UseJwtBearerAuthentication is obsolete?

[vrooijen]

As I was redirected from https://github.com/dotnet/cli/issues/6373 I ask my question here:

Steps to reproduce

dotnet publish -r ubuntu.16.04-arm

Expected behavior

Published application

Actual behavior

Microsoft (R) Build Engine version 15.2.93.5465
Copyright (C) Microsoft Corporation. All rights reserved.

Startup.cs(99,11): error CS0117: 'JwtBearerOptions' does not contain a definition for 'AutomaticAuthenticate' [C:\Tools\dotnet 2\webapp\WebApplication.csproj]
Startup.cs(100,11): error CS0117: 'JwtBearerOptions' does not contain a definition for 'AutomaticChallenge' [C:\Tools\dotnet 2\webapp\WebApplication.csproj]
Startup.cs(97,7): error CS0619: 'JwtBearerAppBuilderExtensions.UseJwtBearerAuthentication(IApplicationBuilder, JwtBearerOptions)' is obsolete: 'See https://go.microsoft.com/fwlink/?linkid=845470' [C:\Tools\dotnet 2\webapp\WebApplication.csproj]

Environment data

CLI version: 2.0.0-preview1-005791
TargetFramework: netcoreapp2.0
RuntimeFrameworkVersion: 2.0.0-preview1-002028-00
RuntimeIdentifiers: ubuntu.16.04-arm
Microsoft.AspNetCore.Authentication.JwtBearer: 2.0.0-preview1-002028-00

I can't find information what to use now, is this really obsolete?

[vrooijen]

I found the code in the dev branch:
https://github.com/aspnet/Security/blob/dev/src/Microsoft.AspNetCore.Authentication.JwtBearer/JwtBearerAppBuilderExtensions.cs

Moving the section from 'Configure' to the 'Startup' method and using services.AddJwtBearerAuthentication(options => { /* configure options.TokenValidationParameters */ }); does the job.

The thing I am missing is AutomaticAuthenticate/AutomaticChallenge which is removed in JwtBearerOptions. This made me use the AuthorizeAttribute without any additional configuration. Now I get an 403

The server logs "authenticationscheme bearer was forbidden"

Update: had to add
services.AddAuthorization(options => { options.DefaultPolicy = new AuthorizationPolicyBuilder(JwtBearerDefaults.AuthenticationScheme) .RequireAuthenticatedUser() .Build(); });

Issue solved!

[Tratcher]

@HaoK ?

[HaoK]

The replacement for: Automatic is setting DefaultAuthenticate/ChallengeScheme via

services.AddAuthentication(o => 
{
   o.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
   o.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
});

I'll open a breaking change announcement later today with more details

[ranouf]

Hi,

Before I had this code:

in Configure
[...]
            var options = new JwtBearerOptions
            {
                Audience = Configuration["auth0:clientId"],
                Authority = $"https://{Configuration["auth0:domain"]}/"
            };
            app.UseJwtBearerAuthentication(options);
[...]

Now I have this:

in ConfigureServices
1/
            //JWT
            services.AddAuthorization(options =>
            {
                options.DefaultPolicy = new AuthorizationPolicyBuilder(JwtBearerDefaults.AuthenticationScheme)
                    .RequireAuthenticatedUser()
                    .Build();
            }
            );
            services.AddAuthentication(o =>
            {
                o.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
                o.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
            });

Or

2/
            //JWT
            services.AddAuthorization(options =>
            {
                options.DefaultPolicy = new AuthorizationPolicyBuilder(JwtBearerDefaults.AuthenticationScheme)
                    .RequireAuthenticatedUser()
                    .Build();
            }
`

It doesnt work. I can t call [Authorize] endpoint.
I dont understand how can I specify the OAuth settings? 
Can you help me to find a solution please?

[Tratcher]

@ranouf https://github.com/aspnet/Security/blob/c5b566ed4abffac4cd7011e0465e012cf503c871/samples/JwtBearerSample/Startup.cs#L47-L53

[ranouf]

Thank you @Tratcher !

And for the next who have the same error, don t forget to add " app.UseAuthentication();" in Configure.

[goforgold]

What is the replacement of TokenValidationParameters from JwtBearerOptions ?

My existing code is:
app.UseJwtBearerAuthentication(new JwtBearerOptions { AutomaticAuthenticate = true, AutomaticChallenge = true, TokenValidationParameters = tokenValidationParameters });

cannot find equivalent replacement.

Any suggestion?

Added later:

I tried this

services.AddJwtBearerAuthentication(o =>
            {
                o.TokenValidationParameters = tokenValidationParameters;
            });

But m not sure, if I use above, do I still need to call services.AddAuthentication? If yes, then does the sequence matter?

[Tratcher]

Yes, you also should call AddAuthentication to specify your default schemes.

[mubavoice]

After I have updated my runtime from Preview 2.0 to 2.0.0-rtm-26425, my code started to break. In my code, I was previously using TokenValidationParameters for Jwt authentication as specified in this example link http://www.c-sharpcorner.com/article/handle-refresh-token-using-asp-net-core-2-0-and-json-web-token/

Now when I compile, I could not find the extension method. I am getting the below exception when I compile my project.

Error CS1061 'IServiceCollection' does not contain a definition for 'AddJwtBearerAuthentication' and no extension method 'AddJwtBearerAuthentication' accepting a first argument of type 'IServiceCollection' could be found (are you missing a using directive or an assembly reference?)

Any help on how to solve this issue?

[Tratcher]

For RTM those extensions have moved one level down to an auth builder:
aspnet/Announcements#262

    services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)
                .AddCookie(o => o.LoginPath = new PathString("/login"))
                .AddFacebook(o =>
                {
                    o.AppId = Configuration["facebook:appid"];
                    o.AppSecret = Configuration["facebook:appsecret"];
                });

[mubavoice]

Thanks @Tratcher, I have fixed the issue with below line services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme).AddJwtBearer(o => { o.TokenValidationParameters = tokenValidationParameters; });

[jculverwell]

Thanks, this worked for me as well.

services.AddAuthentication(options =>
{
options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
}).AddJwtBearer(options =>
{
options.Audience = Configuration["MySettings:Auth0Settings:Audience"];
options.Authority = Configuration["MySettings:Auth0Settings:Authority"];
});