elsa-workflows / elsa-workflows/elsa-core
Documentation for setting up authentication for server & dashboard
- Dominant language
- C#
- Stars
- 7.9k
- Forks
- 1.5k
- Avg merge
- 15h 22m
- Merged PRs (30d)
- 114
Description
We need to document how to configure the workflow server (ASP.NET Core) with authentication middleware and securing the Elsa API controllers and how to configure the dashboard with a plugin to send access tokens to the backend.
The documentation should be created [as a guide](https://github.com/elsa-workflows/elsa-website/tree/master/docs/guides) and should describe the following:
### Identity Provider
- As an example, setup Azure B2C that acts as the identity provider. Or any other identity provider is fine also, ideally one that has a free tier or at least a free trial.
### ASP.NET Core
- Configure Authentication Middleware (Open ID Connect as an example).
- Protect Elsa API controllers.
### Dashboard
- Create a dashboard plugin that adds Axios middleware to attach an access token.
Some sample snippets that can be used as input for the documentation:
In startup:
```
// ConfigureServices:
services
.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
.AddJwtBearer(JwtBearerDefaults.AuthenticationScheme, options => { ... });
services.AddAuthorization();
...
// Configure:
app
.UseAuthentication()
.UseAuthorization()
.UseEndpoints(endpoints =>
{
endpoints
.MapControllers()
.RequireAuthorization(); // Protects all controllers, including Elsa's API controllers. It's like adding `[AuthorizeAttribute]` to all controllers
});
```
In the front-end, the following plugin can be created to read an access token from a locally stored cookie:
```javascript
function AuthPlugin(elsaStudio) {
const {eventBus} = elsaStudio;
const getAccessToken = async () => {
const httpClient = axios.create({
baseURL: window.location.origin
});
try {
const response = await httpClient.get('.auth/me');
return response.data[0].id_token;
} catch (e) {
console.warn(e.response);
return null;
}
};
const configureAuthMiddleware = async (e) => {
const token = await getAccessToken();
if (!token)
return;
e.register({
onRequest(request) {
request.headers = {'Authorization': `Bearer ${token}`};
return request;
}
});
};
// Handle the "http-client-created" event so we con configure the http client.
eventBus.on('http-client-created', configureAuthMiddleware);
}
```
To register a plugin, see: https://elsa-workflows.github.io/elsa-core/docs/next/extensibility/extensibility-designer-plugins#custom-plugins.
Contributor guide
Research direction
Start in the elsa-website docs/guides directory and review the custom plugins guidance linked in the issue. Build a guide covering an identity provider example, ASP.NET Core authentication middleware, protection for Elsa API controllers, and a dashboard plugin that attaches access tokens. Done means each requested setup area is documented with the provided snippets or an equivalent example.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure, csharp, javascript
- Domain
- authentication, backend, documentation, frontend
- Issue type
- Documentation
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100