🔐 Keycloak & Plusserver

# JWT Bearer Token Validierung (für APIs)
dotnet add package Microsoft.AspNetCore.Authentication.JwtBearer

# Azure Identity (falls auch Key Vault genutzt wird)
dotnet add package Azure.Identity

# Optional: Keycloak-spezifisches Paket (vereinfacht Config)
dotnet add package Keycloak.AuthServices.Authentication
dotnet add package Keycloak.AuthServices.Authorization

{
  "Keycloak": {
    "realm": "mein-realm",
    "auth-server-url": "https://auth.meine-firma.de/",
    "ssl-required": "external",
    "resource": "mein-dotnet-api",
    "credentials": {
      "secret": "DEIN-CLIENT-SECRET"
    }
  }
}

using System.Security.Claims;
using System.Text.Json;
using Microsoft.AspNetCore.Authentication;

public class KeycloakRoleClaimsTransformation
    : IClaimsTransformation
{
    public Task<ClaimsPrincipal> TransformAsync(
        ClaimsPrincipal principal)
    {
        var identity = (ClaimsIdentity)principal.Identity!;

        // Realm Roles
        var realmAccess = principal.FindFirst("realm_access");
        if (realmAccess != null)
        {
            var roles = JsonDocument
                .Parse(realmAccess.Value)
                .RootElement.GetProperty("roles");

            foreach (var role in roles.EnumerateArray())
            {
                identity.AddClaim(new Claim(
                    ClaimTypes.Role,
                    role.GetString()!));
            }
        }

        return Task.FromResult(principal);
    }
}

using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;

[ApiController]
[Route("api/[controller]")]
public class DataController : ControllerBase
{
    // Nur authentifizierte User
    [HttpGet]
    [Authorize]
    public IActionResult GetAll()
        => Ok("Authentifiziert!");

    // Nur User mit Rolle "admin"
    [HttpGet("admin")]
    [Authorize(Roles = "admin")]
    public IActionResult GetAdmin()
        => Ok("Admin-Bereich!");

    // Policy-basierte Autorisierung
    [HttpDelete("{id}")]
    [Authorize(Policy = "RequireManager")]
    public IActionResult Delete(int id)
        => Ok($"Gelöscht: {id}");
}

// In Program.cs Policy registrieren:
builder.Services.AddAuthorization(options =>
{
    options.AddPolicy("RequireManager", policy =>
        policy.RequireRole("manager", "admin"));
});

using System.Security.Claims;
using System.Text.Json;
using Microsoft.AspNetCore.Authentication;
using Microsoft.AspNetCore.Authentication.JwtBearer;
using Microsoft.IdentityModel.Tokens;

var builder = WebApplication.CreateBuilder(args);
var config = builder.Configuration;

// ==========================================
// Keycloak JWT Bearer Authentication
// ==========================================
var kcUrl = config["Keycloak:auth-server-url"];
var realm = config["Keycloak:realm"];
var audience = config["Keycloak:resource"];

builder.Services
    .AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddJwtBearer(opt =>
    {
        opt.Authority = $"{kcUrl}realms/{realm}";
        opt.Audience = audience;
        opt.RequireHttpsMetadata = true;
        opt.TokenValidationParameters = new()
        {
            ValidateIssuer = true,
            ValidateAudience = true,
            ValidateLifetime = true,
            ValidIssuer = $"{kcUrl}realms/{realm}"
        };
    });

// Keycloak Rollen-Mapping
builder.Services
    .AddTransient<IClaimsTransformation,
        KeycloakRoleClaimsTransformation>();

// Autorisierung mit Policies
builder.Services.AddAuthorization(opt =>
{
    opt.AddPolicy("AdminOnly",
        p => p.RequireRole("admin"));
    opt.AddPolicy("ManagerOrAdmin",
        p => p.RequireRole("manager", "admin"));
});

builder.Services.AddControllers();

var app = builder.Build();

app.UseHttpsRedirection();
app.UseAuthentication();
app.UseAuthorization();
app.MapControllers();
app.Run();