Skip to Content
DocsClientsDotnetAuthentifizierung

Authentifizierung

Der .NET Client unterstützt OAuth 2.0 Authentifizierung über die ProcessCube® Authority mit verschiedenen Flows.

Client Credentials Flow

Der empfohlene Flow für Service-to-Service Kommunikation:

using ProcessCube.Engine;
using ProcessCube.Engine.Client.Identity;
 
// Identity Provider erstellen
var identityProvider = new ClientCredentialsIdentityProvider(
    authorityAddress: "http://localhost:11235",
    clientId: "my-service",
    clientSecret: "secret-key",
    scope: "engine_read engine_write"
);
 
// Token abrufen
var identity = await identityProvider.GetIdentityAsync();
 
// Client mit Identity erstellen
var client = ClientFactory.CreateProcessDefinitionsClient(
    engineAddress: "http://localhost:8000",
    identity: identity
);
 
// Authentifizierte Requests ausführen
var processes = await client.GetProcessModelsAsync();

Client Credentials benötigen in der Authority einen registrierten OAuth 2.0 Client mit client_credentials Grant Type.

Scopes

Verfügbare Scopes für Engine-Zugriff:

ScopeBeschreibung
engine_readLesezugriff auf Prozesse und Instanzen
engine_writeSchreibzugriff (Deploy, Start, Terminate)
engine_etwExternal Task Worker Zugriff
engine_usertaskUser Task Zugriff

Mehrere Scopes verwenden

var identityProvider = new ClientCredentialsIdentityProvider(
    authorityAddress: "http://localhost:11235",
    clientId: "admin-service",
    clientSecret: "secret-key",
    scope: "engine_read engine_write engine_etw engine_usertask"
);

Periodische Token-Erneuerung

Für lang laufende Anwendungen:

using ProcessCube.Engine.Client.Identity;
 
var identityProvider = new ClientCredentialsIdentityProvider(
    authorityAddress: "http://localhost:11235",
    clientId: "my-service",
    clientSecret: "secret-key",
    scope: "engine_read engine_write"
);
 
// Periodische Provisionierung starten
var identityHolder = await identityProvider.StartPeriodicProvisioningAsync();
 
// Client mit IdentityHolder erstellen (Token wird automatisch erneuert)
var client = ClientFactory.CreateProcessDefinitionsClient(
    engineAddress: "http://localhost:8000",
    identityHolder: identityHolder
);
 
// Verwenden...
var processes = await client.GetProcessModelsAsync();
 
// Provisionierung stoppen wenn nicht mehr benötigt
await identityHolder.StopPeriodicProvisioningAsync();

Tokens haben eine begrenzte Lebenszeit (z.B. 1 Stunde). Verwenden Sie periodische Provisionierung für lang laufende Services.

Resource Owner Password Flow

Für Benutzer-Authentifizierung:

using ProcessCube.Engine.Client.Identity;
 
var identityProvider = new ResourceOwnerPasswordIdentityProvider(
    authorityAddress: "http://localhost:11235",
    clientId: "my-app",
    username: "alice@company.com",
    password: "user-password",
    scope: "engine_read engine_write"
);
 
var identity = await identityProvider.GetIdentityAsync();
 
var client = ClientFactory.CreateProcessDefinitionsClient(
    engineAddress: "http://localhost:8000",
    identity: identity
);

Token-Informationen

Token-Informationen aus der Identity abrufen:

var identityProvider = new ClientCredentialsIdentityProvider(
    authorityAddress: "http://localhost:11235",
    clientId: "my-service",
    clientSecret: "secret-key",
    scope: "engine_read"
);
 
var identity = await identityProvider.GetIdentityAsync();
 
Console.WriteLine($"Token Type: {identity.TokenType}");
Console.WriteLine($"Access Token: {identity.AccessToken.Substring(0, 20)}...");
Console.WriteLine($"Expires In: {identity.ExpiresIn} seconds");
Console.WriteLine($"User ID: {identity.UserId}");

Dependency Injection (ASP.NET Core)

// Program.cs oder Startup.cs
public void ConfigureServices(IServiceCollection services)
{
    // Authority-Konfiguration
    services.AddSingleton<IIdentityProvider>(sp =>
    {
        var config = sp.GetRequiredService<IConfiguration>();
 
        return new ClientCredentialsIdentityProvider(
            authorityAddress: config["ProcessCube:AuthorityAddress"],
            clientId: config["ProcessCube:ClientId"],
            clientSecret: config["ProcessCube:ClientSecret"],
            scope: "engine_read engine_write"
        );
    });
 
    // Client-Factory mit Identity
    services.AddSingleton<IProcessDefinitionsClient>(sp =>
    {
        var config = sp.GetRequiredService<IConfiguration>();
        var identityProvider = sp.GetRequiredService<IIdentityProvider>();
 
        var identity = identityProvider.GetIdentityAsync().Result;
 
        return ClientFactory.CreateProcessDefinitionsClient(
            config["ProcessCube:EngineAddress"],
            identity
        );
    });
}

appsettings.json Konfiguration

{
  "ProcessCube": {
    "EngineAddress": "http://localhost:8000",
    "AuthorityAddress": "http://localhost:11235",
    "ClientId": "my-service",
    "ClientSecret": "secret-key",
    "Scopes": "engine_read engine_write"
  }
}

Fehlerbehandlung

using ProcessCube.Engine.Client.Identity;
using ProcessCube.Engine.Client.Exceptions;
 
try
{
    var identityProvider = new ClientCredentialsIdentityProvider(
        authorityAddress: "http://localhost:11235",
        clientId: "my-service",
        clientSecret: "wrong-secret",
        scope: "engine_read"
    );
 
    var identity = await identityProvider.GetIdentityAsync();
}
catch (AuthenticationException ex)
{
    Console.WriteLine($"Authentifizierung fehlgeschlagen: {ex.Message}");
}
catch (HttpRequestException ex)
{
    Console.WriteLine($"Authority nicht erreichbar: {ex.Message}");
}

Token-Cache implementieren

public class CachedIdentityProvider
{
    private readonly IIdentityProvider _innerProvider;
    private Identity? _cachedIdentity;
    private DateTime _expirationTime;
 
    public CachedIdentityProvider(IIdentityProvider innerProvider)
    {
        _innerProvider = innerProvider;
    }
 
    public async Task<Identity> GetIdentityAsync()
    {
        // Prüfen ob Token noch gültig ist
        if (_cachedIdentity != null && DateTime.UtcNow < _expirationTime)
        {
            return _cachedIdentity;
        }
 
        // Neuen Token holen
        _cachedIdentity = await _innerProvider.GetIdentityAsync();
 
        // Expiration berechnen (95% der Lifetime)
        _expirationTime = DateTime.UtcNow.AddSeconds(_cachedIdentity.ExpiresIn * 0.95);
 
        return _cachedIdentity;
    }
}

Best Practice: Verwenden Sie periodische Token-Erneuerung für lang laufende Services und cachen Sie Tokens, um unnötige Authority-Requests zu vermeiden.

Nächste Schritte

Application InfoErweiterte Konfiguration