IdentityServer4: New & Improved for ASP.NET Core - Brock Allen & Dominick Baier
Why Stack Overflow recommends it
Stack Overflow users link it as the authors' own introduction to IdentityServer4, for grant types, UI changes and token-storage advice such as SaveTokens.
Recommended by 1 people across 1 different months, 2017 to 2017.
What it is
A conference talk from NDC London 2017 by Brock Allen and Dominick Baier, the authors of IdentityServer. It walks through IdentityServer4, the rewrite of their OpenID Connect and OAuth 2.0 framework for ASP.NET Core, and what changed compared with earlier versions.
What people said
Recommends Lex Kuncevic · 2017-05 · Stack Overflow · on “Talking to IdentityServer4 with an Angular SPA application for authentication/authorization receiving a token then talking to Web API”
Identity Server has different flows/grant types , the one you talking about called implicit [LINK] in that case Identity Server will return a jwt token so you have to be storing that jwt token on a client and then attaching that token to request header when requesting your secure webapi routes. [LINK] Official samples [LINK] it is very good starting point also checkout their blog [LINK] that has lots of useful info covering the topic. Talking about the good videos on the topic here is a good one from the recent NDC conf IdentityServer4: New & Improved for ASP.NET Core [this video] also if you want to learn stuff more deeply you can checkout this pluralsignt course [LINK] by Dominick Baier
Cites Rob L · 2017-04 · Stack Overflow · on “What happened to the UI in IdentityServer4?”
After playing with this for a few weeks I feel like I can answer this question to help other developers. Yes, you will need to implement your own from scratch or use the Quickstart UI and modify it as needed. This came from the fact that in IdentityServer3 developers often needed a way to override the pre-created UI. I'd recommend others to follow the QuickstartUI as a guideline and cannibalize/modify the code to fit your specification. See here [this video]
Cites Wellspring · 2017-12 · Stack Overflow · on “SaveTokens = true stupid in OpenIdConnect Middleware?”
I noted that Dominick Baier says (around the 46:10 mark of this video [this video] ... NDC 2017 London IdentityServer4 presentation) that setting SaveTokens = True is not a good idea for other reasons involving cookies getting too large. ...And now I think of it... isn't he leastprivilege?