Henara.MetabaseEmbed.Auth 1.1.0
Henara.MetabaseEmbed.Auth
Keycloak OIDC session for native hosts: login, offline token refresh and logout. Its access token is what
Henara.MetabaseEmbed.Client exchanges for embed tokens.
Setup
The host shows the Keycloak login. Register a Duende.IdentityModel.OidcClient.Browser.IBrowser that opens the start URL
and returns the redirect URL, then the session:
services.AddSingleton<IBrowser, MyBrowser>();
services.AddHenaraAuth(configuration);
| Variable | Description |
|---|---|
HENARA_AUTH_AUTHORITY |
Keycloak realm URL |
HENARA_AUTH_CLIENT_ID |
Public OIDC client ID |
HENARA_AUTH_SCOPES |
Space-separated scopes; must include offline_access |
HENARA_AUTH_CALLBACK_SCHEME |
Scheme of the redirect URIs <scheme>:/signin and <scheme>:/signout |
All are required. AddHenaraAuth throws OptionsValidationException when one is missing or invalid.
Tokens are kept in memory. Register an ITokenStorage before AddHenaraAuth to persist them between app starts.
Usage
Inject IAuthSession:
| Member | Description |
|---|---|
LoginAsync |
Signs in through the IBrowser; false when the user cancelled |
GetAccessTokenAsync |
Valid access token, refreshed shortly before it expires; null when not signed in |
LogoutAsync |
Revokes the offline token, clears the stored tokens and ends the Keycloak session |
TryRestoreAsync |
Restores the session from ITokenStorage |
IsAuthenticated, StateChanged |
Session state and its changes |
Failures throw HenaraAuthException.
Hand the token to Henara.MetabaseEmbed.Client:
public sealed class AuthSessionAccessTokenProvider(IAuthSession session) : IKeycloakAccessTokenProvider
{
public Task<string?> GetAccessTokenAsync(CancellationToken ct = default) => session.GetAccessTokenAsync(ct);
}
No packages depend on Henara.MetabaseEmbed.Auth.
.NET 10.0
- Duende.IdentityModel.OidcClient (>= 7.1.1)
- Microsoft.Extensions.Configuration.Binder (>= 10.0.14)
- Microsoft.Extensions.DependencyInjection.Abstractions (>= 10.0.14)
- Microsoft.Extensions.Options (>= 10.0.14)