Setup JWT Manual Clerk.net with .Net 8 Web API

[ttaylor29]

Hello,

I am new to Clerk.com. I'm trying to start a next.js app with Clerk.

I want to do all of my backend with .NET Core WEB API.

I figured out tonight how to do a manual JWT.

I want to just basically use the front end for the user to sign in and then use that token/JWT to verify they are authenticated.

I tried to set up your code and for some reason, I have a 401 not authorized when I make the call from my next.js app.

I would rather use your SDK for .NET compared to checking manual JWTs and then using the userId from the principle to go and query their API and setting the claims.

Do you know what I'm doing wrong by chance?

Here is my .tsx file:

[Hawxy]

The ClerkAuthority URL you've provided likely isn't valid. Make sure your appsettings.json is correct.

[ttaylor29]

@Hawxy Let me try this.

[ttaylor29]

This is what I have:

"ClerkAuthority": "https://X.clerk.accounts.dev",
"ClerkAuthorizedParty": "http://localhost:3000",

Is this right?

It seems like it is pulling these values in, but nothing happens when I navigate to the web api.

[ttaylor29]

@Hawxy

I was not setting the IssuerSigningKey = new RsaSecurityKey(rsa), part.

Here is my code:

Program.cs section to add JWT items:

                    builder.Services.AddClerkApiClient(config =>
                    {
                        config.SecretKey = builder.Configuration["ClerkSecretKey"];
                    });


                    builder.Services.AddJwtBearerAuthentication(builder.Configuration, builder.Services.BuildServiceProvider().GetRequiredService<IHttpClientFactory>());

Here is a static file I made. This sets the claims for me as well.

using Microsoft.AspNetCore.Authentication.JwtBearer;
using Microsoft.IdentityModel.Tokens;
using System.Net.Http.Headers;
using System.Security.Claims;
using System.Security.Cryptography;
using System.Text.Json;

namespace WebAPINext.Configuration
{
    public static class JwtBearerAuthenticationConfiguration
    {
        public static void AddJwtBearerAuthentication(
            this IServiceCollection services, IConfiguration configuration, IHttpClientFactory httpClientFactory)
        {
            services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
                .AddJwtBearer(options =>
                {
                    // Assume publicKey is your Clerk instance's public RSA key in PEM format
                    var pemFormat = configuration["ClerkPublicKeyPemFormat"];

                    if (pemFormat == null)
                    {
                        throw new Exception(nameof(pemFormat));
                    }

                    RSA rsa = RSA.Create();
                    rsa.ImportFromPem(pemFormat.ToCharArray());

                    options.Authority = configuration["ClerkAuthority"];
                    options.TokenValidationParameters = new TokenValidationParameters
                    {
                        ValidateAudience = false,
                        ValidateIssuerSigningKey = true,
                        ValidateLifetime = true,
                        IssuerSigningKey = new RsaSecurityKey(rsa),
                        ValidateIssuer = false,
                        ClockSkew = TimeSpan.Zero
                    };
                    options.Events = new JwtBearerEvents
                    {
                        OnTokenValidated = async context =>
                        {
                            var azp = context.Principal?.FindFirstValue("azp");
                            if (string.IsNullOrEmpty(azp) || !azp.Equals(configuration["ClerkAuthorizedParty"]))
                            {
                                context.Fail("AZP Claim is invalid or missing");
                                return;
                            }

                            await SetClaims(context, configuration, httpClientFactory).ConfigureAwait(false);
                        },
                    };
                });
        }

        private static async Task SetClaims(TokenValidatedContext context, IConfiguration configuration, IHttpClientFactory httpClientFactory)
        {
            try
            {
                // Assuming 'configuration' and 'context' are available in the scope
                var clerkApiKey = configuration["ClerkSecretKey"];
                if (string.IsNullOrEmpty(clerkApiKey))
                {
                    throw new InvalidOperationException("Clerk API key is not configured properly.");
                }

                var userIdClaim = context.Principal.Claims.FirstOrDefault(c => c.Type == "user_id" || c.Type == ClaimTypes.NameIdentifier);
                if (userIdClaim == null || string.IsNullOrEmpty(userIdClaim.Value))
                {
                    throw new InvalidOperationException("User ID claim is not available.");
                }

                string userId = userIdClaim.Value;
                string clerkApiUrl = $"https://api.clerk.com/v1/users/{userId}";

                using var client = httpClientFactory.CreateClient();
                client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", clerkApiKey);

                var response = await client.GetAsync(clerkApiUrl);
                if (!response.IsSuccessStatusCode)
                {
                    Console.WriteLine("Failed to retrieve user details from Clerk.");
                    return;
                }

                var responseBody = await response.Content.ReadAsStringAsync();
                using var jsonDoc = JsonDocument.Parse(responseBody);

                var user = jsonDoc.RootElement;

                var id = user.GetProperty("id").GetString();
                var emailAddress = user.GetProperty("email_addresses")[0].GetProperty("email_address").GetString();
                var firstName = user.GetProperty("first_name").GetString();
                var lastName = user.GetProperty("last_name").GetString();
                var userName = user.GetProperty("username").GetString();

                var claims = new List<Claim>
                {
                    new Claim(ClaimTypes.NameIdentifier, id),
                    new Claim(ClaimTypes.Name, userName),
                    new Claim("firstName", firstName),
                    new Claim("lastName", lastName),
                    new Claim(ClaimTypes.Email, emailAddress),
                };

                if (context.Principal.Identity is ClaimsIdentity claimsIdentity)
                {
                    claimsIdentity.AddClaims(claims);
                }
            }
            catch (Exception ex)
            {
                Console.WriteLine($"Error in VerifyTokenWithClerkAsync: {ex.Message}");
            }
        }
    }
}

[ttaylor29]

I'm sure this can be cleaned up more in the future.

[Hawxy]

None of that code should be needed, ASP.NET Core queries Clerk's JWKs and grabs the public key itself via https://*.clerk.accounts.dev/.well-known/jwks.json. I just retested this now and my example works fine.

[ttaylor29]

Well, interesting. I'm not sure what else it is? I verified the Authority item. Do you have a test Web Api .Net 8? Sent from my Verizon, Samsung Galaxy smartphone Get Outlook for Android<https://aka.ms/AAb9ysg>

…

________________________________ From: JT ***@***.***> Sent: Tuesday, March 26, 2024 9:15:32 PM To: Hawxy/Clerk.Net ***@***.***> Cc: ttaylor29 ***@***.***>; Author ***@***.***> Subject: Re: [Hawxy/Clerk.Net] Setup JWT Manual Clerk.net with .Net 8 Web API (Discussion #6) None of that code should be needed, ASP.NET Core queries Clerk's JWKs and grabs the public key itself via https://*.clerk.accounts.dev/.well-known/jwks.json. I just retested this now and my example works fine. — Reply to this email directly, view it on GitHub<#6 (reply in thread)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AFTY7X5TVKHV6MWFZ7S37GTY2ITUJAVCNFSM6AAAAABFH6XSCSVHI2DSMVQWIX3LMV43SRDJONRXK43TNFXW4Q3PNVWWK3TUHM4DSMRSGQ3TE>. You are receiving this because you authored the thread.Message ID: ***@***.***>

[ttaylor29]

Now I'm seeing logs though in my console after I moved the secret.json items to my appsettings.Development.json file.

[Hawxy]

Yeah it's as I thought, there's no JWKs being loaded and thus no public key to check against. I've never seen this type of behavior before.

I'd suggest cloning my sample, adding the basic config and seeing if your frontend can hit it, just to rule out something being odd in your own project.

[ttaylor29]

I found it!!!!!!!!!!!!!!!!!!!!!!!!

Look at this URL: https://stackoverflow.com/a/78200588

I did what they said (removed those references that somehow I added via another process, I guess (maybe OAuth setup)).

NOW YOUR CODE WORKS PERFECT!!!

I need to add my claims via the website so I don't have to return to get them via an API call.

[Hawxy]

Man that's very unfortunate. I'm surprised having both installed caused such a conflict. Glad you worked it out though as I was effectively out of ideas.

[ttaylor29]

@Hawxy Thanks again for your help! Not saying I won't have more questions as I become more familiar with NextJS / Clerk.com / React with your awesome product!

[appwebcaddy]

Few things that was not clear in the docs are:

1. In order to get the token, you need to create a JWT Template, this is in Clerk Dashboard. simple default empty template will do.
2. check the token https://jwt.io/ make sure is valid
3. docs says: "If the azp claim does not exist, then you can skip this step." so if (string.IsNullOrEmpty(azp) || )... error should not return an error.
   https://clerk.com/docs/backend-requests/handling/manual-jwt#verify-the-token-signature
4. if not sure about what is your clerk Authority, go to Clerk Dashboard > Developers > API Keys > Show API URLs > Frontend API URL

[Hawxy]

In order to get the token, you need to create a JWT Template

This isn't true at all. Clerks session token (which is a JWT) works fine. It can be expanded via the customization options if needed.

check the token https://jwt.io/ make sure is valid

Sure, that's useful to do, but I'm assuming a user has at least a basic understanding of JWTs in my example.

docs says: "If the azp claim does not exist, then you can skip this step."

If you're using the Clerk JS SDK within a SPA to generate tokens then the azp claim should always be present, which is what I would consider the common usage of having an ASP.NET Core backend. If azp is missing, your usage is unusual.

[appwebcaddy]

@Hawxy this how I generate the token using clerk with NextJs... I am not sure why the api required the template to generate the token, and why the azp is not present? notice I am using a new free clerk account in dev mode.
Can you provide us with an example/doc link, how you generate your JWT token?

[Hawxy]

I use the front-end session token (I personally don't use JS SSR frameworks, I typically use a SPA/static site). If you're sending requests from Next SSR, then you'll want to read the __session cookie to grab the JWT (afaik)