skoruba / identityserver4.admin

The administration for the IdentityServer4 and Asp.Net Core Identity

Skoruba.IdentityServer4.Admin

The administration for the IdentityServer4 and Asp.Net Core Identity

Project Status

The application is written in the Asp.Net Core MVC - using .NET 6

🎉 New version of Duende IdentityServer Admin UI available here ⚡

Requirements

• Install the latest .NET 6 SDK (using older versions may lead to 502.5 errors when hosted on IIS or application exiting immediately after starting when self-hosted)

Installation via dotnet new template

• Install the dotnet new template:

Version 2.0.0 and higher works with IdentityServer4 version 4 🚀

• 🔒 NOTE: This version affects your database data if you use the default database migrations that are part of the project - double check the migrations according to your database provider and create a database backup

dotnet new -i Skoruba.IdentityServer4.Admin.Templates::2.1.0

Create new project:

dotnet new skoruba.is4admin --name MyProject --title MyProject --adminemail "[email protected]" --adminpassword "Pa$$word123" --adminrole MyRole --adminclientid MyClientId --adminclientsecret MyClientSecret --dockersupport true

Project template options:

--name: [string value] for project name
--adminpassword: [string value] admin password
--adminemail: [string value] admin email
--title: [string value] for title and footer of the administration in UI
--adminrole: [string value] for name of admin role, that is used to authorize the administration
--adminclientid: [string value] for client name, that is used in the IdentityServer4 configuration for admin client
--adminclientsecret: [string value] for client secret, that is used in the IdentityServer4 configuration for admin client
--dockersupport: [boolean value] include docker support

How to configure the Administration - IdentityServer4 and Asp.Net Core Identity

• Follow these steps for setup project to use existing IdentityServer4 and Asp.Net Core Identity

Template uses following list of nuget packages

• Available nuget packages

Running in Visual Studio

• Set Startup projects:
  • Skoruba.IdentityServer4.Admin
  • Skoruba.IdentityServer4.Admin.Api
  • Skoruba.IdentityServer4.STS.Identity

Configuration of Administration for Deployment

• Configuration of Admin for deploy on Azure
• Configuration of Admin on Ubuntu with PostgreSQL database

Administration UI preview

• This administration uses bootstrap 4

Admin UI - Light mode 🌞

Admin UI - Dark mode 🌙

Security token service (STS)

Forms

Cloning

git clone https://github.com/skoruba/IdentityServer4.Admin

Running via Docker

• It is possible to run Admin UI through the docker.

Docker setup

DNS

We need some resolving capabilities in order for the project to work. The domain skoruba.local is used here to represent the domain this setup is hosted on. The domain-name needs to be FQDN (fully qualified domain name).

Thus first, we need the domain skoruba.local to resolve to the docker-host machine. If you want this to work on your local machine only, use the first option.

DNS on docker-host machine only

Edit your hosts file:

• On Linux: \etc\hosts
• On Windows: C:\Windows\system32\drivers\etc\hosts

and add the following entries:

127.0.0.1 skoruba.local sts.skoruba.local admin.skoruba.local admin-api.skoruba.local

This way your host machine resolves skoruba.local and its subdomains to itself.

Certificates

We also need certificates in order to serve on HTTPS. We'll make our own self-signed certificates with mkcert.

If the domain is publicly available through DNS, you can use Let's Encypt. Nginx-proxy has support for that, which is left out in this setup.

MkCert

Create the root certificate

Use mkcert to generate local self-signed certificates.

On windows mkcert -install must be executed under elevated Administrator privileges. Then copy over the CA Root certificate over to the project as we want to mount this in later into the containers without using an environment variable.

cd shared/nginx/certs
mkcert --install
copy $env:LOCALAPPDATA\mkcert\rootCA.pem ./cacerts.pem
copy $env:LOCALAPPDATA\mkcert\rootCA.pem ./cacerts.crt

Create the skoruba.local certificates

Generate a certificate for skoruba.local with wildcards for the subdomains. The name of the certificate files need to match with actual domain-names in order for the nginx-proxy to pick them up correctly. We want both the crt-key and the pfx version.

cd shared/nginx/certs
mkcert -cert-file skoruba.local.crt -key-file skoruba.local.key skoruba.local *.skoruba.local
mkcert -pkcs12 skoruba.local.pfx skoruba.local *.skoruba.local

This docker setup is come from this repository - thanks to bravecobra. 😊

Run docker-compose

• Project contains the docker-compose.vs.debug.yml and docker-compose.override.yml to enable debugging with a seeded environment.
• The following possibility to get a running seeded and debug-able (in VS) environment:

docker-compose build
docker-compose up -d

It is also possible to set as startup project the project called docker-compose in Visual Studio.

Docker images

• Docker images will be available also in docker hub

Publish Docker images to Docker hub

• Check the script in build/publish-docker-images.ps1 - change the profile name according to your requirements.

Installation of the Client Libraries

cd src/Skoruba.IdentityServer4.Admin
npm install

cd src/Skoruba.IdentityServer4.STS.Identity
npm install

Bundling and Minification

The following Gulp commands are available:

• gulp fonts - copy fonts to the dist folder
• gulp styles - minify CSS, compile SASS to CSS
• gulp scripts - bundle and minify JS
• gulp clean - remove the dist folder
• gulp build - run the styles and scripts tasks
• gulp watch - watch all changes in all sass files

EF Core & Data Access

• The solution uses these DbContexts:

  • AdminIdentityDbContext: for Asp.Net Core Identity
  • AdminLogDbContext: for logging
  • IdentityServerConfigurationDbContext: for IdentityServer configuration store
  • IdentityServerPersistedGrantDbContext: for IdentityServer operational store
  • AdminAuditLogDbContext: for Audit Logging
  • IdentityServerDataProtectionDbContext: for dataprotection

Run entity framework migrations:

NOTE: Initial migrations are a part of the repository.

• It is possible to use powershell script in folder build/add-migrations.ps1.

• This script take two arguments:

  • --migration (migration name)
  • --migrationProviderName (provider type - available choices: All, SqlServer, MySql, PostgreSQL)

• For example: .\add-migrations.ps1 -migration DbInit -migrationProviderName SqlServer

Available database providers:

• SqlServer
• MySql
• PostgreSQL

It is possible to switch the database provider via appsettings.json:

"DatabaseProviderConfiguration": {
        "ProviderType": "SqlServer" 
    }

Connection strings samples for available db providers:

PostgreSQL:

Server=localhost;Port=5432;Database=IdentityServer4Admin;User Id=sa;Password=#;

MySql:

server=localhost;database=IdentityServer4Admin;user=root;password=#

We suggest to use seed data:

• In Program.cs -> Main, uncomment DbMigrationHelpers.EnsureSeedData(host) or use dotnet CLI dotnet run /seed or via SeedConfiguration in appsettings.json
• The Clients and Resources files in identityserverdata.json (section called: IdentityServerData) - are the initial data, based on a sample from IdentityServer4
• The Users file in identitydata.json (section called: IdentityData) contains the default admin username and password for the first login

Authentication and Authorization

• Change the specific URLs and names for the IdentityServer and Authentication settings in appsettings.json
• In the controllers is used the policy which name is stored in - AuthorizationConsts.AdministrationPolicy. In the policy - AuthorizationConsts.AdministrationPolicy is defined required role stored in - appsettings.json - AdministrationRole.
• With the default configuration, it is necessary to configure and run instance of IdentityServer4. It is possible to use initial migration for creating the client as it mentioned above

Azure Key Vault

• It is possible to use Azure Key Vault and configure it in the appsettings.json with following configuration:

"AzureKeyVaultConfiguration": {
    "AzureKeyVaultEndpoint": "",
    "ClientId": "",
    "ClientSecret": "",
    "UseClientCredentials": true
  }

If your application is running in Azure App Service, you can specify AzureKeyVaultEndpoint. For applications which are running outside of Azure environment it is possible to use the client credentials flow - so it is necesarry to go to Azure portal, register new application and connect this application to Azure Key Vault and setup the client secret.

• It is possible to use Azure Key Vault for following parts of application:

Application Secrets and Database Connection Strings:

• It is necesarry to configure the connection to Azure Key Vault and allow following settings:

"AzureKeyVaultConfiguration": {
    "ReadConfigurationFromKeyVault": true
  }

Dataprotection:

Enable Azure Key Vault for dataprotection with following configuration:

"DataProtectionConfiguration": {
    "ProtectKeysWithAzureKeyVault": false
  }

The you need specify the key identifier in configuration:

"AzureKeyVaultConfiguration": {
    "DataProtectionKeyIdentifier": ""
  }

IdentityServer certificate for signing tokens:

• It is possible to go to Azure Key Vault - generate new certificate and use this certificate name below:

"AzureKeyVaultConfiguration": {
    "IdentityServerCertificateName": ""
  }

Logging

• We are using Serilog with pre-definded following Sinks - white are available in serilog.json:

  • Console
  • File
  • MSSqlServer
  • Seq

{
    "Serilog": {
        "MinimumLevel": {
            "Default": "Error",
            "Override": {
                "Skoruba": "Information"
            }
        },
        "WriteTo": [
            {
                "Name": "Console"
            },
            {
                "Name": "File",
                "Args": {
                    "path": "log.txt",
                    "rollingInterval": "Day"
                }
            },
            {
                "Name": "MSSqlServer",
                "Args": {
                    "connectionString": "...",
                    "tableName": "Log",
                    "columnOptionsSection": {
                        "addStandardColumns": [ "LogEvent" ],
                        "removeStandardColumns": [ "Properties" ]
                    }
                }
            }
        ]
    }
}

Audit Logging

• This solution uses audit logging via - https://github.com/skoruba/AuditLogging (check this link for more detal about this implementation 😊)
• In the Admin UI project is following setup:

services.AddAuditLogging(options => { options.Source = auditLoggingConfiguration.Source; })
                .AddDefaultHttpEventData(subjectOptions =>
                    {
                        subjectOptions.SubjectIdentifierClaim = auditLoggingConfiguration.SubjectIdentifierClaim;
                        subjectOptions.SubjectNameClaim = auditLoggingConfiguration.SubjectNameClaim;
                    },
                    actionOptions =>
                    {
                        actionOptions.IncludeFormVariables = auditLoggingConfiguration.IncludeFormVariables;
                    })
                .AddAuditSinks<DatabaseAuditEventLoggerSink<TAuditLog>>();

            // repository for library
            services.AddTransient<IAuditLoggingRepository<TAuditLog>, AuditLoggingRepository<TAuditLoggingDbContext, TAuditLog>>();

            // repository and service for admin
            services.AddTransient<IAuditLogRepository<TAuditLog>, AuditLogRepository<TAuditLoggingDbContext, TAuditLog>>();
            services.AddTransient<IAuditLogService, AuditLogService<TAuditLog>>();

Admin Configuration

Admin and STS can be customized without editing code in appsettings.json under AdminConfiguration section

Themes

Ui can be customized using themes integrated from bootswatch.

From version 2.0.0 is possible to change theme from UI. 🎈

By default, configuration value is null to use default theme. if you want to use a theme, just fill the lowercase theme name as configuration value of Theme key.

You can also use your custom theme by integrating it in your project or hosting css on your place to pass the url in CustomThemeCss key. (Note that custom theme override standard theme)

• Important Note: Theme can use external resources which caused errors due to CSP. If you get errors, please make sure that you configured correctly CSP section in your appsettings.json with thrusted domains for resources.

  "AdminConfiguration": {
    "PageTitle": "Skoruba IdentityServer4",
    "HomePageLogoUri": "~/images/skoruba-icon.png",
    "FaviconUri": "~/favicon.ico",
    "Theme": "united",
    "CustomThemeCss": null,
    ...
  },

Audit Logging Configuration

In appsettings.json is following configuration:

"AuditLoggingConfiguration": {
    "Source": "IdentityServer.Admin.Web",
    "SubjectIdentifierClaim": "sub",
    "SubjectNameClaim": "name",
    "IncludeFormVariables": false
  }

The Skoruba.IdentityServer4.Admin.BusinessLogic layer contains folder called Events for audit logging. In each method in Services is called function LogEventAsync like this:

await AuditEventLogger.LogEventAsync(new ClientDeletedEvent(client));

Final audit log is available in the table dbo.AuditLog.

Login Configuration

• In Skoruba.IdentityServer4.STS.Identity - in appsettings.json is possible to specify which column will be used for login (Username or Email):

  "LoginConfiguration": {
    "ResolutionPolicy": "Username"
  }

or using Email:

  "LoginConfiguration": {
    "ResolutionPolicy": "Email"    
  }

Register Configuration

• In Skoruba.IdentityServer4.STS.Identity - in appsettings.json is possible to disable user registration (default: true):

 "RegisterConfiguration": {
    "Enabled": false
  }

How to configure API & Swagger

• For development is running on url - https://localhost:44302 and swagger UI is available on url - https://localhost:44302/swagger
• For swagger UI is configured a client and an API in STS:

"AdminApiConfiguration": {
  "IdentityServerBaseUrl": "https://localhost:44310",
  "OidcSwaggerUIClientId": "skoruba_identity_admin_api_swaggerui",
  "OidcApiName": "skoruba_identity_admin_api"
}

• Swagger UI contains following endpoints:

How to configure an external provider in STS

• In Skoruba.IdentityServer4.STS.Identity/Helpers/StartupHelpers.cs - is method called AddExternalProviders which contains the example with GitHub, AzureAD configured in appsettings.json:

"ExternalProvidersConfiguration": {
        "UseGitHubProvider": false,
        "GitHubClientId": "",
        "GitHubClientSecret": "",
        "UseAzureAdProvider": false,
        "AzureAdClientId": "",
        "AzureAdTenantId": "",
        "AzureInstance": "",
        "AzureAdSecret": "",
        "AzureAdCallbackPath": "",
        "AzureDomain": "" 
}

• It is possible to extend ExternalProvidersConfiguration with another configuration properties.
• If you use DockerHub built image, you can use appsettings to configure these providers without changing the code
  • GitHub
  • AzureAD

List of external providers for ASP.NET Core:

• https://github.com/aspnet-contrib/AspNet.Security.OAuth.Providers
• https://docs.microsoft.com/en-us/aspnet/core/security/authentication/social/

Azure AD

• Great article how to set up Azure AD:
  • https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-v2-aspnet-core-webapp

Email service

• It is possible to set up emails via:

SendGrid

In STS project - in appsettings.json:

"SendgridConfiguration": {
        "ApiKey": "",
        "SourceEmail": "",
        "SourceName": ""
    }

SMTP

"SmtpConfiguration": {
        "From": "",
        "Host": "",
        "Login": "",
        "Password": ""
    }

CSP - Content Security Policy

• If you want to use favicon or logo not included/hosted on the same place, you need to declare trusted domain where resources are hosted in appsettings.json.

  "CspTrustedDomains": [
    "google.com",
    "mydomain.com"
  ],

Health checks

• AdminUI, AdminUI Api and STS contain endpoint health, which check databases and IdentityServer.

Localizations - labels, messages

• The project has following translations:
  • English
  • Chinese
  • Russian
  • Persian
  • Swedish
  • Danish
  • Spanish
  • French
  • Finish
  • German
  • Portuguese

Feel free to send a PR with your translation. 😊

• All labels and messages are stored in the resources .resx - locatated in /Resources

  • Client label descriptions from - http://docs.identityserver.io/en/latest/reference/client.html
  • Api Resource label descriptions from - http://docs.identityserver.io/en/latest/reference/api_resource.html
  • Identity Resource label descriptions from - http://docs.identityserver.io/en/latest/reference/identity_resource.html

Tests

• The solution contains unit and integration tests.

Integration tests use StartupTest class which is pre-configured with:

• DbContext contains setup for InMemory database
• Authentication is setup for CookieAuthentication - with fake login url for testing purpose only
• AuthenticatedTestRequestMiddleware - middleware for testing of authentication.

Overview

Solution structure:

• STS:

  • Skoruba.IdentityServer4.STS.Identity - project that contains the instance of IdentityServer4 and combine these samples - Quickstart UI for the IdentityServer4 with Asp.Net Core Identity and EF Core storage and damienbod - IdentityServer4 and Identity template

• Admin UI Api:

  • Skoruba.IdentityServer4.Admin.Api - project with Api for managing data of IdentityServer4 and Asp.Net Core Identity, with swagger support as well

• Admin UI:

  • Skoruba.IdentityServer4.Admin.UI - ASP.NET Core MVC application that contains Admin UI

  • Skoruba.IdentityServer4.Admin - ASP.NET Core MVC application that uses Admin UI package and it's only for application bootstrap

  • Skoruba.IdentityServer4.Admin.BusinessLogic - project that contains Dtos, Repositories, Services and Mappers for the IdentityServer4

  • Skoruba.IdentityServer4.Admin.BusinessLogic.Identity - project that contains Dtos, Repositories, Services and Mappers for the Asp.Net Core Identity

  • Skoruba.IdentityServer4.Admin.BusinessLogic.Shared - project that contains shared Dtos and ExceptionHandling for the Business Logic layer of the IdentityServer4 and Asp.Net Core Identity

  • Skoruba.IdentityServer4.Shared - Shared common Identity DTOS for Admin UI, Admin UI Api and STS

  • Skoruba.IdentityServer4.Shared.Configuration - Shared common layer for Admin UI, Admin UI Api and STS

  • Skoruba.IdentityServer4.Admin.EntityFramework - EF Core data layer that contains Entities for the IdentityServer4

  • Skoruba.IdentityServer4.Admin.EntityFramework.Configuration - EF Core data layer that contains configurations

  • Skoruba.IdentityServer4.Admin.EntityFramework.Identity - EF Core data layer that contains Repositories for the Asp.Net Core Identity

  • Skoruba.IdentityServer4.Admin.EntityFramework.Extensions - project that contains extensions related to EntityFramework

  • Skoruba.IdentityServer4.Admin.EntityFramework.Shared - project that contains DbContexts for the IdentityServer4, Logging and Asp.Net Core Identity, inluding shared Identity entities

  • Skoruba.IdentityServer4.Admin.EntityFramework.SqlServer - project that contains migrations for SqlServer

  • Skoruba.IdentityServer4.Admin.EntityFramework.MySql - project that contains migrations for MySql

  • Skoruba.IdentityServer4.Admin.EntityFramework.PostgreSQL - project that contains migrations for PostgreSQL

• Tests:

  • Skoruba.IdentityServer4.Admin.IntegrationTests - xUnit project that contains the integration tests for AdminUI

  • Skoruba.IdentityServer4.Admin.Api.IntegrationTests - xUnit project that contains the integration tests for AdminUI Api

  • Skoruba.IdentityServer4.Admin.UnitTests - xUnit project that contains the unit tests for AdminUI

  • Skoruba.IdentityServer4.STS.IntegrationTests - xUnit project that contains the integration tests for STS

The admininistration contains the following sections:

IdentityServer4

Clients

It is possible to define the configuration according the client type - by default the client types are used:

• Empty

• Web Application - Server side - Authorization Code Flow with PKCE

• Single Page Application - Javascript - Authorization Code Flow with PKCE

• Native Application - Mobile/Desktop - Authorization Code Flow with PKCE

• Machine/Robot - Client Credentials flow

• TV and Limited-Input Device Application - Device flow

• Actions: Add, Update, Clone, Remove

• Entities:

  • Client Cors Origins
  • Client Grant Types
  • Client IdP Restrictions
  • Client Post Logout Redirect Uris
  • Client Properties
  • Client Redirect Uris
  • Client Scopes
  • Client Secrets

API Resources

• Actions: Add, Update, Remove
• Entities:
  • Api Claims
  • Api Scopes
  • Api Scope Claims
  • Api Secrets
  • Api Properties

Identity Resources

• Actions: Add, Update, Remove
• Entities:
  • Identity Claims
  • Identity Properties

Asp.Net Core Identity

Users

• Actions: Add, Update, Delete
• Entities:
  • User Roles
  • User Logins
  • User Claims

Roles

• Actions: Add, Update, Delete
• Entities:
  • Role Claims

Application Diagram

Roadmap & Vision

1.0.0:

• Create the Business Logic & EF layers - available as a nuget package
• Create a project template using dotnet CLI - dotnet new template
  • First template: The administration of the IdentityServer4 and Asp.Net Core Identity
• Add logging into
  • Database
  • File
  • Seq
• Add localization for other languages
  • English
  • Chinese
  • Russian
  • Persian
  • Swedish
  • Danish
  • Spanish
  • French
  • Finish
• Manage profile
• Password reset
• Link account to an external provider (example with Github)
• Two-Factor Authentication (2FA)
• User registration
• Email service
  • SendGrid
• Add API
  • IdentityServer4
  • Asp.Net Core Identity
  • Add swagger support
• Add audit logs to track changes (#61)
• Docker support (#121)
• Health Checks (Databases and IdentityServer)
• Support for multiple database providers (SqlServer, Mysql, PostgreSQL)
• Simplify Admin Identity middleware (#430)
• Add support for loading signing key from Azure Key Vault (#533)
• Protect keys for dataprotection from Azure Key Vault (#715)

2.0.0

• Update to IdentityServer4 version 4 (#633)
• Add support for themes (#725)
• Extract UI part into nuget package (#770, #409, #55, #322, #28, #133)

3.0.0

• Connect Admin Api to the Admin UI (#478)

4.0.0:

• Create a project template using dotnet CLI - dotnet new template
  • Second template: The administration of the IdentityServer4 (without Asp.Net Core Identity) (#79)
• Add windows authentication (#479)

Future:

• Add UI tests (#97, #116)
• Add more unit and integration tests 😊
• Extend administration for another protocols

Licence

This repository is licensed under the terms of the MIT license.

NOTE: This repository uses the source code from https://github.com/IdentityServer/IdentityServer4.Quickstart.UI which is under the terms of the Apache License 2.0.

Acknowledgements

This web application is based on these projects:

• ASP.NET Core
• IdentityServer4.EntityFramework
• ASP.NET Core Identity
• XUnit
• Fluent Assertions
• Bogus
• AutoMapper
• Serilog

Thanks to Tomáš Hübelbauer for the initial code review.

Thanks to Dominick Baier and Brock Allen - the creators of IdentityServer4.

Contributors

Thanks goes to these wonderful people (emoji key):

Jan Škoruba 💻 💬 📖 💡 🤔	Tomáš Hübelbauer 💻 👀 📖 🤔	Michał Drzał 💻 👀 📖 💡 🤔	cerginio 💻 🐛 💡 🤔	Sven Dummis 📖	Seaear 💻 🌍
Rune Antonsen 🐛	Sindre Njøsen 💻	Alevtina Brown 🌍	Brice 💻	TheEvilPenguin 💻	Saeed Rahmani 🌍
Andy Yu 🌍	ChrisSzabo 💻	aiscrim 💻 💡 🤔	HrDahl 🌍	Andrew Godfroy 📖	bravecobra 💻
Sabit Igde 💻	Rico Herlt 💻	b0 💻	DrQwertySilence 🌍	Carl Quirion 💻	Aegide 🌍
LobsterBandit 💻	Mehmet Perk 💻	tapmui 🌍	Saeed Rahimi 💻	Joshua Williams 💻	Shengjie Yan 💻
Anatoliy 💻	Nicholas Peterson 💻	Alec Papierniak 💻	Carl Reid 💻	ViRuSTriNiTy 💻	J. Arturo 💻
Weihan Li 💻	Saša Tančev 💻	cuibty 💻	Simo Paasisalo 💻	klyse 💻	Martinus Suherman 💻
Pavel Usachev 💻	LabTrans - STIGeo 🌍	Valentin LECERF 💻	Thomas Aunvik 🐛	Sebastian Gebhardt 🐛

This project follows the all-contributors specification. Contributions of any kind are welcome!

Contact and Suggestion

I am happy to share my attempt of the implementation of the administration for IdentityServer4 and ASP.NET Core Identity.

Any feedback is welcome - feel free to create an issue or send me an email - [email protected]. Thank you 😊

Support and Donation 🕊️

If you like my work, you can support me by donation. 👍

Paypal

https://www.paypal.me/skoruba

Patreon

https://www.patreon.com/skoruba

identityserver4.admin's Issues

Update project to .NET Core 2.1.

Problem when using mssql server 2008

Good day,

had a problem using Admin pages, none of them opened, had to add .UseRowNumberForPaging()

services.AddDbContext<AdminDbContext>(options => options.UseSqlServer(configuration.GetConnectionString(ConfigurationConsts.AdminConnectionStringKey),
                optionsSql => optionsSql.MigrationsAssembly(migrationsAssembly).UseRowNumberForPaging()));

It is a known problem of EF core.

Best regards and thanks fore the project!

InvalidOperationException accessing Persisted Grants page

Hi,

I am receiving the following error while accessing the Persisted Grants page (/Grant/PersistedGrants):

An unhandled exception occurred while processing the request.
InvalidOperationException: The binary operator Equal is not defined for the types 'System.Nullable`1[System.Int32]' and 'System.Object'.

System.Linq.Expressions.Expression.GetEqualityComparisonOperator(ExpressionType binaryType, string opName, Expression left, Expression right, bool liftToNull)

This is the useful stack trace information:

I have changed only 2 things:

• The project configuration to run it without IIS Express
• The database related code to run using SQLite following the related instructions

The application seem to be working. Clicking everywhere I found this problem. I also tried adding the page and search arguments, but the error still persists.

Thanks!
Renato A. Ferreira

Add Breadcrumb in Layout

If you are client editting page, you don't go back client list. Maybe breadcrumb is good for the project.

Client Secret Key can a Guid

Can you develop this feature?
When I click a button then guid generate and set in secret key textbox

Add new project with API management

Add new project - Skoruba.IdentityServer4.Admin.Api:

• Create a list of API controllers - for managing of the IdentityServer4 and Asp.Net Core Identity
• Add swagger support

Can you consider writting of blog or do a youtube on integrating it

Dear @skoruba ,
Thanks for this work here,
Can you consider writing a blog or do a YouTube on integrating it.

I am still thinking how to customize it and make it fit well with a new solution or existing solutions.

Thanks in anticipations.

Chris

'xml' Column Type on 'Log' entity incompatible with EntityFramework MySql

Hi

First off - great project...

.. but there's a but... We'd prefer to use MySql for the backend database, however the use of the 'xml' column type in the model annotations forces the use of an underlying database engine that supports that specific column type.

For now i've got around this by overriding the AdminDbContext with my own which replaces the xml column type with one compatible with MySql in the ModelBuilder (OnModelCreating) (see below)

using IdentityServer4.EntityFramework.Entities;
using IdentityServer4.EntityFramework.Extensions;
using IdentityServer4.EntityFramework.Options;
using Microsoft.AspNetCore.Identity.EntityFrameworkCore;
using Microsoft.EntityFrameworkCore;
using Skoruba.IdentityServer4.Admin.EntityFramework.Identity.Constants;
using Skoruba.IdentityServer4.Admin.EntityFramework.Entities;
using Skoruba.IdentityServer4.Admin.EntityFramework.Identity.Entities.Identity;
using Skoruba.IdentityServer4.Admin.EntityFramework.Identity.Interfaces;
using Skoruba.IdentityServer4.Admin.EntityFramework.Interfaces;
using System.Threading.Tasks;
using TableConst = Skoruba.IdentityServer4.Admin.EntityFramework.Constants;

namespace Identity.Server.EntityFramework
{
    public class AdminDbContext : IdentityDbContext<UserIdentity, UserIdentityRole, int, UserIdentityUserClaim, UserIdentityUserRole, UserIdentityUserLogin, UserIdentityRoleClaim, UserIdentityUserToken>,
        IAdminConfigurationDbContext, IAdminLogDbContext, IAdminPersistedGrantDbContext, IAdminPersistedGrantIdentityDbContext
    {
        private readonly ConfigurationStoreOptions _storeOptions;
        private readonly OperationalStoreOptions _operationalOptions;

        public AdminDbContext(DbContextOptions<AdminDbContext> options,
            ConfigurationStoreOptions storeOptions,
                OperationalStoreOptions operationalOptions)
            : base(options)
        {
            _storeOptions = storeOptions;
            _operationalOptions = operationalOptions;
        }

        public DbSet<ApiResource> ApiResources { get; set; }

        public DbSet<IdentityResource> IdentityResources { get; set; }

        public DbSet<ApiSecret> ApiSecrets { get; set; }

        public DbSet<ApiScope> ApiScopes { get; set; }

        public DbSet<ApiScopeClaim> ApiScopeClaims { get; set; }

        public DbSet<IdentityClaim> IdentityClaims { get; set; }

        public DbSet<ApiResourceClaim> ApiResourceClaims { get; set; }

        public DbSet<Client> Clients { get; set; }

        public DbSet<ClientGrantType> ClientGrantTypes { get; set; }

        public DbSet<ClientScope> ClientScopes { get; set; }

        public DbSet<ClientSecret> ClientSecrets { get; set; }

        public DbSet<ClientPostLogoutRedirectUri> ClientPostLogoutRedirectUris { get; set; }

        public DbSet<ClientCorsOrigin> ClientCorsOrigins { get; set; }

        public DbSet<ClientIdPRestriction> ClientIdPRestrictions { get; set; }

        public DbSet<ClientRedirectUri> ClientRedirectUris { get; set; }

        public DbSet<ClientClaim> ClientClaims { get; set; }

        public DbSet<ClientProperty> ClientProperties { get; set; }

        public DbSet<PersistedGrant> PersistedGrants { get; set; }

        public DbSet<Log> Logs { get; set; }

        public Task<int> SaveChangesAsync()
        {
            return base.SaveChangesAsync();
        }

        protected override void OnModelCreating(ModelBuilder builder)
        {
            base.OnModelCreating(builder);

            ConfigureIdentityContext(builder);
            ConfigureLogContext(builder);
            builder.ConfigureClientContext(_storeOptions);
            builder.ConfigureResourcesContext(_storeOptions);
            builder.ConfigurePersistedGrantContext(_operationalOptions);
        }

        private void ConfigureLogContext(ModelBuilder builder)
        {
            builder.Entity<Log>(log =>
            {
                log.ToTable(TableConst.TableConsts.Logging);
                log.HasKey(x => x.Id);
                log.Property(x => x.Properties).HasColumnType("longtext");
                log.Property(x => x.Level).HasMaxLength(128);
            });
        }

        private void ConfigureIdentityContext(ModelBuilder builder)
        {
            builder.Entity<UserIdentityRole>().ToTable(TableConsts.IdentityRoles);
            builder.Entity<UserIdentityRoleClaim>().ToTable(TableConsts.IdentityRoleClaims);
            builder.Entity<UserIdentityUserRole>().ToTable(TableConsts.IdentityUserRoles);

            builder.Entity<UserIdentity>().ToTable(TableConsts.IdentityUsers);
            builder.Entity<UserIdentityUserLogin>().ToTable(TableConsts.IdentityUserLogins);
            builder.Entity<UserIdentityUserClaim>().ToTable(TableConsts.IdentityUserClaims);
            builder.Entity<UserIdentityUserToken>().ToTable(TableConsts.IdentityUserTokens);
        }
    }
}

Just an fyi really.

Cheers!

Add flag for exluding Asp.Net Core Identity from dotnet new template

Currently dotnet new template contains following params:

dotnet new skoruba.is4admin 
--name MyProject 
--title MyProject 
--adminrole MyRole 
--adminclientid MyClientId

It's necesarry to add the flag --exludeAspNetIdentity for exluding Asp.Net Core Identity from template.

No binding between pickers and ViewModels

I can't find any connection between MVC ViewModel and your KO pickers. params.hiddenId is undefined.

<div class="form-group row">
		<label asp-for="AllowedCorsOrigins" class="col-sm-3 col-form-label">
			@await Html.PartialAsync("Client/Section/Label", "AllowedCorsOrigins")
		</label>
	    <div class="col-sm-9">
	        <picker param="multipleSelect=true; hiddenId=AllowedCordOrigins" id="AllowedCorsOriginsItems" multiple-select="true" min-search-text="2"
	                selected-items="@Model.AllowedCorsOrigins" search-input-placeholder="Enter 2 and more characters 1"
	                selected-items-title="Selected: ">
	        </picker>
	    </div>
	</div>

You have multiple attributes for picker, but no params attr. What am I missing?

encapsulate project to injectable parts

I'm wondering if it is possible to change the structure of this project to two different projects(or nuget packages would be better).

• IdentityServer4.Admin
  this project will register all operations to a specific endpoint(like "/identity-server-admin") as a rest api.

• IdentityServer4.Admin.UI
  this project will register all default page to a specific endpoint(like "/identity-server-admin-ui") and it would be possible to inject some css or js or something.

Just like what swagger&swagger-ui has done.

Besides, thanks for your huge efforts for this repo.

Add ScopeClaim support

ScopeClaim support

Consider using IHtmlHelper.PartialAsync

Warning MVC1000: Use of IHtmlHelper.Partial may result in application deadlocks. Consider using Tag Helper or IHtmlHelper.PartialAsync.

Recommendation for this issue: https://docs.microsoft.com/en-us/aspnet/core/test/troubleshoot?view=aspnetcore-2.1#use-of-ihtmlhelperpartial-may-result-in-application-deadlocks

How to use Multiple DbContexts ?

Hi @skoruba ,

How to use Multiple DbContexts with multiple Databases ? I want to use :

• 1 database for Clients, ApiScopes, ApiResources, PersistedGrants ...
• 1 database for Users, Roles, UserClaims ...

I have created a new DbContext (AuthDbContext) but i'm confused how to get it work :/

Any idea ? ^_^

Serilog integration

IdentityServer4 authors "kind of recommend" to use Serilog http://docs.identityserver.io/en/release/topics/logging.html
https://github.com/serilog

Serilog has basic sinks for
File (https://github.com/serilog/serilog-sinks-file)
Database (https://github.com/serilog/serilog-sinks-mssqlserver)
and enterprise level sinks for Splunk, Azure AppInsights, ElasticSearch etc.

Also Enrichers concept allows to customize on DI container level tracking properties.

I would use Serilog to log into existing Log table in Admin context,
and add Logging configuration section to appsettings.json with sinks configurations.

Add UI tests

Planned support for OAuth Device Flow

Device flow will be added in next release of IdentityServer4 and is currently developed:
https://github.com/scottbrady91/IdentityServer4/tree/device-flow

Blog post describing the flow:
http://www.identityserver.com/articles/an-introduction-to-the-oauth-device-flow/

Would you consider adding this flow? I'm willing to help with that since I'll be using that flow a lot.

PasswordHash is set to NULL when saving user settings

Hi,

ran into a bug, when saving user settings from /Identity/UserProfile/X - password of a user is set to NULL (PasswordHash field in dbo.Users). Everything else saves normally.
Maybe some mapping issue?

Best regards.

Consider moving Asp.Net Identity into the separate projects

I'd like to create the project template via dotnet new that doesn't include the part with AspNet Identity therefore I'd like to move Asp.Net Identity into the separate projects.

BusinessLogic:

• Skoruba.IdentityServer4.Admin.BusinessLogic
• Skoruba.IdentityServer4.Admin.BusinessLogic.AspNetIdentity

EntityFramework:

• Skoruba.IdentityServer4.Admin.EntityFramework
• Skoruba.IdentityServer4.Admin.EntityFramework.AspNetIdentity

Use mysql when using template

Hello

I am following the instructions to create a brand new project using the templates.

My problem is that I want to be able to use MySql. How can I change Log.cs

Some const field can read *.settings.json

Some information changes in environments.
For example;

    public const string IdentityAdminCookieName = "IdentityServerAdmin";        
    public const string IdentityAdminRedirectUri = "http://localhost:9000/signin-oidc";
    public const string IdentityServerBaseUrl = "https://devauth.thyteknik.com.tr";
    public const string IdentityAdminBaseUrl = "http://localhost:9000";

The application can take this changing information from the setting.json file.
If you check the issue, I can do it.

Add audit tables to track IdSrv configuration data changes

During administration clients, scopes, users, roles may be important to have control on it's history.

One of the cheap way to get changes history could be SQL server Track Data Changes feature.

1. Add feature for SQL server
   https://docs.microsoft.com/en-us/sql/relational-databases/track-changes/enable-and-disable-change-data-capture-sql-server?view=sql-server-2017
2. Add views to read tracking changes tables and build around them AuditDbContext.

Second options is to realize it on application level by using EF handlers and changetracker.
https://blog.tonysneed.com/2017/10/01/trackable-entities-for-ef-core/

Update gulp-sass

It is necessary update gulp-sass after new release because of this issue: dlmanning/gulp-sass#687

Run Admin in Staging

Hi!
I've tried to run app Admin in staging, but i always see that app try to redirect to /Account/Login. I think problem in this method:

        public static void AddAuthentication(this IServiceCollection services, IHostingEnvironment hostingEnvironment)
        {
            services.AddIdentity<UserIdentity, UserIdentityRole>()
                .AddEntityFrameworkStores<AdminDbContext>()
                .AddDefaultTokenProviders();

            //For integration tests use only cookie middleware
            if (hostingEnvironment.IsStaging())
            {
                services.AddAuthentication(options =>
                {
                    options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
                    options.DefaultChallengeScheme = CookieAuthenticationDefaults.AuthenticationScheme;

                    options.DefaultAuthenticateScheme = CookieAuthenticationDefaults.AuthenticationScheme;
                    options.DefaultForbidScheme = CookieAuthenticationDefaults.AuthenticationScheme;
                    options.DefaultSignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;
                    options.DefaultSignOutScheme = CookieAuthenticationDefaults.AuthenticationScheme;
                })
                    .AddCookie(CookieAuthenticationDefaults.AuthenticationScheme,
                        options => { options.Cookie.Name = AuthorizationConsts.IdentityAdminCookieName; });
            }
            else
            {
                services.AddAuthentication(options =>
                {
                    options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
                    options.DefaultChallengeScheme = AuthorizationConsts.OidcAuthenticationScheme;

                    options.DefaultAuthenticateScheme = CookieAuthenticationDefaults.AuthenticationScheme;
                    options.DefaultForbidScheme = CookieAuthenticationDefaults.AuthenticationScheme;
                    options.DefaultSignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;
                    options.DefaultSignOutScheme = CookieAuthenticationDefaults.AuthenticationScheme;
                })
                    .AddCookie(CookieAuthenticationDefaults.AuthenticationScheme,
                        options => { options.Cookie.Name = AuthorizationConsts.IdentityAdminCookieName; })
                    .AddOpenIdConnect(AuthorizationConsts.OidcAuthenticationScheme, options =>
                    {
                        options.Authority = AuthorizationConsts.IdentityServerBaseUrl;
                        options.RequireHttpsMetadata = false;

                        options.ClientId = AuthorizationConsts.OidcClientId;

                        options.Scope.Clear();
                        options.Scope.Add(AuthorizationConsts.ScopeOpenId);
                        options.Scope.Add(AuthorizationConsts.ScopeProfile);
                        options.Scope.Add(AuthorizationConsts.ScopeEmail);
                        options.Scope.Add(AuthorizationConsts.ScopeRoles);

                        options.SaveTokens = true;

                        options.TokenValidationParameters = new TokenValidationParameters
                        {
                            NameClaimType = JwtClaimTypes.Name,
                            RoleClaimType = JwtClaimTypes.Role,
                        };

                        options.Events = new OpenIdConnectEvents
                        {
                            OnMessageReceived = OnMessageReceived,
                            OnRedirectToIdentityProvider = OnRedirectToIdentityProvider
                        };
                    });
            }

App Admin does't contain definition for OpenIdConnect for Staging and I think it use default authentication methods. But app Admin doesn't contain Login page.

Refresh Token after User Changes Role

Hi,
First, thank you for this great job I appreciate it a lot :) . My question is :
The user remains logged in and accesses AdminUI when I delete the Role, How to block access or redirect to an error page?
Thank you :)

Use in existing IdentityServer setup

For people having identity server running already, any plans on making a guide on how to get this awesome Admin UI to work?

Maybe there has to be some work done with exposing setup options like naming, using existing dbcontexts etc.

Create a documentation

Consider:

• How to create a documentation - what document format to use

• Use Github or some external tool

Any suggestions?

Create generic services/repositories which are connected with Asp.Net Identity

To simplify using of different Asp.Net Identity model, especially another type of key - it will be necessary to rework the services, repositories and mapping which are connected with Asp.Net Identity.

Bug: Log paging must show reasonable amount of page links

Log paging shows all existing links - NOK

Multitenant support

Hello,

First of all, nice job. Really useful and clear admin UI for IS4.

Any plan to support multi-tenant identity strategies? I know that is not an easy architecture, but it has become very popular concept (and we use it in our service model :) )

Would you consider adding this feature?

I would be willing to help.

Consider create project template for dotnet new

https://docs.microsoft.com/en-us/dotnet/core/tools/custom-templates

Table 'ApiResources' already exists

Thanks for such a great project.

I have an issue while migrating database.

First of all, I followed the instruction in EFMigration.md and Issue102 to use MySQL. When I run Update-Database -context AdminDbContext, I got

PM> dotnet ef database update -c AdminDbContext MySql.Data.MySqlClient.MySqlException (0x80004005): Table 'ApiResources' already exists ---> MySql.Data.MySqlClient.MySqlException (0x80004005): Table 'ApiResources' already exists at MySqlConnector.Core.ResultSet.ReadResultSetHeaderAsync(IOBehavior ioBehavior) in C:\projects\mysqlconnector\src\MySqlConnector\Core\ResultSet.cs:line 42 at MySql.Data.MySqlClient.MySqlDataReader.ActivateResultSet(ResultSet resultSet) in C:\projects\mysqlconnector\src\MySqlConnector\MySql.Data.MySqlClient\MySqlDataReader.cs:line 74 at MySql.Data.MySqlClient.MySqlDataReader.ReadFirstResultSetAsync(IOBehavior ioBehavior) in C:\projects\mysqlconnector\src\MySqlConnector\MySql.Data.MySqlClient\MySqlDataReader.cs:line 299 at MySql.Data.MySqlClient.MySqlDataReader.CreateAsync(MySqlCommand command, CommandBehavior behavior, ResultSetProtocol resultSetProtocol, IOBehavior ioBehavior) in C:\projects\mysqlconnector\src\MySqlConnector\MySql.Data.MySqlClient\MySqlDataReader.cs:line 284 at MySqlConnector.Core.TextCommandExecutor.ExecuteReaderAsync(String commandText, MySqlParameterCollection parameterCollection, CommandBehavior behavior, IOBehavior ioBehavior, CancellationToken cancellationToken) in C:\projects\mysqlconnector\src\MySqlConnector\Core\TextCommandExecutor.cs:line 37 at MySql.Data.MySqlClient.MySqlCommand.ExecuteNonQueryAsync(IOBehavior ioBehavior, CancellationToken cancellationToken) in C:\projects\mysqlconnector\src\MySqlConnector\MySql.Data.MySqlClient\MySqlCommand.cs:line 261 at MySql.Data.MySqlClient.MySqlCommand.ExecuteNonQuery() in C:\projects\mysqlconnector\src\MySqlConnector\MySql.Data.MySqlClient\MySqlCommand.cs:line 62 at Microsoft.EntityFrameworkCore.Storage.Internal.RelationalCommand.Execute(IRelationalConnection connection, DbCommandMethod executeMethod, IReadOnlyDictionary2 parameterValues)
at Microsoft.EntityFrameworkCore.Storage.Internal.RelationalCommand.ExecuteNonQuery(IRelationalConnection connection, IReadOnlyDictionary2 parameterValues) at Microsoft.EntityFrameworkCore.Migrations.MigrationCommand.ExecuteNonQuery(IRelationalConnection connection, IReadOnlyDictionary2 parameterValues)
at Microsoft.EntityFrameworkCore.Migrations.Internal.MigrationCommandExecutor.ExecuteNonQuery(IEnumerable1 migrationCommands, IRelationalConnection connection) at Microsoft.EntityFrameworkCore.Migrations.Internal.Migrator.Migrate(String targetMigration) at Microsoft.EntityFrameworkCore.Design.Internal.MigrationsOperations.UpdateDatabase(String targetMigration, String contextType) at Microsoft.EntityFrameworkCore.Design.OperationExecutor.UpdateDatabase.<>c__DisplayClass0_1.<.ctor>b__0() at Microsoft.EntityFrameworkCore.Design.OperationExecutor.OperationBase.Execute(Action action) Table 'ApiResources' already exists

Could you please help to see what did I missed? Thanks

Using SQLite as default database engine

A modest suggestion. By default Admin uses SqlServer which has to be separately installed for anyone who doesn't use Visual Studio daily.

Required changes would be pretty small:

UseSqlServer -> UseSqlite in StartupHelpers.cs and adding SQLite provider package for EntityFramework.Core.

I myself use PostgreSQL (works great), but for demonstration purposes I think SQLite would the best choice. This would also make checking out the Admin so much easier for Linux/MacOS folks.

Add/Edit problem, Client Redirect Uris

In Admin UI under client Basic settings, Adding or Editing Redirect Uris does not work.

Similar problem with other field of same where adding Uri or Editing is not working.

Keep it up.

Consider use the Gulp for generation of the sass files instead of plugin in VS 2017

Host IdentityServer4.Admin on Azure

Hello,

the project looks really great. How should I do that the service is hosted in Azure?

Yours sincerely
Frank

it has some issues by update clients Redirect Uris

dtos have not values

How can I login?

It seems there is no default admin/admin user or something else like for login page.
Follow the step,

1. add-migrations
2. datebase update
3. uncomment seeddata

Then I start IDS4 at localhost:5000, and IDS4 admin at localhost:9000.
Where I open http://localhost:9000, the website redirect me to localhost:5000 login page.
But I don't have a username and password for login.
User table is empty when I check it in SQL Server Management Studio.
Is it something I have done wrong?

Introduce AppSettings based on IOptions aspnetcore feature

Actually AdminUI IdSrv4 intergation and authorization params configured in AuthorizationConsts:

        public const string AdministrationPolicy = "RequireAdministratorRole";
        public const string AdministrationRole = "PlutoRootAdministrator";
        public const string IdentityAdminCookieName = "IdentityServerAdmin";        
        public const string IdentityAdminRedirectUri = "http://localhost:9000/signin-oidc";
        public const string IdentityServerBaseUrl = "https://localhost:44301/idsrv";
        public const string IdentityAdminBaseUrl = "http://localhost:9000";

I would suggest to use AppSettings class for that, which mapped to appsettings section in appsettings.JSON and IAppSettings rigistered as dependency in DI container.

Detailed about IOptions<TSettings> aspnetcore feature here:
https://joonasw.net/view/asp-net-core-1-configuration-deep-dive

services.AddOptions();
services.Configure<MySettings>(Configuration.GetSection("MySettings"));

Unable to assign multiple scopes to a client

I try to add multiple scopes to a client but I can only add one:

Any suggestions?

Add missing Chinese Localization Resources

I've added new localization for Picker component.

@Seaear @zhulige @snys98 - Please, can you help me with these missing localization resources?

In this commit is list of missing resources: 2a67acd

Here is a file that contains all new resources:
https://github.com/skoruba/IdentityServer4.Admin/blob/feature/extensible-aspnet-identity/src/Skoruba.IdentityServer4.Admin/Resources/Views/Configuration/ClientClaims.zh-cn.resx#L138-L161

Thank you!

How to handle multiple roles for same user and Authorize an api

Hello Skoruba ,
Thanks for this nice project it helps a lot

But am having two issues

1. is how can allow multiple roles for a single user , this comes i hand when i have more than one application where user can be able to share the login i tried to implement but it ends up in access denied page failing to authorize the user

2. what are the best way to authorize the API, i tried to implement but it works only on first minute after first minute the API loses access hence preventing user to have access to an API and the refresh token is invalid and throws an error when i try to renew the access token using the refresh token

Request: Add the user provision to the DI pipeline

I'd like to see the methods to provision users (i.e. AutoProvisionUserAsync etc) in a separate implementation having the Skoruba-implementation as default but allowing us to replace it when needed. It is rather impractical having to modify the AccountController after every update.

Connecting sample IS to database managed by IdentityServer4.Admin

Hello,

First of all, big thanks for doing this. You saved me a tremendous amount of work.

Why haven't you connected IdentityServer4 to the database modified by Admin panel? I understand that you could've done for the sake of simplicity and that's why you've opted for in memory stores but I'm curious if there's any other reason.

I'm working on having IS from Skoruba.IdentityServer4 connected to database modified in Skoruba.IdentityServer4.Admin. If I connect them are you interested in a pull request?

Fix that "Allowed Scopes" and "Allowed Grant Types" cannot be displayed properly in Client Basics when published as an application

Hello, I am very glad that you have developed this system. I think it is perfect to improve it here

change

<picker id="AllowedScopesItems" multiple-select="true" min-search-text="2"
        selected-items="@Model.AllowedScopes" url="/Configuration/SearchScopes?scope"
        search-input-placeholder="Enter 2 and more characters" selected-items-title="Selected: ">
</picker>

to

<picker id="AllowedScopesItems" multiple-select="true" min-search-text="2"
        selected-items="@Model.AllowedScopes" url="@Url.Action("SearchScopes","Configuration")?scope"
        search-input-placeholder="Enter 2 and more characters" selected-items-title="Selected: ">
</picker>

NOT PERFECT: url="/Configuration/SearchScopes?scope"
PERFECT: url="@Url.Action("SearchScopes","Configuration")?scope"

There are a few other places I didn't list

redirect to the client details after a client is edit

Api Resources work like a client work
and other manageable areas

Add IdentityServer4.Admin.Common project

Add IdentityServer4.Admin.Common project for common interfaces, constants, DTOs, AppSettings.
Move non specific for App, DAL and BLL constants and DTOs to Common project.

Might be must have refactoring for #56

Redirect Uris and Post Logout Redirect Uris is editable text

Hi again :)
I have long redirectUri and logoutUri. I don't edit the texts. Only I can remove it and add again.
Can you make the texts is editable?

Extended user authorization per Application

Actually Admin UI has only one level of authorization:

 services.AddAuthorization(options =>
            {
                options.AddPolicy(AuthorizationConsts.AdministrationPolicy,
                    policy => policy.RequireRole(AuthorizationConsts.AdministrationRole));
            });

There is need to provide access to Admin UI for users on Client Applicatiion level.
UserA has access to administrate App1, App2
UserB has access to administrate App1, App4, App5

Authorization must restrict user access in views to see only related to his application Client configurations, Stored Grants, Logs, Audit info etc.
What to do with application specific users is an open question.

I would suggest dynamic filters approach on DAL level
http://entityframework.net/ef-dynamic-filters
f.e Conditionally Enabling Filter could looks like that:
modelBuilder.Filter("HasClientId", (IHasClientId) => UserHasClientAppAdminClaim(d.ClientId));

• where UserHasClientAppAdminClaim will check if exists from UserClaimsPrincipal 'application-admin' claim with ClientId.
  For the Clients list view filter will be applied multiple WHERE IN (c1, c2, c3) filter.

Second level Authorization feature must be toggable with feature flag from AppSettings.json.

Consider revision of HTML template - rewrite to bootstrap 4