Skip to content

Commit d48c12e

Browse files
ismcagdasismcagdas
committed
Merge branch 'dev'
2 parents 42817c5 + 47e91fd commit d48c12e

13 files changed

+168
-74
lines changed

‎blog-posts/en/Persist-DataProtection-Keys-To-Database.md

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
# Persist Data Protection Keys to Database
2+
3+
ASP.NET Core provides a very sophisticated approach for protecting data. You can check [ASP.NET Core Data Protection Documentation](https://learn.microsoft.com/en-us/aspnet/core/security/data-protection/introduction) for more information.
4+
5+
Just like you do in any other ASP.NET Core app, if you want to use data protection in ASP.NET Zero, you can easily configure it. However, if you want to store data protection keys in database (see [documentation](https://learn.microsoft.com/en-us/aspnet/core/security/data-protection/configuration/overview)), you will face an error. That's because ASP.NET Core will try to create configured DbContext but at that time DbContext will not be configured by ASP.NET Zero. To overcome this problem, we need to configure data protection a bit different.
6+
7+
## Default Configuration
8+
9+
First of all, you need to add related NuGet package to your project and add `DataProtectionKey` entity to your DbContext as explained [here](https://learn.microsoft.com/en-us/aspnet/core/security/data-protection/configuration/overview). We will just configure data projecttion in a different way.
10+
11+
## Dependency Injection
12+
13+
By default, ASP.NET Core's data protection must be configured in Startup.cs file. However, in our case, we must configure it in ASP.NET Zero's EF Core module. To do that, we must access the `IServiceCollection` in our EF Core module.
14+
15+
Create classes below in the project;
16+
17+
````csharp
18+
public interface IServiceCollectionProvider
19+
{
20+
IServiceCollection ServiceCollection { get; }
21+
}
22+
23+
public sealed class ServiceCollectionProvider: IServiceCollectionProvider
24+
{
25+
public ServiceCollectionProvider(IServiceCollection serviceCollection)
26+
{
27+
ServiceCollection = serviceCollection;
28+
}
29+
30+
public IServiceCollection ServiceCollection { get; }
31+
}
32+
````
33+
34+
Then, we can register IServiceCollectionProvider in our Startup.cs file as shown below;
35+
36+
````csharp
37+
services.AddSingleton<IServiceCollectionProvider>(new ServiceCollectionProvider(services));
38+
````
39+
40+
## Configure Data Protection
41+
42+
Finally, configure data protection in the PostInitialize method of the EFCore module as shown below;
43+
44+
````csharp
45+
var serviceCollectionProvider = IocManager.IocContainer.Resolve<IServiceCollectionProvider>();
46+
serviceCollectionProvider.ServiceCollection.AddDataProtection().PersistKeysToDbContext<YourDbContext>()
47+
.SetApplicationName("YourApplicationName");
48+
````
49+

‎doc-obsolete/Development-Guide-Core.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1902,7 +1902,7 @@ project. Here, a list of all libraries.
19021902
- [jQuery Ajax Forms](http://malsup.com/jquery/form/)
19031903
- [jQuery Timeago](https://github.com/rmm5t/jquery-timeago)
19041904
- [Json2](https://github.com/douglascrockford/JSON-js)
1905-
- [Jcrop](https://github.com/tapmodo/Jcrop)
1905+
- [jquery-cropper](https://github.com/fengyuanchen/jquery-cropper)
19061906
- [LocalForage](https://github.com/localForage/localForage)
19071907
- [Js Cookie](https://github.com/js-cookie/js-cookie)
19081908
- [Moment.js](http://momentjs.com/)

‎docs/en/Development-Guide-Xamarin.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -196,6 +196,10 @@ You can also, see the following docs from Microsoft:
196196
* [Set Up Device for Development](https://docs.microsoft.com/en-us/xamarin/android/get-started/installation/set-up-device-for-development)
197197
* [Create backend services for native mobile apps with ASP.NET Core](https://docs.microsoft.com/en-us/aspnet/core/mobile/native-mobile-backend?view=aspnetcore-3.1)
198198

199+
**Known Problems**
200+
201+
- Long project name causes IOS app to not run on Windows machines while connecting to an IPhone or IPad. So, if you face such a problem, you can move your project to a directory with a shorter name.
202+
199203
## Xamarin.Forms
200204

201205
A key component of building cross-platform applications is being able to share code across various platform-specific projects. ASP.NET Zero Xamarin is using `Xamarin.Forms` to maximize code sharing between two end platforms (iOS & Android). It is expected to write shared codes in `Mobile.Shared` project so that it will be used in both iOS and Android. If you need platform specific development then try to use class abstractions in shared project and implement/extend in end platforms.

‎docs/en/Features-Angular-Audit-Logs.md

Lines changed: 34 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -14,17 +14,42 @@ Audit log report is provided by **AuditLogAppService** class.
1414

1515
### Periodic Log Deletion
1616

17-
ASP.NET Zero has built-in periodic log deletion system. To enable it, go to `*.Application/Auditing/ExpiredAuditLogDeleterWorker.cs` and set `IsEnabled` to true;
18-
19-
```csharp
20-
public class ExpiredAuditLogDeleterWorker : PeriodicBackgroundWorkerBase, ISingletonDependency
21-
{
22-
...
23-
public const bool IsEnabled = false;//default is false
24-
...
17+
ASP.NET Zero has built-in periodic log deletion system (`*.Application/Auditing/ExpiredAuditLogDeleterWorker.cs`). To enable it, go to `appsettings.json` and set `App:AuditLog:AutoDeleteExpiredLogs:IsEnabled` to true; (default `false`)
18+
19+
```json
20+
"App": {
21+
"AuditLog": {
22+
"AutoDeleteExpiredLogs": {
23+
"IsEnabled": true
24+
}
25+
}
26+
}
2527
```
2628

27-
It has two more parameter.
29+
Then periodic log deletion will be enabled.
30+
31+
#### Periodic Log Deletion Backup
32+
33+
Periodic log deletion system also has backup implementation. It uses `IExpiredAndDeletedAuditLogBackupService` to backup deleted items. It's default implementation uses excel to create backup. To enable it, go to `appsettings.json` and set `App:AuditLog:AutoDeleteExpiredLogs:ExcelBackup:IsEnabled` to true; (default `false`). Then deleted items will be stored in the given file path as an excel file.
34+
35+
```json
36+
"App": {
37+
"AuditLog": {
38+
"AutoDeleteExpiredLogs": {
39+
"IsEnabled": true,
40+
"ExcelBackup": {
41+
"IsEnabled": true,
42+
"FilePath": "App_Data/AuditLogsBackups/"
43+
}
44+
}
45+
}
46+
}
47+
```
48+
49+
________
50+
51+
52+
`*.Application/Auditing/ExpiredAuditLogDeleterWorker.cs` has two more parameter.
2853

2954
**CheckPeriodAsMilliseconds:** Time to wait between two controls.
3055

‎docs/en/Features-Angular-Azure-Key-Vault.md

Lines changed: 6 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -2,30 +2,24 @@
22

33
ASP.NET Core provides many configuration providers out of the box. One of them is Azure Key Vault Configuration Provider. **Azure Key Vault** is a cloud service that provides a secure store for secrets. You can securely store **keys**, passwords, certificates, and other secrets. For more information about Azure Key Vault, please refer to https://docs.microsoft.com/en-us/aspnet/core/security/key-vault-configuration.
44

5-
ASP.NET Zero provides built-in integration for Azure Key Vault. There are two modes of Azure Key Vault which are ```Certificate``` and ```Managed``` modes. You can easily configure Azure Key Vault for ASP.NET Zero by filling the configurations displayed below in appsettings.json of your application. For other environments like Production or Staging, use the correct setting file (appsettings.Production.json or appsettings.Staging.json).
5+
ASP.NET Zero provides built-in integration for Azure Key Vault. You can easily configure Azure Key Vault for ASP.NET Zero by filling the configurations displayed below in appsettings.json of your application. For other environments like Production or Staging, use the correct setting file (appsettings.Production.json or appsettings.Staging.json).
66

77
````json
88
"Configuration": {
99
"AzureKeyVault": {
1010
"IsEnabled": "false",
1111
"KeyVaultName": "",
12-
"AzureADApplicationId": "",
13-
"AzureADCertThumbprint": "",
12+
"TenantId": "",
1413
"ClientId": "",
1514
"ClientSecret": ""
1615
}
1716
}
1817
````
1918

20-
21-
2219
* ```IsEnabled```: Enables or disables using Azure Key Vault configuration.
2320
* ```KeyVaultName```: Key Vault Name.
24-
* ```AzureADApplicationId```: Azure AD Application ID.
25-
* ```AzureADCertThumbprint```: Azure AD Certificate Thumbprint
26-
* ```ClientId```: Azure Key Vault Client ID
27-
* ```ClientSecret```: Azure Key Vault Client Secret.
28-
29-
In order to use ```Certificate``` mode, ```KeyVaultName```, ```AzureADApplicationId``` and ```AzureADCertThumbprint``` values must be filled.
21+
* ```TenantId```: Azure TenantId.
22+
* ```ClientId```: Key vault clientId.
23+
* ```ClientSecret```: Key vault client secret.
3024

31-
In order to use ```Managed``` mode, ```ClientId``` and ```ClientSecret``` values must be filled.
25+
For more information, you can check documentation of [https://www.nuget.org/packages/Azure.Extensions.AspNetCore.Configuration.Secrets](https://www.nuget.org/packages/Azure.Extensions.AspNetCore.Configuration.Secrets)

‎docs/en/Features-Angular-Host-Settings.md

Lines changed: 12 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -19,37 +19,31 @@ Clock.Provider = ClockProviders.Utc;
1919

2020
<img src="images/host-settings-tenant-management.png" alt="Tenant Management Settings" class="img-thumbnail" />
2121

22-
* You can configure settings related to tenant management under "Tenant Management" tab.
22+
You can configure settings related to tenant management under "Tenant Management" tab. You can enable/disable tenants from registering the system. You can also make newly registered tenants active or passive.
2323

24-
* You can enable/disable tenants from registering the system.
24+
Enable/disable captcha on tenant registration page.
2525

26-
* You can make newly registered tenants active or passive.
27-
28-
* Enable/disable captcha on tenant registration page.
29-
30-
* You can select a default edition, so a newly registered tenant will be assigned to this edition automatically unless the tenant subscribes to a specific edition.
26+
You can also select a default edition, so a newly registered tenant will be assigned to this edition automatically unless the tenant subscribes to a specific edition.
3127

3228
## User Management
3329

34-
<img src="images/host-settings-user-management-3.png" alt="User Management Settings" class="img-thumbnail" />
35-
36-
* You can force email confirmation for login.
30+
<img src="images/host-settings-user-management-4.png" alt="User Management Settings" class="img-thumbnail" />
3731

38-
* You can enable phone number verification.
32+
User related settings can be configured under this tab. You can force email confirmation for login. You can enable phone number verification. Also, you can enable cookie consent so ASP.NET Zero shows a cookie consent bar for the users to accept cookie policy of your application.
3933

40-
* You can enable cookie consent so ASP.NET Zero shows a cookie consent bar for the users to accept cookie policy of your application.
34+
You can enable/disable captcha on users login page.
4135

42-
* You can enable/disable captcha on users login page.
36+
> Note: **Token Based Authentication** has `ReCaptchaIgnoreWhiteList` located in `WebConsts`. If you want a client app to be ignored for reCaptcha control during login, add a value to `ReCaptchaIgnoreWhiteList` and send the same value in the `User-Agent` request header for your login request from the client app. You can check the Xamarin mobile app in AspNet Zero to see how `ReCaptchaIgnoreWhiteList` works.
4337
44-
* You can also enable/disable session timeout control. If it is enable and the user does not provide any input to the site during the timeout period, a countdown modal will be displayed to user. If the user still does not provide an entry to the site during the modal countdown period, user will be log out.
38+
You can also enable/disable session timeout control. If it is enable and the user does not provide any input to the site during the timeout period, a countdown modal will be displayed to user. If the user still does not provide an entry to the site during the modal countdown period, user will be log out.
4539

46-
* Each tenant can allow tenant users to use Gravatar profile picture or not.
40+
Each tenant can allow tenant users to use Gravatar profile picture or not.
4741

48-
* You can enable password expiration. If it is enabled, users will be forced to change their password after a specific period of time.
42+
##### Password
4943

50-
* You can update password reset code expiration time. If a user requests a password reset code, ASP.NET Zero will send a code to the user's email address. This code will be valid for a specific period of time. You can configure this period of time in this setting.
44+
You can enable/disable password expiration on the settings page. If you enable it, users will have to change their password after defined days passed.
5145

52-
> Note: **Token Based Authentication** has `ReCaptchaIgnoreWhiteList` located in `WebConsts`. If you want a client app to be ignored for reCaptcha control during login, add a value to `ReCaptchaIgnoreWhiteList` and send the same value in the `User-Agent` request header for your login request from the client app. You can check the Xamarin mobile app in AspNet Zero to see how `ReCaptchaIgnoreWhiteList` works.
46+
You can also prevent user's new password from being same as any of last x passwords. If you enable it, you will need to define how many previous password you want to prevent. Users will not be able to use some of the previously used password as a new password.
5347

5448
## Security
5549

‎docs/en/Features-Mvc-Azure-Key-Vault.md

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,7 @@ ASP.NET Zero provides built-in integration for Azure Key Vault. There are two mo
99
"AzureKeyVault": {
1010
"IsEnabled": "false",
1111
"KeyVaultName": "",
12-
"AzureADApplicationId": "",
13-
"AzureADCertThumbprint": "",
12+
"TenantId": "",
1413
"ClientId": "",
1514
"ClientSecret": ""
1615
}
@@ -21,10 +20,9 @@ ASP.NET Zero provides built-in integration for Azure Key Vault. There are two mo
2120

2221
* ```IsEnabled```: Enables or disables using Azure Key Vault configuration.
2322
* ```KeyVaultName```: Key Vault Name.
24-
* ```AzureADApplicationId```: Azure AD Application ID.
25-
* ```AzureADCertThumbprint```: Azure AD Certificate Thumbprint
26-
* ```ClientId```: Azure Key Vault Client ID
27-
* ```ClientSecret```: Azure Key Vault Client Secret.
23+
* ```TenantId```: Azure TenantId.
24+
* ```ClientId```: Key vault clientId.
25+
* ```ClientSecret```: Key vault client secret.
2826

2927
In order to use ```Certificate``` mode, ```KeyVaultName```, ```AzureADApplicationId``` and ```AzureADCertThumbprint``` values must be filled.
3028

‎docs/en/Features-Mvc-Core-Audit-Logs.md

Lines changed: 34 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -13,17 +13,42 @@ Audit log report is provided by **AuditLogAppService** class.
1313

1414
### Periodic Log Deletion
1515

16-
ASP.NET Zero has built-in periodic log deletion system. To enable it, go to `*.Application/Auditing/ExpiredAuditLogDeleterWorker.cs` and set `IsEnabled` to true;
17-
18-
```csharp
19-
public class ExpiredAuditLogDeleterWorker : PeriodicBackgroundWorkerBase, ISingletonDependency
20-
{
21-
...
22-
public const bool IsEnabled = false;//default is false
23-
...
16+
ASP.NET Zero has built-in periodic log deletion system (`*.Application/Auditing/ExpiredAuditLogDeleterWorker.cs`). To enable it, go to `appsettings.json` and set `AuditLog.AutoDeleteExpiredLogs.IsEnabled` to true; (default `false`)
17+
18+
```json
19+
"App": {
20+
"AuditLog": {
21+
"AutoDeleteExpiredLogs": {
22+
"IsEnabled": true
23+
}
24+
}
25+
}
2426
```
2527

26-
It has two more parameter.
28+
Then periodic log deletion will be enabled.
29+
30+
#### Periodic Log Deletion Backup
31+
32+
Periodic log deletion system also has backup implementation. It uses `IExpiredAndDeletedAuditLogBackupService` to backup deleted items. It's default implementation uses excel to create backup. To enable it, go to `appsettings.json` and set `AuditLog.AutoDeleteExpiredLogs.ExcelBackup.IsEnabled` to true; (default `false`). Then deleted items will be stored in the given file path as an excel file.
33+
34+
```json
35+
"App": {
36+
"AuditLog": {
37+
"AutoDeleteExpiredLogs": {
38+
"IsEnabled": true,
39+
"ExcelBackup": {
40+
"IsEnabled": true,
41+
"FilePath": "App_Data/AuditLogsBackups/"
42+
}
43+
}
44+
}
45+
}
46+
```
47+
48+
________
49+
50+
51+
`*.Application/Auditing/ExpiredAuditLogDeleterWorker.cs` has two more parameter.
2752

2853
**CheckPeriodAsMilliseconds:** Time to wait between two controls.
2954

‎docs/en/Features-Mvc-Core-Host-Settings.md

Lines changed: 13 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -19,35 +19,31 @@ Clock.Provider = ClockProviders.Utc;
1919

2020
<img src="images/host-settings-tenant-management.png" alt="Tenant Management Settings" class="img-thumbnail" />
2121

22-
* You can configure settings related to tenant management under "Tenant Management" tab.
22+
You can configure settings related to tenant management under "Tenant Management" tab. You can enable/disable tenants from registering the system. You can also make newly registered tenants active or passive.
2323

24-
* You can enable/disable tenants from registering the system.
24+
Enable/disable captcha on tenant registration page.
2525

26-
* You can make newly registered tenants active or passive.
27-
28-
* Enable/disable captcha on tenant registration page.
29-
30-
* You can select a default edition, so a newly registered tenant will be assigned to this edition automatically unless the tenant subscribes to a specific edition.
26+
You can also select a default edition, so a newly registered tenant will be assigned to this edition automatically unless the tenant subscribes to a specific edition.
3127

3228
## User Management
3329

34-
<img src="images/host-settings-user-management-3.png" alt="User Management Settings" class="img-thumbnail" />
30+
<img src="images/host-settings-user-management-4.png" alt="User Management Settings" class="img-thumbnail" />
3531

36-
* You can force email confirmation for login. You can enable phone number verification.
32+
User related settings can be configured under this tab. You can force email confirmation for login. You can enable phone number verification. Also, you can enable cookie consent so ASP.NET Zero shows a cookie consent bar for the users to accept cookie policy of your application.
3733

38-
* You can enable cookie consent so ASP.NET Zero shows a cookie consent bar for the users to accept cookie policy of your application.
34+
You can enable/disable captcha on login page.
3935

40-
* You can enable/disable captcha on login page.
36+
> Note: **Token Based Authentication** has `ReCaptchaIgnoreWhiteList` located in `WebConsts`. If you want a client app to be ignored for reCaptcha control during login, add a value to `ReCaptchaIgnoreWhiteList` and send the same value in the `User-Agent` request header for your login request from the client app. You can check the Xamarin mobile app in AspNet Zero to see how `ReCaptchaIgnoreWhiteList` works.
4137
42-
* You can enable/disable session timeout control. If it is enable and the user does not provide any input to the site during the timeout period, a countdown modal will be displayed to user. If the user still does not provide an entry to the site during the modal countdown period, user will be log out.
38+
You can also enable/disable session timeout control. If it is enable and the user does not provide any input to the site during the timeout period, a countdown modal will be displayed to user. If the user still does not provide an entry to the site during the modal countdown period, user will be log out.
4339

44-
* Each tenant can allow tenant users to use Gravatar profile picture or not.
40+
Each tenant can allow tenant users to use Gravatar profile picture or not.
4541

46-
* You can enable password expiration. If it is enabled, users will be forced to change their password after a specific period of time.
42+
##### Password
4743

48-
* You can update password reset code expiration time. If a user requests a password reset code, ASP.NET Zero will send a code to the user's email address. This code will be valid for a specific period of time. You can configure this period of time in this setting.
44+
You can enable/disable password expiration on the settings page. If you enable it, users will have to change their password after defined days passed.
4945

50-
> Note: **Token Based Authentication** has `ReCaptchaIgnoreWhiteList` located in `WebConsts`. If you want a client app to be ignored for reCaptcha control during login, add a value to `ReCaptchaIgnoreWhiteList` and send the same value in the `User-Agent` request header for your login request from the client app. You can check the Xamarin mobile app in AspNet Zero to see how `ReCaptchaIgnoreWhiteList` works.
46+
You can also prevent user's new password from being same as any of last x passwords. If you enable it, you will need to define how many previous password you want to prevent. Users will not be able to use some of the previously used password as a new password.
5147

5248
## Security
5349

@@ -79,4 +75,4 @@ Under this tab, there is only one setting which is used to enable/disable quick
7975

8076
## Next
8177

82-
- [Tenant Settings](Features-Mvc-Core-Tenant-Settings)
78+
- [Tenant Settings](Features-Mvc-Core-Tenant-Settings)

0 commit comments

Comments
 (0)