Any SignalR module sample available?

[wcrisafu]

Hi,

I am trying to incorporate SignalR in my modules (not for chat but to broadcast tournament updates) but I cannot find a way to put it in place without modifying the Oqtane server (which would make future upgrades difficult). Does anyone have a simple Oqtane module (even chat) with SignalR, MapHub, etc.?

Thank you!

[leigh-pointer]

Hi @wcrisafu
You will need to create a startup.cs in your server project and implent it there.

using Oqtane.Infrastructure;
namespace YourCompany.YourModule;

    public class StartUp : IServerStartup
    {
        public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
        {
             //throw new NotImplementedException();
        }

        public void ConfigureMvc(IMvcBuilder mvcBuilder)
        {
            //throw new NotImplementedException();
        }

        public void ConfigureServices(IServiceCollection services)
        {
             //throw new NotImplementedException();
        }
}

[wcrisafu]

I do have it and I am trying to add my changes there but, I am having difficulties with the "hub". I am trying different combination but i think the main issue is that Blazor wants to map hubs in a specific order. Any other option beside the "MapHub"?

P.S.: "app" does not have the "MapHub" because "Oqtane.Server" does not have the Signalr pakage by default.

namespace Oqtane.TMS.Server.Startup
{
public class ServerStartup : IServerStartup
{
public void ConfigureServices(IServiceCollection services)
{
services.AddBlazorise(options =>
{
options.Immediate = true;
})
.AddBootstrap5Providers()
.AddFontAwesomeIcons();

        services.AddSignalR();

        services.AddResponseCompression(opts =>
        {
            opts.MimeTypes = ResponseCompressionDefaults.MimeTypes.Concat(
                new[] { "application/octet-stream" });
        });
       
    }
    public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
    {
        app.UseResponseCompression();
        //app.MapHub<TMSHub>("/tmshub");
        //app.UseEndpoints(endpoints => endpoints.MapHub<TMSHub>("/tmshub"));
    }
    public void ConfigureMvc(IMvcBuilder mvcBuilder)
    {

    }
}

}

[wcrisafu]

I tried to use the "app.UseEndpoints(endpoints =>" (see below) and I received the error "Message=EndpointRoutingMiddleware matches endpoints setup by EndpointMiddleware and so must be added to the request execution pipeline before EndpointMiddleware. Please add EndpointRoutingMiddleware by calling 'IApplicationBuilder.UseRouting' inside the call to 'Configure(...)' in the application startup code."

public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
{
app.UseResponseCompression();
app.UseEndpoints(endpoints => {
endpoints.MapHub("/tmshub");

        });

[wcrisafu]

Huge step forward. Look like I was just missing the "app.UseRouting();" before the "app.UseEndpoints("

Now I just need to get the correct URL make this work and I should be in business: "hubConnection = new HubConnectionBuilder().WithUrl(url).Build();"

[W6HBR]

@wcrisafu How did you make out with this? I have a need for implementing a new module that will need to use SignalR for client updates and wondering if you have any tips or even code examples to share?

[wcrisafu]

Hi Sorry for the delay (vacation + work).

I just added a few comments to #3159 . Please see if that is what you are looking for.

Keep in mind I implemented an anonymously broadcast only (not 1:1 chat). My code is kind of a mess (done in my free time and in a rush) and that is why I did not post it. If I get time to refactor it, I may share later.

If you tell le exactly what you need, I can try to share some pieces of code.

[Sen-Gupta]

I have a sample that works all fine until you try to use [Authorize] on the Hub.

private async Task GetJwtTokenAsync()
{
try
{
// Fetch the JWT from Oqtane's built-in endpoint - using the correct path
var accessToken = await _http.GetStringAsync("/api/User/token");

     if (string.IsNullOrEmpty(accessToken))
     {
         _logger.LogWarning("Empty JWT token received for SignalR authentication. Make sure you are logged in with a registered user.");
     }
     else
     {
         _logger.LogInformation("Successfully retrieved JWT token for SignalR authentication");
     }
     
     return accessToken;
 }
 catch (Exception ex)
 {
     _logger.LogError(ex, "Failed to retrieve JWT token for SignalR authentication: {ErrorMessage}. Please ensure you are logged in.", ex.Message);
     return null;
 }

}

private async Task InitializeHubConnection()
{
try
{
// Get JWT token for authentication
var token = await GetJwtTokenAsync();

     if (string.IsNullOrEmpty(token))
     {
         _logger.LogWarning("No authentication token available. SignalR connection will be unauthenticated.");
     }
     
     // Get the base URL for the hub - append token as query parameter for websocket authentication
     string baseUrl = _navigationManager.BaseUri.TrimEnd('/') + "/clinichub";
     
     // Add the token as a query parameter for SignalR WebSocket authentication
     if (!string.IsNullOrEmpty(token))
     {
         baseUrl += $"?access_token={Uri.EscapeDataString(token)}";
     }
     
     _logger.LogInformation("Initializing hub connection to {Url}", baseUrl);
     
     // Build the connection with JWT authentication
     var builder = new HubConnectionBuilder()
         .WithUrl(baseUrl, options => 
         {
             // Enable detailed logging for WebSocket connections
             options.WebSocketConfiguration = conf => {
                 conf.RemoteCertificateValidationCallback = (sender, certificate, chain, errors) => true;
             };
         })
         .WithAutomaticReconnect(new[] { TimeSpan.FromSeconds(0), TimeSpan.FromSeconds(2), TimeSpan.FromSeconds(5), TimeSpan.FromSeconds(10) });

     _hubConnection = builder.Build();

     // Register for connection events with improved logging
     _hubConnection.Reconnecting += exception =>
     {
         _logger.LogWarning(exception, "Reconnecting to SignalR hub. Error: {ErrorMessage}", exception?.Message ?? "Unknown error");
         return Task.CompletedTask;
     };

     _hubConnection.Reconnected += connectionId =>
     {
         _logger.LogInformation("Successfully reconnected to SignalR hub with connection ID: {ConnectionId}", connectionId);
         _ = ProcessPendingMessagesAsync();
         return Task.CompletedTask;
     };

     _hubConnection.Closed += exception =>
     {
         if (exception != null)
         {
             _logger.LogError(exception, "SignalR connection closed with error: {ErrorMessage}", exception.Message);
         }
         else
         {
             _logger.LogInformation("SignalR connection closed normally");
         }
         return Task.CompletedTask;
     };

     // Register built-in handlers
     _hubConnection.On<string, string>("ReceiveNotification", (message, type) =>
     {
         _logger.LogInformation("Received notification: {Message} ({Type})", message, type);
         InvokeHandlers("ReceiveNotification", message, type);
     });

     _hubConnection.On<CacheChangeEvent>("ReceiveCacheChange", (cacheEvent) =>
     {
         _logger.LogInformation("Received cache change event for type: {EntityType}", 
             cacheEvent?.EntityType ?? "unknown");
         InvokeHandlers("ReceiveCacheChange", cacheEvent);
     });
 }
 catch (Exception ex)
 {
     _logger.LogError(ex, "Error initializing SignalR hub connection: {Message}", ex.Message);
     throw; // Rethrow to properly handle in the calling method
 }

}

I'm able to get token and send to Hub but always get 403.

[sbwalker]

@Sen-Gupta Oqtane Server only accepts bearer tokens as headers - not as querystring parameters... perhaps this is why you are getting 403 errors.

[Sen-Gupta]

This should work options.Headers.Add("Authorization", "Bearer " + accessToken); }) .Build(); Work,?

[sbwalker]

@Sen-Gupta I do not know if this will work in your case or not - I was just pointing out that Oqtane only supports bearer token auth headers, not querystring params. Independent from Oqtane there are challenges in getting SignalR to work with all Blazor render modes - especially Blazor Server. And in regards to Oqtane, you would need to figure out how to get SignalR to behave properly with multi-tenancy (unless you are not using multi-tenancy).

[Sen-Gupta]

@sbwalker

We are on single tenant!

Irrespective of token passed in query or header, we stay on 403.

We are using Oqtane admin and a normal user, both are in role registered as well.

How can I debug?

Since we get 403, we are failing on authorization, authentication succeeds.....

I understand Oqtane does not keep roles claim in token.

Need to figure out why it is not working out..

[Sen-Gupta]

Hurry! @sbwalker I have a working solution with authentication.

I will share full sample so that everyone can use it.

A minor improvement, I did set a secret in the site for Jwt.

How do I retrieve in an ServerStartup? I have hard coded the same secret in the ServerStartup.

I tried httpContextAccessor.GetSiteSetting but it is null or even the alias but could not get the token that i configured in the Site

Accesing the configured secret is the last pending challenge, we have! I guess it is too easy for you!

private string GetJwtSecret(HttpContext context)
        {
            try
            {
                // Retrieve the JWT secret using the same approach as JwtMiddleware
                var alias = context.GetAlias();
                if (alias != null)
                {
                    var sitesettings = context.GetSiteSettings();
                    var secret = sitesettings.GetValue("JwtOptions:Secret", "");
                    if (!string.IsNullOrEmpty(secret))
                    {
                        return secret;
                    }
                }
                return string.Empty;
            }
            catch (Exception ex)
            {
                var logger = context.RequestServices.GetService<ILogger<ServerStartup>>();
                logger?.LogError(ex, "Error retrieving JWT secret from site settings");
                return string.Empty;
            }
        }
        
        
 and here is how it is being called (both defined in Module level ServerStartup.cs)
 
 // Add HttpContextAccessor if it hasn't been registered already
services.AddHttpContextAccessor();

// Configure JWT Bearer authentication explicitly for SignalR
services.AddAuthentication()
    .AddJwtBearer(JwtBearerDefaults.AuthenticationScheme, options =>
    {
        // Skip validation in development if needed
        options.RequireHttpsMetadata = false;
        options.SaveToken = true;
        
        // Configure token validation parameters
        options.TokenValidationParameters = new TokenValidationParameters
        {
            ValidateIssuer = false,
            ValidateAudience = false,
            ValidateLifetime = true,
            ValidateIssuerSigningKey = true,
            ClockSkew = TimeSpan.Zero
        };
        
        // Configure JWT events to handle WebSocket protocol
        options.Events = new JwtBearerEvents
        {
            OnMessageReceived = context =>
            {
                // Get the token from the query string for SignalR connections
                var accessToken = context.Request.Query["access_token"];
                
                // If the token is not in the query string, check the Authorization header
                if (string.IsNullOrEmpty(accessToken))
                {
                    var authHeader = context.Request.Headers["Authorization"].ToString();
                    if (!string.IsNullOrEmpty(authHeader) && authHeader.StartsWith("Bearer "))
                    {
                        accessToken = authHeader.Substring("Bearer ".Length).Trim();
                    }
                }

                // If the request is for our SignalR hub, set the token
                var path = context.HttpContext.Request.Path;
                if (!string.IsNullOrEmpty(accessToken) && path.StartsWithSegments("/clinichub"))
                {
                    context.Token = accessToken;
                    
                    // Get the JWT token secret using the same approach as JwtMiddleware
                    var secret = GetJwtSecret(context.HttpContext);
                    if (!string.IsNullOrEmpty(secret))
                    {
                        // Set the signing key for validation
                        context.Options.TokenValidationParameters.IssuerSigningKey = 
                            new SymmetricSecurityKey(Encoding.ASCII.GetBytes(PadSecret(secret)));
                    }
                }
                
                return Task.CompletedTask;
            },
            
            OnAuthenticationFailed = context =>
            {
                var logger = context.HttpContext.RequestServices.GetService<ILogger<ServerStartup>>();
                logger?.LogError($"JWT Authentication failed: {context.Exception.Message}");
                return Task.CompletedTask;
            }
        };
    });

@sbwalker you rock!

[bbqchickenrobot]

@Sen-Gupta - Did you ever figure out how to get the secret pulled in ?

[Sen-Gupta]

Unfortunately not, this was put in cold bag.
@sbwalker any inputs?

[sbwalker]

@Sen-Gupta you cannot access SiteSettings via HttpContext because UseTenantResolution is called AfTER IServerStartup (ConfigureOqtaneAssemblies). If ConfigureOqtaneAssemblies was called later in the Configure method (like it was in the PR which was rolled back) then you would be able to access the tenant and SiteSettings.

[Sen-Gupta]

@bbqchickenrobot, this worked for me.

@sbwalker, with the recent change of moving.

app.UseExceptionMiddleWare();
app.UseTenantResolution();
app.UseJwtAuthorization();
app.UseRouting();
app.UseCors();
app.UseOutputCache();
app.UseAuthentication();
app.UseAuthorization();
app.UseAntiforgery();

// execute any IServerStartup logic
app.ConfigureOqtaneAssemblies(env); //As suggested by @sbwalker

if (_useSwagger)
{
// Add Swagger security middleware to check for admin access
app.UseSwaggerSecurity();
app.UseSwagger();
app.UseSwaggerUI(c => { c.SwaggerEndpoint("/swagger/" + Constants.Version + "/swagger.json", Constants.PackageId + " " + Constants.Version); });
}

It has been possible to read the token as shown below.

public class ServerStartup : IServerStartup
    {
        // Static field to store the application builder instance for later use
        private static IApplicationBuilder _app;  //we will use in GetJwtSecret
        
        public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
        {
            // Store app reference for use in GetJwtSecret
            _app = app;
            
            // not implemented
            app.AddCustomSerilog();

            // Add our initialization middleware early in the pipeline
            app.AddCsdpInitialization();
            // Add SignalR hub endpoint
            app.UseEndpoints(endpoints =>
            {
                endpoints.MapHub<ClinicHub>("/clinichub");
            });
        }

        public void ConfigureMvc(IMvcBuilder mvcBuilder)
        {
            // not implemented
        }

        public void ConfigureServices(IServiceCollection services)
        {
            
            // Configure JWT Bearer authentication explicitly for SignalR
            services.AddAuthentication()
                .AddJwtBearer(JwtBearerDefaults.AuthenticationScheme, options =>
                {
                    // Skip validation in development if needed
                    options.RequireHttpsMetadata = false;
                    options.SaveToken = true;
                    
                    // Configure token validation parameters
                    options.TokenValidationParameters = new TokenValidationParameters
                    {
                        ValidateIssuer = false,
                        ValidateAudience = false,
                        ValidateLifetime = true,
                        ValidateIssuerSigningKey = true, // Changed to true
                        // Add a signing key that matches what Oqtane uses
                        IssuerSigningKey = new SymmetricSecurityKey(
                            Encoding.ASCII.GetBytes(PadSecret(GetJwtSecret())) //Pull JwtSecret here
                        ),
                        ClockSkew = TimeSpan.Zero
                    };

                    // Configure JWT events to handle WebSocket protocol
                    options.Events = new JwtBearerEvents
                    {
                        OnMessageReceived = context =>
                        {
                            // Get the token from the query string or the "Authorization" header for SignalR connections
                            var accessToken = context.Request.Query["access_token"];
                            
                            // If the token is not in the query string, check the Authorization header
                            if (string.IsNullOrEmpty(accessToken))
                            {
                                accessToken = context.Request.Headers["Authorization"].ToString().Replace("Bearer ", "");
                            }

                            // If the request is for the SignalR hub, set the token
                            var path = context.HttpContext.Request.Path;
                            if (!string.IsNullOrEmpty(accessToken) && path.StartsWithSegments("/clinichub"))
                            {
                                context.Token = accessToken;
                            }
                            return Task.CompletedTask;
                        }
                    };
                });
            
              // Register SignalR Hub with basic configuration
            services.AddSignalR(options =>
            {
                options.EnableDetailedErrors = true; // Help with debugging SignalR issues
                options.MaximumReceiveMessageSize = 102400; // 100 KB
            });
            
        }

        private string GetJwtSecret()
        {
            // Try to get the JWT secret from SiteSettings
            var serviceProvider = _app?.ApplicationServices;
            try 
            {
                // Resolve IHttpContextAccessor from the service provider if available
                
                if (serviceProvider != null)
                {
                    var httpContextAccessor = serviceProvider.GetService(typeof(IHttpContextAccessor)) as IHttpContextAccessor;
                    if (httpContextAccessor?.HttpContext != null)
                    {
                        // Get site settings using extension method from Oqtane
                        var siteSettings = httpContextAccessor.HttpContext.GetSiteSettings();
                        var secret = siteSettings?.GetValue("JwtOptions:Secret", "");
                        if (!string.IsNullOrEmpty(secret))
                        {
                            return secret;
                        }
                    }
                }
            }
            catch (Exception ex)
            {
                // Fall through to default if any error occurs\
                var logger = serviceProvider?.GetService(typeof(ILogger<ServerStartup>)) as ILogger<ServerStartup>;
                logger?.LogError(ex, "Error getting JWT secret from SiteSettings");
            }
            
            // Fallback to default value for development
            return "ab0a5f6d7d7084bdd4da4f34c7e9208c";
        }

        private string PadSecret(string secret)
        {
            // Ensure secret is 256 bits (32 bytes) as required by SymmetricSecurityKey
            if (string.IsNullOrEmpty(secret)) return new string('0', 32);
            
            if (secret.Length < 32)
            {
                return secret.PadRight(32, '0');
            }
            else if (secret.Length > 32)
            {
                return secret.Substring(0, 32);
            }
            
            return secret;
        }
    }`

Thanks for all your hardwork @sbwalker.