Hop til hovedindhold

Security during development

Document status35 - Reviewed

Browser-based development login​

When running the application locally via docker-compose, a lightweight dev login page replaces the Azure Entra / MSAL sign-in flow. This works fully offline — no Azure AD connectivity required.

How it works:

  1. Start the application with docker-compose (the energyConnect profile).
  2. Open <http://localhost:4200> — you will be redirected to the dev login page.
  3. Enter a User ID (e.g. dev@energyconnect.dk), optionally a display name, and select the roles you need.
  4. Click Sign in — you're logged in with a cookie, just like in production.

Your selection is saved to localStorage, so it persists across browser refreshes.

Switching roles:

Navigate to http://localhost:4200/dev-login at any time to change your active roles. You can also clear the EnergyConnect.Auth cookie to force a new login prompt.

How activation works:

The dev login is enabled by the environment variable Authentication__DevAuth__UseDevAuth=true in docker-compose.yml. It additionally requires ASPNETCORE_ENVIRONMENT=Development. Both conditions must be true — the feature cannot activate in production.

Switching back to Azure Entra (MSAL):

Remove or set Authentication__DevAuth__UseDevAuth=false in your docker-compose environment. The standard OIDC flow resumes.

API-only authentication (without the browser UI)​

To perform API calls during development without Azure Entra, you will still need a JWT token. You can generate a new by using the user-jwts tool. In a Developer terminal position yourself in the *.API project and execute the following:

dotnet user-jwts create -n name@domain.top --role "MeteringPointReader"

To add all roles for your local user: dotnet user-jwts create -n "EnergyConnect Development User" --role "MeteringPointReader" --role "MeteringPointWriter" --role "AggregatedDataReader" --role "VEEReader" --role "VEEWriter" --role "ChargeInformationReader" --role "ChargeInformationWriter" --role "ConnectionPointWriter" --role "ConnectionPointReader" --valid-for "999999d"

To generate the "SigningKey" for your AppSettings file, do this from the root of the desired project (e.g. DMC.API): dotnet user-jwts key

It will generate a new token for you. Change the name and role accordingly.

Azure Auth during Development​

In production / Azure Test and QA we use Azure Entra handle Authority, Generation of tokens and Roles. To generate token valid to use here, a Script has been made: .\Infrastructure\Scripts\auth\AuthTest.ps1

This returns a token from Azure, with your asigned roles. It will be the same token generated if you logged into: https://internal-test.energyconnect.dk

This token can also be used then running the project locally. To do this, change the following in your appsettings.Development.json. ( DMC and NTS )

  1. Remove SigningKey.
  2. Replace the value in ValidAudiences.
  3. Replace the value in ValidIssuer.

ValidAudiences and ValidIssuer has to match the Audience / aud and Issuer / iss claims in the generated token. The Script .\Infrastructure\Scripts\auth\AuthTest.ps1 returns these, but a token can also be decoded via a website like: https://www.jwt.io/

##To get started: Run the following command to define your local machine to be a DEVELOPMENT environment: $Env:ASPNETCORE_ENVIRONMENT = "Development"

From the solution root, run the following script to set the default Auth credentials for your local machine: .\Infrastructure\Scripts\auth\SetDefaultDevAuth.ps1