Kévin Chalet
8 years ago
14 changed files with 1667 additions and 7 deletions
@ -0,0 +1,287 @@ |
|||||
|
/* |
||||
|
* Licensed under the Apache License, Version 2.0 (http://www.apache.org/licenses/LICENSE-2.0)
|
||||
|
* See https://github.com/openiddict/openiddict-core for more information concerning
|
||||
|
* the license and the contributors participating to this project. |
||||
|
*/ |
||||
|
|
||||
|
using System; |
||||
|
using System.ComponentModel; |
||||
|
using System.Security.Claims; |
||||
|
using System.Threading.Tasks; |
||||
|
using AspNet.Security.OAuth.Validation; |
||||
|
using Microsoft.AspNetCore.Authentication; |
||||
|
using Microsoft.Extensions.DependencyInjection; |
||||
|
using Microsoft.Extensions.Logging; |
||||
|
using Microsoft.Net.Http.Headers; |
||||
|
using Newtonsoft.Json.Linq; |
||||
|
using OpenIddict.Abstractions; |
||||
|
using OpenIddict.Core; |
||||
|
|
||||
|
namespace OpenIddict.Validation |
||||
|
{ |
||||
|
[EditorBrowsable(EditorBrowsableState.Never)] |
||||
|
public class OpenIddictValidationHandler : OAuthValidationHandler { } |
||||
|
|
||||
|
[EditorBrowsable(EditorBrowsableState.Never)] |
||||
|
public class OpenIddictValidationHandler<TToken> : OpenIddictValidationHandler where TToken : class |
||||
|
{ |
||||
|
protected override async Task<AuthenticateResult> HandleAuthenticateAsync() |
||||
|
{ |
||||
|
var context = new RetrieveTokenContext(Context, Options); |
||||
|
await Options.Events.RetrieveToken(context); |
||||
|
|
||||
|
if (context.HandledResponse) |
||||
|
{ |
||||
|
// If no ticket has been provided, return a failed result to
|
||||
|
// indicate that authentication was rejected by application code.
|
||||
|
if (context.Ticket == null) |
||||
|
{ |
||||
|
return AuthenticateResult.Fail("Authentication was stopped by application code."); |
||||
|
} |
||||
|
|
||||
|
return AuthenticateResult.Success(context.Ticket); |
||||
|
} |
||||
|
|
||||
|
else if (context.Skipped) |
||||
|
{ |
||||
|
Logger.LogInformation("Authentication was skipped by application code."); |
||||
|
|
||||
|
return AuthenticateResult.Skip(); |
||||
|
} |
||||
|
|
||||
|
var token = context.Token; |
||||
|
|
||||
|
if (string.IsNullOrEmpty(token)) |
||||
|
{ |
||||
|
// Try to retrieve the access token from the authorization header.
|
||||
|
string header = Request.Headers[HeaderNames.Authorization]; |
||||
|
if (string.IsNullOrEmpty(header)) |
||||
|
{ |
||||
|
Logger.LogDebug("Authentication was skipped because no bearer token was received."); |
||||
|
|
||||
|
return AuthenticateResult.Skip(); |
||||
|
} |
||||
|
|
||||
|
// Ensure that the authorization header contains the mandatory "Bearer" scheme.
|
||||
|
// See https://tools.ietf.org/html/rfc6750#section-2.1
|
||||
|
if (!header.StartsWith(OAuthValidationConstants.Schemes.Bearer + ' ', StringComparison.OrdinalIgnoreCase)) |
||||
|
{ |
||||
|
Logger.LogDebug("Authentication was skipped because an incompatible " + |
||||
|
"scheme was used in the 'Authorization' header."); |
||||
|
|
||||
|
return AuthenticateResult.Skip(); |
||||
|
} |
||||
|
|
||||
|
// Extract the token from the authorization header.
|
||||
|
token = header.Substring(OAuthValidationConstants.Schemes.Bearer.Length + 1).Trim(); |
||||
|
|
||||
|
if (string.IsNullOrEmpty(token)) |
||||
|
{ |
||||
|
Logger.LogDebug("Authentication was skipped because the bearer token " + |
||||
|
"was missing from the 'Authorization' header."); |
||||
|
|
||||
|
return AuthenticateResult.Skip(); |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
// Try to unprotect the token and return an error
|
||||
|
// if the ticket can't be decrypted or validated.
|
||||
|
var result = await CreateTicketAsync(token); |
||||
|
if (!result.Succeeded) |
||||
|
{ |
||||
|
Context.Features.Set(new OAuthValidationFeature |
||||
|
{ |
||||
|
Error = new OAuthValidationError |
||||
|
{ |
||||
|
Error = OAuthValidationConstants.Errors.InvalidToken, |
||||
|
ErrorDescription = "The access token is not valid." |
||||
|
} |
||||
|
}); |
||||
|
|
||||
|
return AuthenticateResult.Fail("Authentication failed because the access token was invalid."); |
||||
|
} |
||||
|
|
||||
|
// Ensure that the authentication ticket is still valid.
|
||||
|
var ticket = result.Ticket; |
||||
|
if (ticket.Properties.ExpiresUtc.HasValue && |
||||
|
ticket.Properties.ExpiresUtc.Value < Options.SystemClock.UtcNow) |
||||
|
{ |
||||
|
Context.Features.Set(new OAuthValidationFeature |
||||
|
{ |
||||
|
Error = new OAuthValidationError |
||||
|
{ |
||||
|
Error = OAuthValidationConstants.Errors.InvalidToken, |
||||
|
ErrorDescription = "The access token is no longer valid." |
||||
|
} |
||||
|
}); |
||||
|
|
||||
|
return AuthenticateResult.Fail("Authentication failed because the access token was expired."); |
||||
|
} |
||||
|
|
||||
|
// Ensure that the access token was issued
|
||||
|
// to be used with this resource server.
|
||||
|
if (!ValidateAudience(ticket)) |
||||
|
{ |
||||
|
Context.Features.Set(new OAuthValidationFeature |
||||
|
{ |
||||
|
Error = new OAuthValidationError |
||||
|
{ |
||||
|
Error = OAuthValidationConstants.Errors.InvalidToken, |
||||
|
ErrorDescription = "The access token is not valid for this resource server." |
||||
|
} |
||||
|
}); |
||||
|
|
||||
|
return AuthenticateResult.Fail("Authentication failed because the access token " + |
||||
|
"was not valid for this resource server."); |
||||
|
} |
||||
|
|
||||
|
var notification = new ValidateTokenContext(Context, Options, ticket); |
||||
|
await Options.Events.ValidateToken(notification); |
||||
|
|
||||
|
if (notification.HandledResponse) |
||||
|
{ |
||||
|
// If no ticket has been provided, return a failed result to
|
||||
|
// indicate that authentication was rejected by application code.
|
||||
|
if (notification.Ticket == null) |
||||
|
{ |
||||
|
return AuthenticateResult.Fail("Authentication was stopped by application code."); |
||||
|
} |
||||
|
|
||||
|
return AuthenticateResult.Success(notification.Ticket); |
||||
|
} |
||||
|
|
||||
|
else if (notification.Skipped) |
||||
|
{ |
||||
|
Logger.LogInformation("Authentication was skipped by application code."); |
||||
|
|
||||
|
return AuthenticateResult.Skip(); |
||||
|
} |
||||
|
|
||||
|
// Allow the application code to replace the ticket
|
||||
|
// reference from the ValidateToken event.
|
||||
|
ticket = notification.Ticket; |
||||
|
|
||||
|
if (ticket == null) |
||||
|
{ |
||||
|
return AuthenticateResult.Fail("Authentication was stopped by application code."); |
||||
|
} |
||||
|
|
||||
|
return AuthenticateResult.Success(ticket); |
||||
|
} |
||||
|
|
||||
|
private bool ValidateAudience(AuthenticationTicket ticket) |
||||
|
{ |
||||
|
// If no explicit audience has been configured,
|
||||
|
// skip the default audience validation.
|
||||
|
if (Options.Audiences.Count == 0) |
||||
|
{ |
||||
|
return true; |
||||
|
} |
||||
|
|
||||
|
// Extract the audiences from the authentication ticket.
|
||||
|
var audiences = ticket.Properties.GetProperty(OAuthValidationConstants.Properties.Audiences); |
||||
|
if (string.IsNullOrEmpty(audiences)) |
||||
|
{ |
||||
|
return false; |
||||
|
} |
||||
|
|
||||
|
// Ensure that the authentication ticket contains one of the registered audiences.
|
||||
|
foreach (var audience in JArray.Parse(audiences).Values<string>()) |
||||
|
{ |
||||
|
if (Options.Audiences.Contains(audience)) |
||||
|
{ |
||||
|
return true; |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
return false; |
||||
|
} |
||||
|
|
||||
|
private async Task<AuthenticateResult> CreateTicketAsync(string payload) |
||||
|
{ |
||||
|
var manager = Context.RequestServices.GetService<OpenIddictTokenManager<TToken>>(); |
||||
|
if (manager == null) |
||||
|
{ |
||||
|
throw new InvalidOperationException("The token manager was not correctly registered."); |
||||
|
} |
||||
|
|
||||
|
// Retrieve the token entry from the database. If it
|
||||
|
// cannot be found, assume the token is not valid.
|
||||
|
var token = await manager.FindByReferenceIdAsync(payload); |
||||
|
if (token == null) |
||||
|
{ |
||||
|
return AuthenticateResult.Fail("Authentication failed because the access token cannot be found in the database."); |
||||
|
} |
||||
|
|
||||
|
// Extract the encrypted payload from the token. If it's null or empty,
|
||||
|
// assume the token is not a reference token and consider it as invalid.
|
||||
|
var ciphertext = await manager.GetPayloadAsync(token); |
||||
|
if (string.IsNullOrEmpty(ciphertext)) |
||||
|
{ |
||||
|
return AuthenticateResult.Fail("Authentication failed because the access token is not a reference token."); |
||||
|
} |
||||
|
|
||||
|
var ticket = Options.AccessTokenFormat.Unprotect(ciphertext); |
||||
|
if (ticket == null) |
||||
|
{ |
||||
|
return AuthenticateResult.Fail( |
||||
|
"Authentication failed because the reference token cannot be decrypted. " + |
||||
|
"This may indicate that the token entry is corrupted or tampered."); |
||||
|
} |
||||
|
|
||||
|
// Dynamically set the creation and expiration dates.
|
||||
|
ticket.Properties.IssuedUtc = await manager.GetCreationDateAsync(token); |
||||
|
ticket.Properties.ExpiresUtc = await manager.GetExpirationDateAsync(token); |
||||
|
|
||||
|
// Restore the token and authorization identifiers attached with the database entry.
|
||||
|
ticket.Properties.SetProperty(OpenIddictConstants.Properties.TokenId, await manager.GetIdAsync(token)); |
||||
|
ticket.Properties.SetProperty(OpenIddictConstants.Properties.AuthorizationId, |
||||
|
await manager.GetAuthorizationIdAsync(token)); |
||||
|
|
||||
|
if (Options.SaveToken) |
||||
|
{ |
||||
|
// Store the access token in the authentication ticket.
|
||||
|
ticket.Properties.StoreTokens(new[] |
||||
|
{ |
||||
|
new AuthenticationToken { Name = OAuthValidationConstants.Properties.Token, Value = payload } |
||||
|
}); |
||||
|
} |
||||
|
|
||||
|
// Resolve the primary identity associated with the principal.
|
||||
|
var identity = (ClaimsIdentity) ticket.Principal.Identity; |
||||
|
|
||||
|
// Copy the scopes extracted from the authentication ticket to the
|
||||
|
// ClaimsIdentity to make them easier to retrieve from application code.
|
||||
|
var scopes = ticket.Properties.GetProperty(OAuthValidationConstants.Properties.Scopes); |
||||
|
if (!string.IsNullOrEmpty(scopes)) |
||||
|
{ |
||||
|
foreach (var scope in JArray.Parse(scopes).Values<string>()) |
||||
|
{ |
||||
|
identity.AddClaim(new Claim(OAuthValidationConstants.Claims.Scope, scope)); |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
var notification = new CreateTicketContext(Context, Options, ticket); |
||||
|
await Options.Events.CreateTicket(notification); |
||||
|
|
||||
|
if (notification.HandledResponse) |
||||
|
{ |
||||
|
// If no ticket has been provided, return a failed result to
|
||||
|
// indicate that authentication was rejected by application code.
|
||||
|
if (notification.Ticket == null) |
||||
|
{ |
||||
|
return AuthenticateResult.Skip(); |
||||
|
} |
||||
|
|
||||
|
return AuthenticateResult.Success(notification.Ticket); |
||||
|
} |
||||
|
|
||||
|
else if (notification.Skipped) |
||||
|
{ |
||||
|
return AuthenticateResult.Skip(); |
||||
|
} |
||||
|
|
||||
|
return AuthenticateResult.Success(notification.Ticket); |
||||
|
} |
||||
|
} |
||||
|
} |
||||
@ -0,0 +1,78 @@ |
|||||
|
/* |
||||
|
* Licensed under the Apache License, Version 2.0 (http://www.apache.org/licenses/LICENSE-2.0)
|
||||
|
* See https://github.com/openiddict/openiddict-core for more information concerning
|
||||
|
* the license and the contributors participating to this project. |
||||
|
*/ |
||||
|
|
||||
|
using System; |
||||
|
using JetBrains.Annotations; |
||||
|
using Microsoft.AspNetCore.Http.Authentication; |
||||
|
|
||||
|
namespace OpenIddict.Validation |
||||
|
{ |
||||
|
/// <summary>
|
||||
|
/// Defines a set of commonly used helpers.
|
||||
|
/// </summary>
|
||||
|
internal static class OpenIddictValidationHelpers |
||||
|
{ |
||||
|
/// <summary>
|
||||
|
/// Gets a given property from the authentication properties.
|
||||
|
/// </summary>
|
||||
|
/// <param name="properties">The authentication properties.</param>
|
||||
|
/// <param name="property">The specific property to look for.</param>
|
||||
|
/// <returns>The value corresponding to the property, or <c>null</c> if the property cannot be found.</returns>
|
||||
|
public static string GetProperty([NotNull] this AuthenticationProperties properties, [NotNull] string property) |
||||
|
{ |
||||
|
if (properties == null) |
||||
|
{ |
||||
|
throw new ArgumentNullException(nameof(properties)); |
||||
|
} |
||||
|
|
||||
|
if (string.IsNullOrEmpty(property)) |
||||
|
{ |
||||
|
throw new ArgumentException("The property name cannot be null or empty.", nameof(property)); |
||||
|
} |
||||
|
|
||||
|
if (!properties.Items.TryGetValue(property, out string value)) |
||||
|
{ |
||||
|
return null; |
||||
|
} |
||||
|
|
||||
|
return value; |
||||
|
} |
||||
|
|
||||
|
/// <summary>
|
||||
|
/// Sets the specified property in the authentication properties.
|
||||
|
/// </summary>
|
||||
|
/// <param name="properties">The authentication properties.</param>
|
||||
|
/// <param name="property">The property name.</param>
|
||||
|
/// <param name="value">The property value.</param>
|
||||
|
/// <returns>The <see cref="AuthenticationProperties"/> so that multiple calls can be chained.</returns>
|
||||
|
public static AuthenticationProperties SetProperty( |
||||
|
[NotNull] this AuthenticationProperties properties, |
||||
|
[NotNull] string property, [CanBeNull] string value) |
||||
|
{ |
||||
|
if (properties == null) |
||||
|
{ |
||||
|
throw new ArgumentNullException(nameof(properties)); |
||||
|
} |
||||
|
|
||||
|
if (string.IsNullOrEmpty(property)) |
||||
|
{ |
||||
|
throw new ArgumentException("The property name cannot be null or empty.", nameof(property)); |
||||
|
} |
||||
|
|
||||
|
if (string.IsNullOrEmpty(value)) |
||||
|
{ |
||||
|
properties.Items.Remove(property); |
||||
|
} |
||||
|
|
||||
|
else |
||||
|
{ |
||||
|
properties.Items[property] = value; |
||||
|
} |
||||
|
|
||||
|
return properties; |
||||
|
} |
||||
|
} |
||||
|
} |
||||
@ -0,0 +1,52 @@ |
|||||
|
/* |
||||
|
* Licensed under the Apache License, Version 2.0 (http://www.apache.org/licenses/LICENSE-2.0)
|
||||
|
* See https://github.com/openiddict/openiddict-core for more information concerning
|
||||
|
* the license and the contributors participating to this project. |
||||
|
*/ |
||||
|
|
||||
|
using System.ComponentModel; |
||||
|
using System.Text.Encodings.Web; |
||||
|
using AspNet.Security.OAuth.Validation; |
||||
|
using JetBrains.Annotations; |
||||
|
using Microsoft.AspNetCore.Authentication; |
||||
|
using Microsoft.AspNetCore.DataProtection; |
||||
|
using Microsoft.AspNetCore.Http; |
||||
|
using Microsoft.Extensions.Logging; |
||||
|
using Microsoft.Extensions.Options; |
||||
|
|
||||
|
namespace OpenIddict.Validation |
||||
|
{ |
||||
|
[EditorBrowsable(EditorBrowsableState.Never)] |
||||
|
public class OpenIddictValidationMiddleware : OAuthValidationMiddleware |
||||
|
{ |
||||
|
public OpenIddictValidationMiddleware( |
||||
|
[NotNull] RequestDelegate next, |
||||
|
[NotNull] IOptions<OpenIddictValidationOptions> options, |
||||
|
[NotNull] ILoggerFactory loggerFactory, |
||||
|
[NotNull] UrlEncoder encoder, |
||||
|
[NotNull] IDataProtectionProvider dataProtectionProvider) |
||||
|
: base(next, options, loggerFactory, encoder, dataProtectionProvider) |
||||
|
{ |
||||
|
} |
||||
|
|
||||
|
protected override AuthenticationHandler<OAuthValidationOptions> CreateHandler() |
||||
|
=> new OpenIddictValidationHandler(); |
||||
|
} |
||||
|
|
||||
|
[EditorBrowsable(EditorBrowsableState.Never)] |
||||
|
public class OpenIddictValidationMiddleware<TToken> : OpenIddictValidationMiddleware where TToken : class |
||||
|
{ |
||||
|
public OpenIddictValidationMiddleware( |
||||
|
[NotNull] RequestDelegate next, |
||||
|
[NotNull] IOptions<OpenIddictValidationOptions> options, |
||||
|
[NotNull] ILoggerFactory loggerFactory, |
||||
|
[NotNull] UrlEncoder encoder, |
||||
|
[NotNull] IDataProtectionProvider dataProtectionProvider) |
||||
|
: base(next, options, loggerFactory, encoder, dataProtectionProvider) |
||||
|
{ |
||||
|
} |
||||
|
|
||||
|
protected override AuthenticationHandler<OAuthValidationOptions> CreateHandler() |
||||
|
=> new OpenIddictValidationHandler<TToken>(); |
||||
|
} |
||||
|
} |
||||
@ -0,0 +1,25 @@ |
|||||
|
<Project Sdk="Microsoft.NET.Sdk"> |
||||
|
|
||||
|
<Import Project="..\..\build\packages.props" /> |
||||
|
|
||||
|
<PropertyGroup> |
||||
|
<TargetFrameworks>net451;netstandard1.3</TargetFrameworks> |
||||
|
</PropertyGroup> |
||||
|
|
||||
|
<PropertyGroup> |
||||
|
<Description>OpenIddict token validation middleware for ASP.NET Core.</Description> |
||||
|
<Authors>Kévin Chalet;Chino Chang</Authors> |
||||
|
<PackageTags>aspnetcore;authentication;jwt;openidconnect;openiddict;security</PackageTags> |
||||
|
</PropertyGroup> |
||||
|
|
||||
|
<ItemGroup> |
||||
|
<ProjectReference Include="..\OpenIddict.Core\OpenIddict.Core.csproj" /> |
||||
|
</ItemGroup> |
||||
|
|
||||
|
<ItemGroup> |
||||
|
<PackageReference Include="AspNet.Security.OAuth.Validation" Version="$(AspNetContribOpenIdExtensionsVersion)" /> |
||||
|
<PackageReference Include="JetBrains.Annotations" Version="$(JetBrainsVersion)" PrivateAssets="All" /> |
||||
|
<PackageReference Include="Microsoft.AspNetCore.Authentication" Version="$(AspNetCoreVersion)" /> |
||||
|
</ItemGroup> |
||||
|
|
||||
|
</Project> |
||||
@ -0,0 +1,126 @@ |
|||||
|
/* |
||||
|
* Licensed under the Apache License, Version 2.0 (http://www.apache.org/licenses/LICENSE-2.0)
|
||||
|
* See https://github.com/openiddict/openiddict-core for more information concerning
|
||||
|
* the license and the contributors participating to this project. |
||||
|
*/ |
||||
|
|
||||
|
using System; |
||||
|
using System.ComponentModel; |
||||
|
using System.Linq; |
||||
|
using JetBrains.Annotations; |
||||
|
using Microsoft.AspNetCore.DataProtection; |
||||
|
using OpenIddict.Validation; |
||||
|
|
||||
|
namespace Microsoft.Extensions.DependencyInjection |
||||
|
{ |
||||
|
/// <summary>
|
||||
|
/// Exposes the necessary methods required to configure the OpenIddict validation services.
|
||||
|
/// </summary>
|
||||
|
public class OpenIddictValidationBuilder |
||||
|
{ |
||||
|
/// <summary>
|
||||
|
/// Initializes a new instance of <see cref="OpenIddictValidationBuilder"/>.
|
||||
|
/// </summary>
|
||||
|
/// <param name="services">The services collection.</param>
|
||||
|
public OpenIddictValidationBuilder([NotNull] IServiceCollection services) |
||||
|
{ |
||||
|
if (services == null) |
||||
|
{ |
||||
|
throw new ArgumentNullException(nameof(services)); |
||||
|
} |
||||
|
|
||||
|
Services = services; |
||||
|
} |
||||
|
|
||||
|
/// <summary>
|
||||
|
/// Gets the services collection.
|
||||
|
/// </summary>
|
||||
|
[EditorBrowsable(EditorBrowsableState.Never)] |
||||
|
public IServiceCollection Services { get; } |
||||
|
|
||||
|
/// <summary>
|
||||
|
/// Amends the default OpenIddict validation configuration.
|
||||
|
/// </summary>
|
||||
|
/// <param name="configuration">The delegate used to configure the OpenIddict options.</param>
|
||||
|
/// <remarks>This extension can be safely called multiple times.</remarks>
|
||||
|
/// <returns>The <see cref="OpenIddictValidationBuilder"/>.</returns>
|
||||
|
public OpenIddictValidationBuilder Configure([NotNull] Action<OpenIddictValidationOptions> configuration) |
||||
|
{ |
||||
|
if (configuration == null) |
||||
|
{ |
||||
|
throw new ArgumentNullException(nameof(configuration)); |
||||
|
} |
||||
|
|
||||
|
Services.Configure(configuration); |
||||
|
|
||||
|
return this; |
||||
|
} |
||||
|
|
||||
|
/// <summary>
|
||||
|
/// Registers the specified values as valid audiences. Setting the audiences is recommended
|
||||
|
/// when the authorization server issues access tokens for multiple distinct resource servers.
|
||||
|
/// </summary>
|
||||
|
/// <param name="audiences">The audiences valid for this resource server.</param>
|
||||
|
/// <returns>The <see cref="OpenIddictValidationBuilder"/>.</returns>
|
||||
|
public OpenIddictValidationBuilder AddAudiences([NotNull] params string[] audiences) |
||||
|
{ |
||||
|
if (audiences == null) |
||||
|
{ |
||||
|
throw new ArgumentNullException(nameof(audiences)); |
||||
|
} |
||||
|
|
||||
|
if (audiences.Any(audience => string.IsNullOrEmpty(audience))) |
||||
|
{ |
||||
|
throw new ArgumentException("Audiences cannot be null or empty.", nameof(audiences)); |
||||
|
} |
||||
|
|
||||
|
return Configure(options => options.Audiences.UnionWith(audiences)); |
||||
|
} |
||||
|
|
||||
|
/// <summary>
|
||||
|
/// Configures OpenIddict not to return the authentication error
|
||||
|
/// details as part of the standard WWW-Authenticate response header.
|
||||
|
/// </summary>
|
||||
|
/// <returns>The <see cref="OpenIddictValidationBuilder"/>.</returns>
|
||||
|
public OpenIddictValidationBuilder RemoveErrorDetails() |
||||
|
=> Configure(options => options.IncludeErrorDetails = false); |
||||
|
|
||||
|
/// <summary>
|
||||
|
/// Sets the realm, which is used to compute the WWW-Authenticate response header.
|
||||
|
/// </summary>
|
||||
|
/// <param name="realm">The realm.</param>
|
||||
|
/// <returns>The <see cref="OpenIddictValidationBuilder"/>.</returns>
|
||||
|
public OpenIddictValidationBuilder SetRealm([NotNull] string realm) |
||||
|
{ |
||||
|
if (string.IsNullOrEmpty(realm)) |
||||
|
{ |
||||
|
throw new ArgumentException("The realm cannot be null or empty.", nameof(realm)); |
||||
|
} |
||||
|
|
||||
|
return Configure(options => options.Realm = realm); |
||||
|
} |
||||
|
|
||||
|
/// <summary>
|
||||
|
/// Configures the OpenIddict validation handler to use reference tokens.
|
||||
|
/// </summary>
|
||||
|
/// <returns>The <see cref="OpenIddictValidationBuilder"/>.</returns>
|
||||
|
public OpenIddictValidationBuilder UseReferenceTokens() |
||||
|
=> Configure(options => options.UseReferenceTokens = true); |
||||
|
|
||||
|
/// <summary>
|
||||
|
/// Configures OpenIddict to use a specific data protection provider
|
||||
|
/// instead of relying on the default instance provided by the DI container.
|
||||
|
/// </summary>
|
||||
|
/// <param name="provider">The data protection provider used to create token protectors.</param>
|
||||
|
/// <returns>The <see cref="OpenIddictValidationBuilder"/>.</returns>
|
||||
|
public OpenIddictValidationBuilder UseDataProtectionProvider([NotNull] IDataProtectionProvider provider) |
||||
|
{ |
||||
|
if (provider == null) |
||||
|
{ |
||||
|
throw new ArgumentNullException(nameof(provider)); |
||||
|
} |
||||
|
|
||||
|
return Configure(options => options.DataProtectionProvider = provider); |
||||
|
} |
||||
|
} |
||||
|
} |
||||
@ -0,0 +1,124 @@ |
|||||
|
/* |
||||
|
* Licensed under the Apache License, Version 2.0 (http://www.apache.org/licenses/LICENSE-2.0)
|
||||
|
* See https://github.com/openiddict/openiddict-core for more information concerning
|
||||
|
* the license and the contributors participating to this project. |
||||
|
*/ |
||||
|
|
||||
|
using System; |
||||
|
using System.Text; |
||||
|
using AspNet.Security.OAuth.Validation; |
||||
|
using JetBrains.Annotations; |
||||
|
using Microsoft.AspNetCore.Authentication; |
||||
|
using Microsoft.AspNetCore.Builder; |
||||
|
using Microsoft.AspNetCore.DataProtection; |
||||
|
using Microsoft.Extensions.Options; |
||||
|
using OpenIddict.Core; |
||||
|
using OpenIddict.Validation; |
||||
|
|
||||
|
namespace Microsoft.Extensions.DependencyInjection |
||||
|
{ |
||||
|
public static class OpenIddictValidationExtensions |
||||
|
{ |
||||
|
/// <summary>
|
||||
|
/// Registers the OpenIddict token validation services in the DI container.
|
||||
|
/// </summary>
|
||||
|
/// <param name="builder">The services builder used by OpenIddict to register new services.</param>
|
||||
|
/// <remarks>This extension can be safely called multiple times.</remarks>
|
||||
|
/// <returns>The <see cref="OpenIddictValidationBuilder"/>.</returns>
|
||||
|
public static OpenIddictValidationBuilder AddValidation([NotNull] this OpenIddictBuilder builder) |
||||
|
{ |
||||
|
if (builder == null) |
||||
|
{ |
||||
|
throw new ArgumentNullException(nameof(builder)); |
||||
|
} |
||||
|
|
||||
|
builder.Services.AddAuthentication(); |
||||
|
|
||||
|
return new OpenIddictValidationBuilder(builder.Services); |
||||
|
} |
||||
|
|
||||
|
/// <summary>
|
||||
|
/// Registers the OpenIddict token validation services in the DI container.
|
||||
|
/// </summary>
|
||||
|
/// <param name="builder">The services builder used by OpenIddict to register new services.</param>
|
||||
|
/// <param name="configuration">The configuration delegate used to configure the validation services.</param>
|
||||
|
/// <remarks>This extension can be safely called multiple times.</remarks>
|
||||
|
/// <returns>The <see cref="OpenIddictBuilder"/>.</returns>
|
||||
|
public static OpenIddictBuilder AddValidation( |
||||
|
[NotNull] this OpenIddictBuilder builder, |
||||
|
[NotNull] Action<OpenIddictValidationBuilder> configuration) |
||||
|
{ |
||||
|
if (builder == null) |
||||
|
{ |
||||
|
throw new ArgumentNullException(nameof(builder)); |
||||
|
} |
||||
|
|
||||
|
if (configuration == null) |
||||
|
{ |
||||
|
throw new ArgumentNullException(nameof(configuration)); |
||||
|
} |
||||
|
|
||||
|
configuration(builder.AddValidation()); |
||||
|
|
||||
|
return builder; |
||||
|
} |
||||
|
|
||||
|
/// <summary>
|
||||
|
/// Registers the OpenIddict validation middleware in the ASP.NET Core pipeline.
|
||||
|
/// </summary>
|
||||
|
/// <param name="app">The application builder used to register middleware instances.</param>
|
||||
|
/// <returns>The <see cref="IApplicationBuilder"/>.</returns>
|
||||
|
public static IApplicationBuilder UseOpenIddictValidation([NotNull] this IApplicationBuilder app) |
||||
|
{ |
||||
|
if (app == null) |
||||
|
{ |
||||
|
throw new ArgumentNullException(nameof(app)); |
||||
|
} |
||||
|
|
||||
|
var configuration = app.ApplicationServices.GetRequiredService<IOptions<OpenIddictCoreOptions>>().Value; |
||||
|
|
||||
|
var options = app.ApplicationServices.GetRequiredService<IOptions<OpenIddictValidationOptions>>().Value; |
||||
|
if (options.Events == null) |
||||
|
{ |
||||
|
options.Events = new OAuthValidationEvents(); |
||||
|
} |
||||
|
|
||||
|
if (options.DataProtectionProvider == null) |
||||
|
{ |
||||
|
options.DataProtectionProvider = app.ApplicationServices.GetDataProtectionProvider(); |
||||
|
} |
||||
|
|
||||
|
if (options.UseReferenceTokens && options.AccessTokenFormat == null) |
||||
|
{ |
||||
|
var protector = options.DataProtectionProvider.CreateProtector( |
||||
|
"OpenIdConnectServerHandler", |
||||
|
nameof(options.AccessTokenFormat), |
||||
|
nameof(options.UseReferenceTokens), "ASOS"); |
||||
|
|
||||
|
options.AccessTokenFormat = new TicketDataFormat(protector); |
||||
|
} |
||||
|
|
||||
|
if (options.TokenType == null) |
||||
|
{ |
||||
|
options.TokenType = configuration.DefaultTokenType; |
||||
|
} |
||||
|
|
||||
|
if (options.UseReferenceTokens) |
||||
|
{ |
||||
|
if (options.TokenType == null) |
||||
|
{ |
||||
|
throw new InvalidOperationException(new StringBuilder() |
||||
|
.AppendLine("The entity types must be configured for the token validation services to work correctly.") |
||||
|
.Append("To configure the entities, use either 'services.AddOpenIddict().AddCore().UseDefaultModels()' ") |
||||
|
.Append("or 'services.AddOpenIddict().AddCore().UseCustomModels()'.") |
||||
|
.ToString()); |
||||
|
} |
||||
|
|
||||
|
return app.UseMiddleware(typeof(OpenIddictValidationMiddleware<>) |
||||
|
.MakeGenericType(options.TokenType), new OptionsWrapper<OpenIddictValidationOptions>(options)); |
||||
|
} |
||||
|
|
||||
|
return app.UseMiddleware<OpenIddictValidationMiddleware>(new OptionsWrapper<OpenIddictValidationOptions>(options)); |
||||
|
} |
||||
|
} |
||||
|
} |
||||
@ -0,0 +1,24 @@ |
|||||
|
/* |
||||
|
* Licensed under the Apache License, Version 2.0 (http://www.apache.org/licenses/LICENSE-2.0)
|
||||
|
* See https://github.com/openiddict/openiddict-core for more information concerning
|
||||
|
* the license and the contributors participating to this project. |
||||
|
*/ |
||||
|
|
||||
|
using System; |
||||
|
using AspNet.Security.OAuth.Validation; |
||||
|
|
||||
|
namespace OpenIddict.Validation |
||||
|
{ |
||||
|
public class OpenIddictValidationOptions : OAuthValidationOptions |
||||
|
{ |
||||
|
/// <summary>
|
||||
|
/// Gets or sets the type corresponding to the Token entity.
|
||||
|
/// </summary>
|
||||
|
public Type TokenType { get; set; } |
||||
|
|
||||
|
/// <summary>
|
||||
|
/// Gets or sets a boolean indicating whether reference tokens are used.
|
||||
|
/// </summary>
|
||||
|
public bool UseReferenceTokens { get; set; } |
||||
|
} |
||||
|
} |
||||
@ -0,0 +1,28 @@ |
|||||
|
<Project Sdk="Microsoft.NET.Sdk"> |
||||
|
|
||||
|
<Import Project="..\..\build\tests.props" /> |
||||
|
|
||||
|
<PropertyGroup> |
||||
|
<TargetFrameworks>netcoreapp2.0;net461</TargetFrameworks> |
||||
|
<TargetFrameworks Condition=" '$(OS)' != 'Windows_NT' ">netcoreapp2.0</TargetFrameworks> |
||||
|
</PropertyGroup> |
||||
|
|
||||
|
<ItemGroup> |
||||
|
<ProjectReference Include="..\..\src\OpenIddict\OpenIddict.csproj" /> |
||||
|
</ItemGroup> |
||||
|
|
||||
|
<ItemGroup> |
||||
|
<PackageReference Include="Microsoft.AspNetCore.TestHost" Version="$(AspNetCoreVersion)" /> |
||||
|
<PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="$(AspNetCoreVersion)" /> |
||||
|
<PackageReference Include="Microsoft.Extensions.Logging.Debug" Version="$(AspNetCoreVersion)" /> |
||||
|
<PackageReference Include="Microsoft.NET.Test.Sdk" Version="$(TestSdkVersion)" /> |
||||
|
<PackageReference Include="Moq" Version="$(MoqVersion)" /> |
||||
|
<PackageReference Include="xunit" Version="$(XunitVersion)" /> |
||||
|
<PackageReference Include="xunit.runner.visualstudio" Version="$(XunitVersion)" /> |
||||
|
</ItemGroup> |
||||
|
|
||||
|
<ItemGroup> |
||||
|
<Service Include="{82a7f48d-3b50-4b1e-b82e-3ada8210c358}" /> |
||||
|
</ItemGroup> |
||||
|
|
||||
|
</Project> |
||||
@ -0,0 +1,897 @@ |
|||||
|
/* |
||||
|
* Licensed under the Apache License, Version 2.0 (http://www.apache.org/licenses/LICENSE-2.0)
|
||||
|
* See https://github.com/openiddict/openiddict-core for more information concerning
|
||||
|
* the license and the contributors participating to this project. |
||||
|
*/ |
||||
|
|
||||
|
using System; |
||||
|
using System.Collections.Generic; |
||||
|
using System.Linq; |
||||
|
using System.Net; |
||||
|
using System.Net.Http; |
||||
|
using System.Net.Http.Headers; |
||||
|
using System.Security.Claims; |
||||
|
using System.Threading.Tasks; |
||||
|
using AspNet.Security.OAuth.Validation; |
||||
|
using Microsoft.AspNetCore.Authentication; |
||||
|
using Microsoft.AspNetCore.Builder; |
||||
|
using Microsoft.AspNetCore.DataProtection; |
||||
|
using Microsoft.AspNetCore.Hosting; |
||||
|
using Microsoft.AspNetCore.Http; |
||||
|
using Microsoft.AspNetCore.Http.Authentication; |
||||
|
using Microsoft.AspNetCore.Http.Features.Authentication; |
||||
|
using Microsoft.AspNetCore.TestHost; |
||||
|
using Microsoft.Extensions.DependencyInjection; |
||||
|
using Microsoft.Extensions.Logging; |
||||
|
using Microsoft.Extensions.Options; |
||||
|
using Moq; |
||||
|
using Newtonsoft.Json; |
||||
|
using Newtonsoft.Json.Linq; |
||||
|
using OpenIddict.Abstractions; |
||||
|
using OpenIddict.Core; |
||||
|
using OpenIddict.Models; |
||||
|
using Xunit; |
||||
|
|
||||
|
namespace OpenIddict.Validation.Tests |
||||
|
{ |
||||
|
public class OpenIddictValidationHandlerTests |
||||
|
{ |
||||
|
[Fact] |
||||
|
public async Task HandleAuthenticateAsync_InvalidTokenCausesInvalidAuthentication() |
||||
|
{ |
||||
|
// Arrange
|
||||
|
var server = CreateResourceServer(); |
||||
|
var client = server.CreateClient(); |
||||
|
|
||||
|
var request = new HttpRequestMessage(HttpMethod.Get, "/"); |
||||
|
request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", "invalid-token"); |
||||
|
|
||||
|
// Act
|
||||
|
var response = await client.SendAsync(request); |
||||
|
|
||||
|
// Assert
|
||||
|
Assert.Equal(HttpStatusCode.Unauthorized, response.StatusCode); |
||||
|
} |
||||
|
|
||||
|
[Fact] |
||||
|
public async Task HandleAuthenticateAsync_ValidTokenAllowsSuccessfulAuthentication() |
||||
|
{ |
||||
|
// Arrange
|
||||
|
var server = CreateResourceServer(); |
||||
|
var client = server.CreateClient(); |
||||
|
|
||||
|
var request = new HttpRequestMessage(HttpMethod.Get, "/"); |
||||
|
request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", "valid-token"); |
||||
|
|
||||
|
// Act
|
||||
|
var response = await client.SendAsync(request); |
||||
|
|
||||
|
// Assert
|
||||
|
Assert.Equal(HttpStatusCode.OK, response.StatusCode); |
||||
|
Assert.Equal("Fabrikam", await response.Content.ReadAsStringAsync()); |
||||
|
} |
||||
|
|
||||
|
[Fact] |
||||
|
public async Task HandleAuthenticateAsync_MissingAudienceCausesInvalidAuthentication() |
||||
|
{ |
||||
|
// Arrange
|
||||
|
var server = CreateResourceServer(builder => |
||||
|
{ |
||||
|
builder.AddAudiences("http://www.fabrikam.com/"); |
||||
|
}); |
||||
|
|
||||
|
var client = server.CreateClient(); |
||||
|
|
||||
|
var request = new HttpRequestMessage(HttpMethod.Get, "/"); |
||||
|
request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", "valid-token"); |
||||
|
|
||||
|
// Act
|
||||
|
var response = await client.SendAsync(request); |
||||
|
|
||||
|
// Assert
|
||||
|
Assert.Equal(HttpStatusCode.Unauthorized, response.StatusCode); |
||||
|
} |
||||
|
|
||||
|
[Fact] |
||||
|
public async Task HandleAuthenticateAsync_InvalidAudienceCausesInvalidAuthentication() |
||||
|
{ |
||||
|
// Arrange
|
||||
|
var server = CreateResourceServer(builder => |
||||
|
{ |
||||
|
builder.AddAudiences("http://www.fabrikam.com/"); |
||||
|
}); |
||||
|
|
||||
|
var client = server.CreateClient(); |
||||
|
|
||||
|
var request = new HttpRequestMessage(HttpMethod.Get, "/"); |
||||
|
request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", "valid-token-with-single-audience"); |
||||
|
|
||||
|
// Act
|
||||
|
var response = await client.SendAsync(request); |
||||
|
|
||||
|
// Assert
|
||||
|
Assert.Equal(HttpStatusCode.Unauthorized, response.StatusCode); |
||||
|
} |
||||
|
|
||||
|
[Fact] |
||||
|
public async Task HandleAuthenticateAsync_ValidAudienceAllowsSuccessfulAuthentication() |
||||
|
{ |
||||
|
// Arrange
|
||||
|
var server = CreateResourceServer(builder => |
||||
|
{ |
||||
|
builder.AddAudiences("http://www.fabrikam.com/"); |
||||
|
}); |
||||
|
|
||||
|
var client = server.CreateClient(); |
||||
|
|
||||
|
var request = new HttpRequestMessage(HttpMethod.Get, "/"); |
||||
|
request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", "valid-token-with-multiple-audiences"); |
||||
|
|
||||
|
// Act
|
||||
|
var response = await client.SendAsync(request); |
||||
|
|
||||
|
// Assert
|
||||
|
Assert.Equal(HttpStatusCode.OK, response.StatusCode); |
||||
|
Assert.Equal("Fabrikam", await response.Content.ReadAsStringAsync()); |
||||
|
} |
||||
|
|
||||
|
[Fact] |
||||
|
public async Task HandleAuthenticateAsync_AnyMatchingAudienceCausesSuccessfulAuthentication() |
||||
|
{ |
||||
|
// Arrange
|
||||
|
var server = CreateResourceServer(builder => |
||||
|
{ |
||||
|
builder.AddAudiences("http://www.contoso.com/"); |
||||
|
builder.AddAudiences("http://www.fabrikam.com/"); |
||||
|
}); |
||||
|
|
||||
|
var client = server.CreateClient(); |
||||
|
|
||||
|
var request = new HttpRequestMessage(HttpMethod.Get, "/"); |
||||
|
request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", "valid-token-with-single-audience"); |
||||
|
|
||||
|
// Act
|
||||
|
var response = await client.SendAsync(request); |
||||
|
|
||||
|
// Assert
|
||||
|
Assert.Equal(HttpStatusCode.OK, response.StatusCode); |
||||
|
Assert.Equal("Fabrikam", await response.Content.ReadAsStringAsync()); |
||||
|
} |
||||
|
|
||||
|
[Fact] |
||||
|
public async Task HandleAuthenticateAsync_MultipleMatchingAudienceCausesSuccessfulAuthentication() |
||||
|
{ |
||||
|
// Arrange
|
||||
|
var server = CreateResourceServer(builder => |
||||
|
{ |
||||
|
builder.AddAudiences("http://www.contoso.com/"); |
||||
|
builder.AddAudiences("http://www.fabrikam.com/"); |
||||
|
}); |
||||
|
|
||||
|
var client = server.CreateClient(); |
||||
|
|
||||
|
var request = new HttpRequestMessage(HttpMethod.Get, "/"); |
||||
|
request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", "valid-token-with-multiple-audiences"); |
||||
|
|
||||
|
// Act
|
||||
|
var response = await client.SendAsync(request); |
||||
|
|
||||
|
// Assert
|
||||
|
Assert.Equal(HttpStatusCode.OK, response.StatusCode); |
||||
|
Assert.Equal("Fabrikam", await response.Content.ReadAsStringAsync()); |
||||
|
} |
||||
|
|
||||
|
[Fact] |
||||
|
public async Task HandleAuthenticateAsync_ExpiredTicketCausesInvalidAuthentication() |
||||
|
{ |
||||
|
// Arrange
|
||||
|
var server = CreateResourceServer(); |
||||
|
var client = server.CreateClient(); |
||||
|
|
||||
|
var request = new HttpRequestMessage(HttpMethod.Get, "/"); |
||||
|
request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", "expired-token"); |
||||
|
|
||||
|
// Act
|
||||
|
var response = await client.SendAsync(request); |
||||
|
|
||||
|
// Assert
|
||||
|
Assert.Equal(HttpStatusCode.Unauthorized, response.StatusCode); |
||||
|
} |
||||
|
|
||||
|
[Fact] |
||||
|
public async Task HandleAuthenticateAsync_AuthenticationTicketContainsRequiredClaims() |
||||
|
{ |
||||
|
// Arrange
|
||||
|
var server = CreateResourceServer(); |
||||
|
var client = server.CreateClient(); |
||||
|
|
||||
|
var request = new HttpRequestMessage(HttpMethod.Get, "/ticket"); |
||||
|
request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", "valid-token-with-scopes"); |
||||
|
|
||||
|
// Act
|
||||
|
var response = await client.SendAsync(request); |
||||
|
|
||||
|
var ticket = JObject.Parse(await response.Content.ReadAsStringAsync()); |
||||
|
var claims = from claim in ticket.Value<JArray>("Claims") |
||||
|
select new |
||||
|
{ |
||||
|
Type = claim.Value<string>(nameof(Claim.Type)), |
||||
|
Value = claim.Value<string>(nameof(Claim.Value)) |
||||
|
}; |
||||
|
|
||||
|
// Assert
|
||||
|
Assert.Equal(HttpStatusCode.OK, response.StatusCode); |
||||
|
|
||||
|
Assert.Contains(claims, claim => claim.Type == OAuthValidationConstants.Claims.Subject && |
||||
|
claim.Value == "Fabrikam"); |
||||
|
|
||||
|
Assert.Contains(claims, claim => claim.Type == OAuthValidationConstants.Claims.Scope && |
||||
|
claim.Value == "C54A8F5E-0387-43F4-BA43-FD4B50DC190D"); |
||||
|
|
||||
|
Assert.Contains(claims, claim => claim.Type == OAuthValidationConstants.Claims.Scope && |
||||
|
claim.Value == "5C57E3BD-9EFB-4224-9AB8-C8C5E009FFD7"); |
||||
|
} |
||||
|
|
||||
|
[Fact] |
||||
|
public async Task HandleAuthenticateAsync_AuthenticationTicketContainsRequiredProperties() |
||||
|
{ |
||||
|
// Arrange
|
||||
|
var server = CreateResourceServer(builder => |
||||
|
{ |
||||
|
builder.Configure(options => options.SaveToken = true); |
||||
|
}); |
||||
|
|
||||
|
var client = server.CreateClient(); |
||||
|
|
||||
|
var request = new HttpRequestMessage(HttpMethod.Get, "/ticket"); |
||||
|
request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", "valid-token"); |
||||
|
|
||||
|
// Act
|
||||
|
var response = await client.SendAsync(request); |
||||
|
|
||||
|
var ticket = JObject.Parse(await response.Content.ReadAsStringAsync()); |
||||
|
var properties = from claim in ticket.Value<JArray>("Properties") |
||||
|
select new |
||||
|
{ |
||||
|
Name = claim.Value<string>("Name"), |
||||
|
Value = claim.Value<string>("Value") |
||||
|
}; |
||||
|
|
||||
|
// Assert
|
||||
|
Assert.Equal(HttpStatusCode.OK, response.StatusCode); |
||||
|
|
||||
|
Assert.Contains(properties, property => property.Name == ".Token.access_token" && |
||||
|
property.Value == "valid-token"); |
||||
|
} |
||||
|
|
||||
|
[Fact] |
||||
|
public async Task HandleAuthenticateAsync_InvalidReplacedTokenCausesInvalidAuthentication() |
||||
|
{ |
||||
|
// Arrange
|
||||
|
var server = CreateResourceServer(builder => |
||||
|
{ |
||||
|
builder.Configure(options => options.Events.OnRetrieveToken = context => |
||||
|
{ |
||||
|
context.Token = "invalid-token"; |
||||
|
|
||||
|
return Task.FromResult(0); |
||||
|
}); |
||||
|
}); |
||||
|
|
||||
|
var client = server.CreateClient(); |
||||
|
|
||||
|
var request = new HttpRequestMessage(HttpMethod.Get, "/"); |
||||
|
request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", "valid-token"); |
||||
|
|
||||
|
// Act
|
||||
|
var response = await client.SendAsync(request); |
||||
|
|
||||
|
// Assert
|
||||
|
Assert.Equal(HttpStatusCode.Unauthorized, response.StatusCode); |
||||
|
} |
||||
|
|
||||
|
[Fact] |
||||
|
public async Task HandleAuthenticateAsync_ValidReplacedTokenCausesSuccessfulAuthentication() |
||||
|
{ |
||||
|
// Arrange
|
||||
|
var server = CreateResourceServer(builder => |
||||
|
{ |
||||
|
builder.Configure(options => options.Events.OnRetrieveToken = context => |
||||
|
{ |
||||
|
context.Token = "valid-token"; |
||||
|
|
||||
|
return Task.FromResult(0); |
||||
|
}); |
||||
|
}); |
||||
|
|
||||
|
var client = server.CreateClient(); |
||||
|
|
||||
|
var request = new HttpRequestMessage(HttpMethod.Get, "/"); |
||||
|
request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", "invalid-token"); |
||||
|
|
||||
|
// Act
|
||||
|
var response = await client.SendAsync(request); |
||||
|
|
||||
|
// Assert
|
||||
|
Assert.Equal(HttpStatusCode.OK, response.StatusCode); |
||||
|
Assert.Equal("Fabrikam", await response.Content.ReadAsStringAsync()); |
||||
|
} |
||||
|
|
||||
|
[Fact] |
||||
|
public async Task HandleAuthenticateAsync_SkipToNextMiddlewareFromReceiveTokenCausesInvalidAuthentication() |
||||
|
{ |
||||
|
// Arrange
|
||||
|
var server = CreateResourceServer(builder => |
||||
|
{ |
||||
|
builder.Configure(options => options.Events.OnRetrieveToken = context => |
||||
|
{ |
||||
|
context.SkipToNextMiddleware(); |
||||
|
|
||||
|
return Task.FromResult(0); |
||||
|
}); |
||||
|
}); |
||||
|
|
||||
|
var client = server.CreateClient(); |
||||
|
|
||||
|
var request = new HttpRequestMessage(HttpMethod.Get, "/"); |
||||
|
request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", "valid-token"); |
||||
|
|
||||
|
// Act
|
||||
|
var response = await client.SendAsync(request); |
||||
|
|
||||
|
// Assert
|
||||
|
Assert.Equal(HttpStatusCode.Unauthorized, response.StatusCode); |
||||
|
} |
||||
|
|
||||
|
[Fact] |
||||
|
public async Task HandleAuthenticateAsync_NullTicketAndHandleResponseFromReceiveTokenCauseInvalidAuthentication() |
||||
|
{ |
||||
|
// Arrange
|
||||
|
var server = CreateResourceServer(builder => |
||||
|
{ |
||||
|
builder.Configure(options => options.Events.OnRetrieveToken = context => |
||||
|
{ |
||||
|
context.Ticket = null; |
||||
|
context.HandleResponse(); |
||||
|
|
||||
|
return Task.FromResult(0); |
||||
|
}); |
||||
|
}); |
||||
|
|
||||
|
var client = server.CreateClient(); |
||||
|
|
||||
|
var request = new HttpRequestMessage(HttpMethod.Get, "/"); |
||||
|
request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", "valid-token"); |
||||
|
|
||||
|
// Act
|
||||
|
var response = await client.SendAsync(request); |
||||
|
|
||||
|
// Assert
|
||||
|
Assert.Equal(HttpStatusCode.Unauthorized, response.StatusCode); |
||||
|
} |
||||
|
|
||||
|
[Fact] |
||||
|
public async Task HandleAuthenticateAsync_ReplacedTicketAndHandleResponseFromReceiveTokenCauseSuccessfulAuthentication() |
||||
|
{ |
||||
|
// Arrange
|
||||
|
var server = CreateResourceServer(builder => |
||||
|
{ |
||||
|
builder.Configure(options => options.Events.OnRetrieveToken = context => |
||||
|
{ |
||||
|
var identity = new ClaimsIdentity(context.Options.AuthenticationScheme); |
||||
|
identity.AddClaim(new Claim(OAuthValidationConstants.Claims.Subject, "Fabrikam")); |
||||
|
|
||||
|
context.Ticket = new AuthenticationTicket( |
||||
|
new ClaimsPrincipal(identity), |
||||
|
new AuthenticationProperties(), |
||||
|
context.Options.AuthenticationScheme); |
||||
|
|
||||
|
context.HandleResponse(); |
||||
|
|
||||
|
return Task.FromResult(0); |
||||
|
}); |
||||
|
}); |
||||
|
|
||||
|
var client = server.CreateClient(); |
||||
|
|
||||
|
var request = new HttpRequestMessage(HttpMethod.Get, "/"); |
||||
|
request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", "invalid-token"); |
||||
|
|
||||
|
// Act
|
||||
|
var response = await client.SendAsync(request); |
||||
|
|
||||
|
// Assert
|
||||
|
Assert.Equal(HttpStatusCode.OK, response.StatusCode); |
||||
|
Assert.Equal("Fabrikam", await response.Content.ReadAsStringAsync()); |
||||
|
} |
||||
|
|
||||
|
[Fact] |
||||
|
public async Task HandleAuthenticateAsync_SkipToNextMiddlewareFromValidateTokenCausesInvalidAuthentication() |
||||
|
{ |
||||
|
// Arrange
|
||||
|
var server = CreateResourceServer(builder => |
||||
|
{ |
||||
|
builder.Configure(options => options.Events.OnValidateToken = context => |
||||
|
{ |
||||
|
context.SkipToNextMiddleware(); |
||||
|
|
||||
|
return Task.FromResult(0); |
||||
|
}); |
||||
|
}); |
||||
|
|
||||
|
var client = server.CreateClient(); |
||||
|
|
||||
|
var request = new HttpRequestMessage(HttpMethod.Get, "/"); |
||||
|
request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", "valid-token"); |
||||
|
|
||||
|
// Act
|
||||
|
var response = await client.SendAsync(request); |
||||
|
|
||||
|
// Assert
|
||||
|
Assert.Equal(HttpStatusCode.Unauthorized, response.StatusCode); |
||||
|
} |
||||
|
|
||||
|
[Fact] |
||||
|
public async Task HandleAuthenticateAsync_NullTicketAndHandleResponseFromValidateTokenCauseInvalidAuthentication() |
||||
|
{ |
||||
|
// Arrange
|
||||
|
var server = CreateResourceServer(builder => |
||||
|
{ |
||||
|
builder.Configure(options => options.Events.OnValidateToken = context => |
||||
|
{ |
||||
|
context.Ticket = null; |
||||
|
context.HandleResponse(); |
||||
|
|
||||
|
return Task.FromResult(0); |
||||
|
}); |
||||
|
}); |
||||
|
|
||||
|
var client = server.CreateClient(); |
||||
|
|
||||
|
var request = new HttpRequestMessage(HttpMethod.Get, "/"); |
||||
|
request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", "valid-token"); |
||||
|
|
||||
|
// Act
|
||||
|
var response = await client.SendAsync(request); |
||||
|
|
||||
|
// Assert
|
||||
|
Assert.Equal(HttpStatusCode.Unauthorized, response.StatusCode); |
||||
|
} |
||||
|
|
||||
|
[Fact] |
||||
|
public async Task HandleAuthenticateAsync_ReplacedTicketAndHandleResponseFromValidateTokenCauseSuccessfulAuthentication() |
||||
|
{ |
||||
|
// Arrange
|
||||
|
var server = CreateResourceServer(builder => |
||||
|
{ |
||||
|
builder.Configure(options => options.Events.OnValidateToken = context => |
||||
|
{ |
||||
|
var identity = new ClaimsIdentity(context.Options.AuthenticationScheme); |
||||
|
identity.AddClaim(new Claim(OAuthValidationConstants.Claims.Subject, "Contoso")); |
||||
|
|
||||
|
context.Ticket = new AuthenticationTicket( |
||||
|
new ClaimsPrincipal(identity), |
||||
|
new AuthenticationProperties(), |
||||
|
context.Options.AuthenticationScheme); |
||||
|
|
||||
|
context.HandleResponse(); |
||||
|
|
||||
|
return Task.FromResult(0); |
||||
|
}); |
||||
|
}); |
||||
|
|
||||
|
var client = server.CreateClient(); |
||||
|
|
||||
|
var request = new HttpRequestMessage(HttpMethod.Get, "/"); |
||||
|
request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", "valid-token"); |
||||
|
|
||||
|
// Act
|
||||
|
var response = await client.SendAsync(request); |
||||
|
|
||||
|
// Assert
|
||||
|
Assert.Equal(HttpStatusCode.OK, response.StatusCode); |
||||
|
Assert.Equal("Contoso", await response.Content.ReadAsStringAsync()); |
||||
|
} |
||||
|
|
||||
|
[Fact] |
||||
|
public async Task HandleAuthenticateAsync_UpdatedTicketFromValidateTokenCausesSuccessfulAuthentication() |
||||
|
{ |
||||
|
// Arrange
|
||||
|
var server = CreateResourceServer(builder => |
||||
|
{ |
||||
|
builder.Configure(options => options.Events.OnValidateToken = context => |
||||
|
{ |
||||
|
var identity = new ClaimsIdentity(context.Options.AuthenticationScheme); |
||||
|
identity.AddClaim(new Claim(OAuthValidationConstants.Claims.Subject, "Contoso")); |
||||
|
|
||||
|
context.Ticket = new AuthenticationTicket( |
||||
|
new ClaimsPrincipal(identity), |
||||
|
new AuthenticationProperties(), |
||||
|
context.Options.AuthenticationScheme); |
||||
|
|
||||
|
context.HandleResponse(); |
||||
|
|
||||
|
return Task.FromResult(0); |
||||
|
}); |
||||
|
}); |
||||
|
|
||||
|
var client = server.CreateClient(); |
||||
|
|
||||
|
var request = new HttpRequestMessage(HttpMethod.Get, "/"); |
||||
|
request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", "valid-token"); |
||||
|
|
||||
|
// Act
|
||||
|
var response = await client.SendAsync(request); |
||||
|
|
||||
|
// Assert
|
||||
|
Assert.Equal(HttpStatusCode.OK, response.StatusCode); |
||||
|
Assert.Equal("Contoso", await response.Content.ReadAsStringAsync()); |
||||
|
} |
||||
|
|
||||
|
[Fact] |
||||
|
public async Task HandleUnauthorizedAsync_ErrorDetailsAreResolvedFromChallengeContext() |
||||
|
{ |
||||
|
// Arrange
|
||||
|
var server = CreateResourceServer(builder => |
||||
|
{ |
||||
|
builder.RemoveErrorDetails(); |
||||
|
builder.SetRealm("global_realm"); |
||||
|
|
||||
|
builder.Configure(options => options.Events.OnApplyChallenge = context => |
||||
|
{ |
||||
|
// Assert
|
||||
|
Assert.Equal(context.Error, "custom_error"); |
||||
|
Assert.Equal(context.ErrorDescription, "custom_error_description"); |
||||
|
Assert.Equal(context.ErrorUri, "custom_error_uri"); |
||||
|
Assert.Equal(context.Realm, "custom_realm"); |
||||
|
Assert.Equal(context.Scope, "custom_scope"); |
||||
|
|
||||
|
return Task.FromResult(0); |
||||
|
}); |
||||
|
}); |
||||
|
|
||||
|
var client = server.CreateClient(); |
||||
|
|
||||
|
// Act
|
||||
|
var response = await client.GetAsync("/challenge"); |
||||
|
|
||||
|
// Assert
|
||||
|
Assert.Equal(HttpStatusCode.Unauthorized, response.StatusCode); |
||||
|
Assert.Equal(@"Bearer realm=""custom_realm"", error=""custom_error"", error_description=""custom_error_description"", " + |
||||
|
@"error_uri=""custom_error_uri"", scope=""custom_scope""", response.Headers.WwwAuthenticate.ToString()); |
||||
|
} |
||||
|
|
||||
|
[Theory] |
||||
|
[InlineData("invalid-token", OAuthValidationConstants.Errors.InvalidToken, "The access token is not valid.")] |
||||
|
[InlineData("expired-token", OAuthValidationConstants.Errors.InvalidToken, "The access token is no longer valid.")] |
||||
|
public async Task HandleUnauthorizedAsync_ErrorDetailsAreInferredFromAuthenticationFailure( |
||||
|
string token, string error, string description) |
||||
|
{ |
||||
|
// Arrange
|
||||
|
var server = CreateResourceServer(); |
||||
|
var client = server.CreateClient(); |
||||
|
|
||||
|
var request = new HttpRequestMessage(HttpMethod.Get, "/"); |
||||
|
request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", token); |
||||
|
|
||||
|
// Act
|
||||
|
var response = await client.SendAsync(request); |
||||
|
|
||||
|
// Assert
|
||||
|
Assert.Equal(HttpStatusCode.Unauthorized, response.StatusCode); |
||||
|
Assert.Equal($@"Bearer error=""{error}"", error_description=""{description}""", |
||||
|
response.Headers.WwwAuthenticate.ToString()); |
||||
|
} |
||||
|
|
||||
|
[Fact] |
||||
|
public async Task HandleUnauthorizedAsync_ApplyChallenge_AllowsHandlingResponse() |
||||
|
{ |
||||
|
// Arrange
|
||||
|
var server = CreateResourceServer(builder => |
||||
|
{ |
||||
|
builder.Configure(options => options.Events.OnApplyChallenge = context => |
||||
|
{ |
||||
|
context.HandleResponse(); |
||||
|
context.HttpContext.Response.Headers["X-Custom-Authentication-Header"] = "Bearer"; |
||||
|
|
||||
|
return Task.FromResult(0); |
||||
|
}); |
||||
|
}); |
||||
|
|
||||
|
var client = server.CreateClient(); |
||||
|
|
||||
|
// Act
|
||||
|
var response = await client.GetAsync("/challenge"); |
||||
|
|
||||
|
// Assert
|
||||
|
Assert.Equal(HttpStatusCode.OK, response.StatusCode); |
||||
|
Assert.Empty(response.Headers.WwwAuthenticate); |
||||
|
Assert.Equal(new[] { "Bearer" }, response.Headers.GetValues("X-Custom-Authentication-Header")); |
||||
|
} |
||||
|
|
||||
|
[Fact] |
||||
|
public async Task HandleUnauthorizedAsync_ApplyChallenge_AllowsSkippingToNextMiddleware() |
||||
|
{ |
||||
|
// Arrange
|
||||
|
var server = CreateResourceServer(builder => |
||||
|
{ |
||||
|
builder.Configure(options => options.Events.OnApplyChallenge = context => |
||||
|
{ |
||||
|
context.SkipToNextMiddleware(); |
||||
|
|
||||
|
return Task.FromResult(0); |
||||
|
}); |
||||
|
}); |
||||
|
|
||||
|
var client = server.CreateClient(); |
||||
|
|
||||
|
// Act
|
||||
|
var response = await client.GetAsync("/challenge"); |
||||
|
|
||||
|
// Assert
|
||||
|
Assert.Equal(HttpStatusCode.OK, response.StatusCode); |
||||
|
Assert.Empty(response.Headers.WwwAuthenticate); |
||||
|
Assert.Empty(await response.Content.ReadAsStringAsync()); |
||||
|
} |
||||
|
|
||||
|
[Theory] |
||||
|
[InlineData(null, null, null, null, null, "Bearer")] |
||||
|
[InlineData("custom_error", null, null, null, null, @"Bearer error=""custom_error""")] |
||||
|
[InlineData(null, "custom_error_description", null, null, null, @"Bearer error_description=""custom_error_description""")] |
||||
|
[InlineData(null, null, "custom_error_uri", null, null, @"Bearer error_uri=""custom_error_uri""")] |
||||
|
[InlineData(null, null, null, "custom_realm", null, @"Bearer realm=""custom_realm""")] |
||||
|
[InlineData(null, null, null, null, "custom_scope", @"Bearer scope=""custom_scope""")] |
||||
|
[InlineData("custom_error", "custom_error_description", "custom_error_uri", "custom_realm", "custom_scope", |
||||
|
@"Bearer realm=""custom_realm"", error=""custom_error"", " + |
||||
|
@"error_description=""custom_error_description"", " + |
||||
|
@"error_uri=""custom_error_uri"", scope=""custom_scope""")] |
||||
|
public async Task HandleUnauthorizedAsync_ReturnsExpectedWwwAuthenticateHeader( |
||||
|
string error, string description, string uri, string realm, string scope, string header) |
||||
|
{ |
||||
|
// Arrange
|
||||
|
var server = CreateResourceServer(builder => |
||||
|
{ |
||||
|
builder.Configure(options => options.Events.OnApplyChallenge = context => |
||||
|
{ |
||||
|
context.Error = error; |
||||
|
context.ErrorDescription = description; |
||||
|
context.ErrorUri = uri; |
||||
|
context.Realm = realm; |
||||
|
context.Scope = scope; |
||||
|
|
||||
|
return Task.FromResult(0); |
||||
|
}); |
||||
|
}); |
||||
|
|
||||
|
var client = server.CreateClient(); |
||||
|
|
||||
|
// Act
|
||||
|
var response = await client.GetAsync("/challenge"); |
||||
|
|
||||
|
// Assert
|
||||
|
Assert.Equal(HttpStatusCode.Unauthorized, response.StatusCode); |
||||
|
Assert.Equal(header, response.Headers.WwwAuthenticate.ToString()); |
||||
|
} |
||||
|
|
||||
|
private static TestServer CreateResourceServer(Action<OpenIddictValidationBuilder> configuration = null) |
||||
|
{ |
||||
|
var format = new Mock<ISecureDataFormat<AuthenticationTicket>>(MockBehavior.Strict); |
||||
|
|
||||
|
format.Setup(mock => mock.Unprotect(It.Is<string>(token => token == "invalid-token"))) |
||||
|
.Returns(value: null); |
||||
|
|
||||
|
format.Setup(mock => mock.Unprotect(It.Is<string>(token => token == "valid-token"))) |
||||
|
.Returns(delegate |
||||
|
{ |
||||
|
var identity = new ClaimsIdentity(OAuthValidationDefaults.AuthenticationScheme); |
||||
|
identity.AddClaim(new Claim(OAuthValidationConstants.Claims.Subject, "Fabrikam")); |
||||
|
|
||||
|
var properties = new AuthenticationProperties(); |
||||
|
|
||||
|
return new AuthenticationTicket(new ClaimsPrincipal(identity), |
||||
|
properties, OAuthValidationDefaults.AuthenticationScheme); |
||||
|
}); |
||||
|
|
||||
|
format.Setup(mock => mock.Unprotect(It.Is<string>(token => token == "valid-token-with-scopes"))) |
||||
|
.Returns(delegate |
||||
|
{ |
||||
|
var identity = new ClaimsIdentity(OAuthValidationDefaults.AuthenticationScheme); |
||||
|
identity.AddClaim(new Claim(OAuthValidationConstants.Claims.Subject, "Fabrikam")); |
||||
|
|
||||
|
var properties = new AuthenticationProperties(); |
||||
|
properties.Items[OAuthValidationConstants.Properties.Scopes] = |
||||
|
@"[""C54A8F5E-0387-43F4-BA43-FD4B50DC190D"",""5C57E3BD-9EFB-4224-9AB8-C8C5E009FFD7""]"; |
||||
|
|
||||
|
return new AuthenticationTicket(new ClaimsPrincipal(identity), |
||||
|
properties, OAuthValidationDefaults.AuthenticationScheme); |
||||
|
}); |
||||
|
|
||||
|
format.Setup(mock => mock.Unprotect(It.Is<string>(token => token == "valid-token-with-single-audience"))) |
||||
|
.Returns(delegate |
||||
|
{ |
||||
|
var identity = new ClaimsIdentity(OAuthValidationDefaults.AuthenticationScheme); |
||||
|
identity.AddClaim(new Claim(OAuthValidationConstants.Claims.Subject, "Fabrikam")); |
||||
|
|
||||
|
var properties = new AuthenticationProperties(new Dictionary<string, string> |
||||
|
{ |
||||
|
[OAuthValidationConstants.Properties.Audiences] = @"[""http://www.contoso.com/""]" |
||||
|
}); |
||||
|
|
||||
|
return new AuthenticationTicket(new ClaimsPrincipal(identity), |
||||
|
properties, OAuthValidationDefaults.AuthenticationScheme); |
||||
|
}); |
||||
|
|
||||
|
format.Setup(mock => mock.Unprotect(It.Is<string>(token => token == "valid-token-with-multiple-audiences"))) |
||||
|
.Returns(delegate |
||||
|
{ |
||||
|
var identity = new ClaimsIdentity(OAuthValidationDefaults.AuthenticationScheme); |
||||
|
identity.AddClaim(new Claim(OAuthValidationConstants.Claims.Subject, "Fabrikam")); |
||||
|
|
||||
|
var properties = new AuthenticationProperties(new Dictionary<string, string> |
||||
|
{ |
||||
|
[OAuthValidationConstants.Properties.Audiences] = @"[""http://www.contoso.com/"",""http://www.fabrikam.com/""]" |
||||
|
}); |
||||
|
|
||||
|
return new AuthenticationTicket(new ClaimsPrincipal(identity), |
||||
|
properties, OAuthValidationDefaults.AuthenticationScheme); |
||||
|
}); |
||||
|
|
||||
|
format.Setup(mock => mock.Unprotect(It.Is<string>(token => token == "expired-token"))) |
||||
|
.Returns(delegate |
||||
|
{ |
||||
|
var identity = new ClaimsIdentity(OAuthValidationDefaults.AuthenticationScheme); |
||||
|
identity.AddClaim(new Claim(OAuthValidationConstants.Claims.Subject, "Fabrikam")); |
||||
|
|
||||
|
var properties = new AuthenticationProperties(); |
||||
|
properties.ExpiresUtc = DateTimeOffset.UtcNow - TimeSpan.FromDays(1); |
||||
|
|
||||
|
return new AuthenticationTicket(new ClaimsPrincipal(identity), |
||||
|
properties, OAuthValidationDefaults.AuthenticationScheme); |
||||
|
}); |
||||
|
|
||||
|
var builder = new WebHostBuilder(); |
||||
|
builder.UseEnvironment("Testing"); |
||||
|
|
||||
|
builder.ConfigureLogging(options => options.AddDebug()); |
||||
|
|
||||
|
builder.ConfigureServices(services => |
||||
|
{ |
||||
|
services.AddOpenIddict() |
||||
|
.AddCore(options => |
||||
|
{ |
||||
|
options.UseDefaultModels(); |
||||
|
|
||||
|
// Replace the default OpenIddict managers.
|
||||
|
options.Services.AddSingleton(CreateApplicationManager()); |
||||
|
options.Services.AddSingleton(CreateAuthorizationManager()); |
||||
|
options.Services.AddSingleton(CreateScopeManager()); |
||||
|
options.Services.AddSingleton(CreateTokenManager()); |
||||
|
}) |
||||
|
|
||||
|
.AddValidation(options => |
||||
|
{ |
||||
|
options.Configure(settings => settings.AccessTokenFormat = format.Object); |
||||
|
|
||||
|
// Note: overriding the default data protection provider is not necessary for the tests to pass,
|
||||
|
// but is useful to ensure unnecessary keys are not persisted in testing environments, which also
|
||||
|
// helps make the unit tests run faster, as no registry or disk access is required in this case.
|
||||
|
options.UseDataProtectionProvider(new EphemeralDataProtectionProvider()); |
||||
|
|
||||
|
// Run the configuration delegate
|
||||
|
// registered by the unit tests.
|
||||
|
configuration?.Invoke(options); |
||||
|
}); |
||||
|
}); |
||||
|
|
||||
|
builder.Configure(app => |
||||
|
{ |
||||
|
app.UseOpenIddictValidation(); |
||||
|
|
||||
|
app.Map("/ticket", map => map.Run(async context => |
||||
|
{ |
||||
|
var ticket = new AuthenticateContext(OAuthValidationDefaults.AuthenticationScheme); |
||||
|
await context.Authentication.AuthenticateAsync(ticket); |
||||
|
|
||||
|
if (!ticket.Accepted || ticket.Principal == null || ticket.Properties == null) |
||||
|
{ |
||||
|
await context.Authentication.ChallengeAsync(); |
||||
|
|
||||
|
return; |
||||
|
} |
||||
|
|
||||
|
context.Response.ContentType = "application/json"; |
||||
|
|
||||
|
// Return the authentication ticket as a JSON object.
|
||||
|
await context.Response.WriteAsync(JsonConvert.SerializeObject(new |
||||
|
{ |
||||
|
Claims = from claim in ticket.Principal.Claims |
||||
|
select new { claim.Type, claim.Value }, |
||||
|
|
||||
|
Properties = from property in ticket.Properties |
||||
|
select new { Name = property.Key, property.Value } |
||||
|
})); |
||||
|
})); |
||||
|
|
||||
|
app.Map("/challenge", map => map.Run(context => |
||||
|
{ |
||||
|
var properties = new AuthenticationProperties(new Dictionary<string, string> |
||||
|
{ |
||||
|
[OAuthValidationConstants.Properties.Error] = "custom_error", |
||||
|
[OAuthValidationConstants.Properties.ErrorDescription] = "custom_error_description", |
||||
|
[OAuthValidationConstants.Properties.ErrorUri] = "custom_error_uri", |
||||
|
[OAuthValidationConstants.Properties.Realm] = "custom_realm", |
||||
|
[OAuthValidationConstants.Properties.Scope] = "custom_scope", |
||||
|
}); |
||||
|
|
||||
|
return context.Authentication.ChallengeAsync(OAuthValidationDefaults.AuthenticationScheme, properties); |
||||
|
})); |
||||
|
|
||||
|
app.Run(context => |
||||
|
{ |
||||
|
if (!context.User.Identities.Any(identity => identity.IsAuthenticated)) |
||||
|
{ |
||||
|
return context.Authentication.ChallengeAsync(); |
||||
|
} |
||||
|
|
||||
|
var identifier = context.User.FindFirst(OAuthValidationConstants.Claims.Subject).Value; |
||||
|
return context.Response.WriteAsync(identifier); |
||||
|
}); |
||||
|
}); |
||||
|
|
||||
|
return new TestServer(builder); |
||||
|
|
||||
|
} |
||||
|
|
||||
|
private static OpenIddictApplicationManager<OpenIddictApplication> CreateApplicationManager( |
||||
|
Action<Mock<OpenIddictApplicationManager<OpenIddictApplication>>> configuration = null) |
||||
|
{ |
||||
|
var manager = new Mock<OpenIddictApplicationManager<OpenIddictApplication>>( |
||||
|
Mock.Of<IOpenIddictApplicationStoreResolver>(), |
||||
|
Mock.Of<ILogger<OpenIddictApplicationManager<OpenIddictApplication>>>(), |
||||
|
Mock.Of<IOptions<OpenIddictCoreOptions>>()); |
||||
|
|
||||
|
configuration?.Invoke(manager); |
||||
|
|
||||
|
return manager.Object; |
||||
|
} |
||||
|
|
||||
|
private static OpenIddictAuthorizationManager<OpenIddictAuthorization> CreateAuthorizationManager( |
||||
|
Action<Mock<OpenIddictAuthorizationManager<OpenIddictAuthorization>>> configuration = null) |
||||
|
{ |
||||
|
var manager = new Mock<OpenIddictAuthorizationManager<OpenIddictAuthorization>>( |
||||
|
Mock.Of<IOpenIddictAuthorizationStoreResolver>(), |
||||
|
Mock.Of<ILogger<OpenIddictAuthorizationManager<OpenIddictAuthorization>>>(), |
||||
|
Mock.Of<IOptions<OpenIddictCoreOptions>>()); |
||||
|
|
||||
|
configuration?.Invoke(manager); |
||||
|
|
||||
|
return manager.Object; |
||||
|
} |
||||
|
|
||||
|
private static OpenIddictScopeManager<OpenIddictScope> CreateScopeManager( |
||||
|
Action<Mock<OpenIddictScopeManager<OpenIddictScope>>> configuration = null) |
||||
|
{ |
||||
|
var manager = new Mock<OpenIddictScopeManager<OpenIddictScope>>( |
||||
|
Mock.Of<IOpenIddictScopeStoreResolver>(), |
||||
|
Mock.Of<ILogger<OpenIddictScopeManager<OpenIddictScope>>>(), |
||||
|
Mock.Of<IOptions<OpenIddictCoreOptions>>()); |
||||
|
|
||||
|
configuration?.Invoke(manager); |
||||
|
|
||||
|
return manager.Object; |
||||
|
} |
||||
|
|
||||
|
private static OpenIddictTokenManager<OpenIddictToken> CreateTokenManager( |
||||
|
Action<Mock<OpenIddictTokenManager<OpenIddictToken>>> configuration = null) |
||||
|
{ |
||||
|
var manager = new Mock<OpenIddictTokenManager<OpenIddictToken>>( |
||||
|
Mock.Of<IOpenIddictTokenStoreResolver>(), |
||||
|
Mock.Of<ILogger<OpenIddictTokenManager<OpenIddictToken>>>(), |
||||
|
Mock.Of<IOptions<OpenIddictCoreOptions>>()); |
||||
|
|
||||
|
configuration?.Invoke(manager); |
||||
|
|
||||
|
return manager.Object; |
||||
|
} |
||||
|
} |
||||
|
} |
||||
Loading…
Reference in new issue