Kévin Chalet
2 years ago
25 changed files with 1000 additions and 52 deletions
@ -0,0 +1,314 @@ |
|||||
|
/* |
||||
|
* Licensed under the Apache License, Version 2.0 (http://www.apache.org/licenses/LICENSE-2.0)
|
||||
|
* See https://github.com/openiddict/openiddict-core for more information concerning
|
||||
|
* the license and the contributors participating to this project. |
||||
|
*/ |
||||
|
|
||||
|
using System.Collections.Immutable; |
||||
|
using System.Diagnostics; |
||||
|
using System.Runtime.InteropServices; |
||||
|
using System.Runtime.Versioning; |
||||
|
using System.Text; |
||||
|
using Microsoft.Extensions.Primitives; |
||||
|
using OpenIddict.Extensions; |
||||
|
|
||||
|
#if SUPPORTS_WINDOWS_RUNTIME
|
||||
|
using Windows.Security.Authentication.Web; |
||||
|
using Windows.UI.Core; |
||||
|
#endif
|
||||
|
|
||||
|
namespace OpenIddict.Client.SystemIntegration; |
||||
|
|
||||
|
public static partial class OpenIddictClientSystemIntegrationHandlers |
||||
|
{ |
||||
|
public static class Session |
||||
|
{ |
||||
|
public static ImmutableArray<OpenIddictClientHandlerDescriptor> DefaultHandlers { get; } = ImmutableArray.Create([ |
||||
|
/* |
||||
|
* Logout request processing: |
||||
|
*/ |
||||
|
InvokeWebAuthenticationBroker.Descriptor, |
||||
|
LaunchSystemBrowser.Descriptor, |
||||
|
|
||||
|
/* |
||||
|
* Post-logout redirection request extraction: |
||||
|
*/ |
||||
|
ExtractGetHttpListenerRequest<ExtractPostLogoutRedirectionRequestContext>.Descriptor, |
||||
|
ExtractProtocolActivationParameters<ExtractPostLogoutRedirectionRequestContext>.Descriptor, |
||||
|
ExtractWebAuthenticationResultData<ExtractPostLogoutRedirectionRequestContext>.Descriptor, |
||||
|
|
||||
|
/* |
||||
|
* Post-logout redirection response handling: |
||||
|
*/ |
||||
|
AttachHttpResponseCode<ApplyPostLogoutRedirectionResponseContext>.Descriptor, |
||||
|
AttachCacheControlHeader<ApplyPostLogoutRedirectionResponseContext>.Descriptor, |
||||
|
ProcessEmptyHttpResponse.Descriptor, |
||||
|
ProcessProtocolActivationResponse<ApplyPostLogoutRedirectionResponseContext>.Descriptor, |
||||
|
ProcessWebAuthenticationResultResponse<ApplyPostLogoutRedirectionResponseContext>.Descriptor |
||||
|
]); |
||||
|
|
||||
|
/// <summary>
|
||||
|
/// Contains the logic responsible for initiating logout requests using the web authentication broker.
|
||||
|
/// Note: this handler is not used when the user session is not interactive.
|
||||
|
/// </summary>
|
||||
|
public class InvokeWebAuthenticationBroker : IOpenIddictClientHandler<ApplyLogoutRequestContext> |
||||
|
{ |
||||
|
private readonly OpenIddictClientSystemIntegrationService _service; |
||||
|
|
||||
|
public InvokeWebAuthenticationBroker(OpenIddictClientSystemIntegrationService service) |
||||
|
=> _service = service ?? throw new ArgumentNullException(nameof(service)); |
||||
|
|
||||
|
/// <summary>
|
||||
|
/// Gets the default descriptor definition assigned to this handler.
|
||||
|
/// </summary>
|
||||
|
public static OpenIddictClientHandlerDescriptor Descriptor { get; } |
||||
|
= OpenIddictClientHandlerDescriptor.CreateBuilder<ApplyLogoutRequestContext>() |
||||
|
.AddFilter<RequireInteractiveSession>() |
||||
|
.AddFilter<RequireWebAuthenticationBroker>() |
||||
|
.UseSingletonHandler<InvokeWebAuthenticationBroker>() |
||||
|
.SetOrder(100_000) |
||||
|
.SetType(OpenIddictClientHandlerType.BuiltIn) |
||||
|
.Build(); |
||||
|
|
||||
|
/// <inheritdoc/>
|
||||
|
[SupportedOSPlatform("windows10.0.17763")] |
||||
|
#pragma warning disable CS1998
|
||||
|
public async ValueTask HandleAsync(ApplyLogoutRequestContext context) |
||||
|
#pragma warning restore CS1998
|
||||
|
{ |
||||
|
if (context is null) |
||||
|
{ |
||||
|
throw new ArgumentNullException(nameof(context)); |
||||
|
} |
||||
|
|
||||
|
Debug.Assert(context.Transaction.Request is not null, SR.GetResourceString(SR.ID4008)); |
||||
|
|
||||
|
#if SUPPORTS_WINDOWS_RUNTIME
|
||||
|
if (string.IsNullOrEmpty(context.PostLogoutRedirectUri)) |
||||
|
{ |
||||
|
return; |
||||
|
} |
||||
|
|
||||
|
// Note: WebAuthenticationBroker internally requires a pointer to the CoreWindow object associated
|
||||
|
// to the thread from which the challenge operation is started. Unfortunately, CoreWindow - and by
|
||||
|
// extension WebAuthenticationBroker - are only supported on UWP and cannot be used in Win32 apps.
|
||||
|
//
|
||||
|
// To ensure a meaningful exception is returned when the web authentication broker is used with an
|
||||
|
// incompatible application model (e.g WinUI 3.0), the presence of a CoreWindow is verified here.
|
||||
|
//
|
||||
|
// See https://github.com/microsoft/WindowsAppSDK/issues/398 for more information.
|
||||
|
if (!OpenIddictClientSystemIntegrationHelpers.IsWebAuthenticationBrokerSupported() || |
||||
|
CoreWindow.GetForCurrentThread() is null) |
||||
|
{ |
||||
|
throw new PlatformNotSupportedException(SR.GetResourceString(SR.ID0392)); |
||||
|
} |
||||
|
|
||||
|
// OpenIddict represents the complete interactive logout dance as a two-phase process:
|
||||
|
// - The sign-out, during which the user is redirected to the authorization server, either
|
||||
|
// by launching the system browser or, as in this case, using a web-view-like approach.
|
||||
|
//
|
||||
|
// - The callback validation that takes place after the authorization server and the user approved
|
||||
|
// the demand and redirected the user agent to the client (using either protocol activation,
|
||||
|
// an embedded web server or by tracking the return URL of the web view created for the process).
|
||||
|
//
|
||||
|
// Unlike OpenIddict, WebAuthenticationBroker materializes this process as a single/one-shot API
|
||||
|
// that opens the system-managed authentication host, navigates to the specified request URI and
|
||||
|
// doesn't return until the specified callback URI is reached or the modal closed by the user.
|
||||
|
// To accomodate OpenIddict's model, successful results are processed as any other callback request.
|
||||
|
|
||||
|
// Note: IAsyncOperation<T>.AsTask(context.CancellationToken) is deliberately not used here as
|
||||
|
// the asynchronous operation returned by the web authentication broker is not cancellable.
|
||||
|
switch (await WebAuthenticationBroker.AuthenticateAsync( |
||||
|
options : WebAuthenticationOptions.None, |
||||
|
requestUri : OpenIddictHelpers.AddQueryStringParameters( |
||||
|
uri: new Uri(context.EndSessionEndpoint, UriKind.Absolute), |
||||
|
parameters: context.Transaction.Request.GetParameters().ToDictionary( |
||||
|
parameter => parameter.Key, |
||||
|
parameter => new StringValues((string?[]?) parameter.Value))), |
||||
|
callbackUri: new Uri(context.PostLogoutRedirectUri, UriKind.Absolute))) |
||||
|
{ |
||||
|
case { ResponseStatus: WebAuthenticationStatus.Success } result: |
||||
|
await _service.HandleWebAuthenticationResultAsync(result, context.CancellationToken); |
||||
|
context.HandleRequest(); |
||||
|
return; |
||||
|
|
||||
|
// Since the result of this operation is known by the time WebAuthenticationBroker.AuthenticateAsync()
|
||||
|
// returns, some errors can directly be handled and surfaced here, as part of the challenge handling.
|
||||
|
|
||||
|
case { ResponseStatus: WebAuthenticationStatus.UserCancel }: |
||||
|
context.Reject( |
||||
|
error: Errors.AccessDenied, |
||||
|
description: SR.GetResourceString(SR.ID2149), |
||||
|
uri: SR.FormatID8000(SR.ID2149)); |
||||
|
|
||||
|
return; |
||||
|
|
||||
|
case { ResponseStatus: WebAuthenticationStatus.ErrorHttp } result: |
||||
|
context.Reject( |
||||
|
error: result.ResponseErrorDetail switch |
||||
|
{ |
||||
|
400 => Errors.InvalidRequest, |
||||
|
401 => Errors.InvalidToken, |
||||
|
403 => Errors.InsufficientAccess, |
||||
|
429 => Errors.SlowDown, |
||||
|
500 => Errors.ServerError, |
||||
|
503 => Errors.TemporarilyUnavailable, |
||||
|
_ => Errors.ServerError |
||||
|
}, |
||||
|
description: SR.FormatID2161(result.ResponseErrorDetail), |
||||
|
uri: SR.FormatID8000(SR.ID2161)); |
||||
|
|
||||
|
return; |
||||
|
|
||||
|
default: |
||||
|
context.Reject( |
||||
|
error: Errors.ServerError, |
||||
|
description: SR.GetResourceString(SR.ID2136), |
||||
|
uri: SR.FormatID8000(SR.ID2136)); |
||||
|
|
||||
|
return; |
||||
|
} |
||||
|
#else
|
||||
|
throw new PlatformNotSupportedException(SR.GetResourceString(SR.ID0392)); |
||||
|
#endif
|
||||
|
} |
||||
|
} |
||||
|
|
||||
|
/// <summary>
|
||||
|
/// Contains the logic responsible for initiating logout requests using the system browser.
|
||||
|
/// Note: this handler is not used when the user session is not interactive.
|
||||
|
/// </summary>
|
||||
|
public class LaunchSystemBrowser : IOpenIddictClientHandler<ApplyLogoutRequestContext> |
||||
|
{ |
||||
|
/// <summary>
|
||||
|
/// Gets the default descriptor definition assigned to this handler.
|
||||
|
/// </summary>
|
||||
|
public static OpenIddictClientHandlerDescriptor Descriptor { get; } |
||||
|
= OpenIddictClientHandlerDescriptor.CreateBuilder<ApplyLogoutRequestContext>() |
||||
|
.AddFilter<RequireInteractiveSession>() |
||||
|
.AddFilter<RequireSystemBrowser>() |
||||
|
.UseSingletonHandler<LaunchSystemBrowser>() |
||||
|
.SetOrder(InvokeWebAuthenticationBroker.Descriptor.Order + 1_000) |
||||
|
.SetType(OpenIddictClientHandlerType.BuiltIn) |
||||
|
.Build(); |
||||
|
|
||||
|
/// <inheritdoc/>
|
||||
|
public async ValueTask HandleAsync(ApplyLogoutRequestContext context) |
||||
|
{ |
||||
|
if (context is null) |
||||
|
{ |
||||
|
throw new ArgumentNullException(nameof(context)); |
||||
|
} |
||||
|
|
||||
|
Debug.Assert(context.Transaction.Request is not null, SR.GetResourceString(SR.ID4008)); |
||||
|
|
||||
|
var uri = OpenIddictHelpers.AddQueryStringParameters( |
||||
|
uri: new Uri(context.EndSessionEndpoint, UriKind.Absolute), |
||||
|
parameters: context.Transaction.Request.GetParameters().ToDictionary( |
||||
|
parameter => parameter.Key, |
||||
|
parameter => new StringValues((string?[]?) parameter.Value))); |
||||
|
|
||||
|
if (RuntimeInformation.IsOSPlatform(OSPlatform.Windows)) |
||||
|
{ |
||||
|
// Note: on Windows, multiple application models exist and must be supported to cover most scenarios:
|
||||
|
//
|
||||
|
// - Classical Win32 applications, for which no application-specific restriction is enforced.
|
||||
|
// - Win32 applications running in an AppContainer, that are very similar to UWP applications.
|
||||
|
// - Classical UWP applications, for which strict application restrictions are enforced.
|
||||
|
// - Full-trust UWP applications, that are rare but very similar to classical Win32 applications.
|
||||
|
// - Modern/hybrid Windows applications, that can be sandboxed or run as full-trust applications.
|
||||
|
//
|
||||
|
// Since .NET Standard 2.0 support for UWP was only introduced in Windows 10 1709 (also known
|
||||
|
// as Fall Creators Update) and OpenIddict requires Windows 10 1809 as the minimum supported
|
||||
|
// version, Windows 8/8.1's Metro-style/universal applications are deliberately not supported.
|
||||
|
//
|
||||
|
// While Process.Start()/ShellExecuteEx() can typically be used without any particular restriction
|
||||
|
// by non-sandboxed desktop applications to launch the default system browser, calling these
|
||||
|
// APIs in sandboxed applications will result in an UnauthorizedAccessException being thrown.
|
||||
|
//
|
||||
|
// To avoid that, the OpenIddict host needs to determine whether the platform supports Windows
|
||||
|
// Runtime APIs and favor the Launcher.LaunchUriAsync() API when it's offered by the platform.
|
||||
|
|
||||
|
#if SUPPORTS_WINDOWS_RUNTIME
|
||||
|
if (OpenIddictClientSystemIntegrationHelpers.IsUriLauncherSupported() && await |
||||
|
OpenIddictClientSystemIntegrationHelpers.TryLaunchBrowserWithWindowsRuntimeAsync(uri)) |
||||
|
{ |
||||
|
context.HandleRequest(); |
||||
|
return; |
||||
|
} |
||||
|
#endif
|
||||
|
if (await OpenIddictClientSystemIntegrationHelpers.TryLaunchBrowserWithShellExecuteAsync(uri)) |
||||
|
{ |
||||
|
context.HandleRequest(); |
||||
|
return; |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
if (RuntimeInformation.IsOSPlatform(OSPlatform.Linux) && |
||||
|
await OpenIddictClientSystemIntegrationHelpers.TryLaunchBrowserWithXdgOpenAsync(uri)) |
||||
|
{ |
||||
|
context.HandleRequest(); |
||||
|
return; |
||||
|
} |
||||
|
|
||||
|
throw new InvalidOperationException(SR.GetResourceString(SR.ID0385)); |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
/// <summary>
|
||||
|
/// Contains the logic responsible for processing OpenID Connect responses that don't specify any parameter.
|
||||
|
/// Note: this handler is not used when the OpenID Connect request is not handled by the embedded web server.
|
||||
|
/// </summary>
|
||||
|
public sealed class ProcessEmptyHttpResponse : IOpenIddictClientHandler<ApplyPostLogoutRedirectionResponseContext> |
||||
|
{ |
||||
|
/// <summary>
|
||||
|
/// Gets the default descriptor definition assigned to this handler.
|
||||
|
/// </summary>
|
||||
|
public static OpenIddictClientHandlerDescriptor Descriptor { get; } |
||||
|
= OpenIddictClientHandlerDescriptor.CreateBuilder<ApplyPostLogoutRedirectionResponseContext>() |
||||
|
.AddFilter<RequireHttpListenerContext>() |
||||
|
.UseSingletonHandler<ProcessEmptyHttpResponse>() |
||||
|
.SetOrder(int.MaxValue - 100_000) |
||||
|
.SetType(OpenIddictClientHandlerType.BuiltIn) |
||||
|
.Build(); |
||||
|
|
||||
|
/// <inheritdoc/>
|
||||
|
public async ValueTask HandleAsync(ApplyPostLogoutRedirectionResponseContext context) |
||||
|
{ |
||||
|
if (context is null) |
||||
|
{ |
||||
|
throw new ArgumentNullException(nameof(context)); |
||||
|
} |
||||
|
|
||||
|
Debug.Assert(context.Transaction.Response is not null, SR.GetResourceString(SR.ID4007)); |
||||
|
|
||||
|
// This handler only applies to HTTP listener requests. If the HTTP context cannot be resolved,
|
||||
|
// this may indicate that the request was incorrectly processed by another server stack.
|
||||
|
var response = context.Transaction.GetHttpListenerContext()?.Response ?? |
||||
|
throw new InvalidOperationException(SR.GetResourceString(SR.ID0390)); |
||||
|
|
||||
|
// Always return a 200 status, even for responses indicating that the authentication failed.
|
||||
|
response.StatusCode = 200; |
||||
|
response.ContentType = "text/plain"; |
||||
|
|
||||
|
// Return a message indicating whether the sign-out process
|
||||
|
// succeeded or failed and that will be visible by the user.
|
||||
|
var buffer = Encoding.UTF8.GetBytes(context.Transaction.Response.Error switch |
||||
|
{ |
||||
|
null or { Length: 0 } => "Logout completed. Please return to the application.", |
||||
|
Errors.AccessDenied => "Logout denied. Please return to the application.", |
||||
|
_ => "Logout failed. Please return to the application." |
||||
|
}); |
||||
|
|
||||
|
#if SUPPORTS_STREAM_MEMORY_METHODS
|
||||
|
await response.OutputStream.WriteAsync(buffer); |
||||
|
#else
|
||||
|
await response.OutputStream.WriteAsync(buffer, 0, buffer.Length); |
||||
|
#endif
|
||||
|
await response.OutputStream.FlushAsync(); |
||||
|
|
||||
|
context.HandleRequest(); |
||||
|
} |
||||
|
} |
||||
|
} |
||||
|
} |
||||
Loading…
Reference in new issue