Kévin Chalet
4 years ago
46 changed files with 3781 additions and 867 deletions
@ -0,0 +1,30 @@ |
|||||
|
/* |
||||
|
* Licensed under the Apache License, Version 2.0 (http://www.apache.org/licenses/LICENSE-2.0)
|
||||
|
* See https://github.com/openiddict/openiddict-core for more information concerning
|
||||
|
* the license and the contributors participating to this project. |
||||
|
*/ |
||||
|
|
||||
|
using System.Runtime.Versioning; |
||||
|
|
||||
|
namespace OpenIddict.Client.SystemIntegration; |
||||
|
|
||||
|
/// <summary>
|
||||
|
/// Provides various settings needed to configure the OpenIddict client system integration.
|
||||
|
/// </summary>
|
||||
|
public enum OpenIddictClientSystemIntegrationAuthenticationMode |
||||
|
{ |
||||
|
/// <summary>
|
||||
|
/// Browser-based authentication.
|
||||
|
/// </summary>
|
||||
|
SystemBrowser = 0, |
||||
|
|
||||
|
/// <summary>
|
||||
|
/// Windows web authentication broker-based authentication.
|
||||
|
/// </summary>
|
||||
|
/// <remarks>
|
||||
|
/// Note: the web authentication broker is only supported in UWP applications
|
||||
|
/// and its use is generally not recommended due to its inherent limitations.
|
||||
|
/// </remarks>
|
||||
|
[SupportedOSPlatform("windows10.0.17763")] |
||||
|
WebAuthenticationBroker = 1 |
||||
|
} |
||||
@ -0,0 +1,238 @@ |
|||||
|
/* |
||||
|
* Licensed under the Apache License, Version 2.0 (http://www.apache.org/licenses/LICENSE-2.0)
|
||||
|
* See https://github.com/openiddict/openiddict-core for more information concerning
|
||||
|
* the license and the contributors participating to this project. |
||||
|
*/ |
||||
|
|
||||
|
using System.ComponentModel; |
||||
|
using System.IO.Pipes; |
||||
|
using System.Runtime.InteropServices; |
||||
|
using System.Runtime.Versioning; |
||||
|
using OpenIddict.Client.SystemIntegration; |
||||
|
|
||||
|
namespace Microsoft.Extensions.DependencyInjection; |
||||
|
|
||||
|
/// <summary>
|
||||
|
/// Exposes the necessary methods required to configure
|
||||
|
/// the OpenIddict client system integration.
|
||||
|
/// </summary>
|
||||
|
public sealed class OpenIddictClientSystemIntegrationBuilder |
||||
|
{ |
||||
|
/// <summary>
|
||||
|
/// Initializes a new instance of <see cref="OpenIddictClientSystemIntegrationBuilder"/>.
|
||||
|
/// </summary>
|
||||
|
/// <param name="services">The services collection.</param>
|
||||
|
public OpenIddictClientSystemIntegrationBuilder(IServiceCollection services) |
||||
|
=> Services = services ?? throw new ArgumentNullException(nameof(services)); |
||||
|
|
||||
|
/// <summary>
|
||||
|
/// Gets the services collection.
|
||||
|
/// </summary>
|
||||
|
[EditorBrowsable(EditorBrowsableState.Never)] |
||||
|
public IServiceCollection Services { get; } |
||||
|
|
||||
|
/// <summary>
|
||||
|
/// Amends the default OpenIddict client system integration configuration.
|
||||
|
/// </summary>
|
||||
|
/// <param name="configuration">The delegate used to configure the OpenIddict options.</param>
|
||||
|
/// <remarks>This extension can be safely called multiple times.</remarks>
|
||||
|
/// <returns>The <see cref="OpenIddictClientSystemIntegrationBuilder"/>.</returns>
|
||||
|
public OpenIddictClientSystemIntegrationBuilder Configure(Action<OpenIddictClientSystemIntegrationOptions> configuration) |
||||
|
{ |
||||
|
if (configuration is null) |
||||
|
{ |
||||
|
throw new ArgumentNullException(nameof(configuration)); |
||||
|
} |
||||
|
|
||||
|
Services.Configure(configuration); |
||||
|
|
||||
|
return this; |
||||
|
} |
||||
|
|
||||
|
/// <summary>
|
||||
|
/// Uses the Windows web authentication broker to start authentication flows.
|
||||
|
/// </summary>
|
||||
|
/// <remarks>
|
||||
|
/// Note: the web authentication broker is only supported in UWP applications
|
||||
|
/// and its use is generally not recommended due to its inherent limitations.
|
||||
|
/// </remarks>
|
||||
|
/// <returns>The <see cref="OpenIddictClientSystemIntegrationBuilder"/>.</returns>
|
||||
|
[SupportedOSPlatform("windows10.0.17763")] |
||||
|
public OpenIddictClientSystemIntegrationBuilder UseWebAuthenticationBroker() |
||||
|
{ |
||||
|
if (!RuntimeInformation.IsOSPlatform(OSPlatform.Windows)) |
||||
|
{ |
||||
|
throw new PlatformNotSupportedException(SR.GetResourceString(SR.ID0392)); |
||||
|
} |
||||
|
|
||||
|
#if SUPPORTS_WINDOWS_RUNTIME
|
||||
|
if (!OpenIddictClientSystemIntegrationHelpers.IsWindowsRuntimeSupported()) |
||||
|
{ |
||||
|
throw new PlatformNotSupportedException(SR.GetResourceString(SR.ID0392)); |
||||
|
} |
||||
|
|
||||
|
return Configure(options => options.AuthenticationMode = |
||||
|
OpenIddictClientSystemIntegrationAuthenticationMode.WebAuthenticationBroker); |
||||
|
#else
|
||||
|
throw new PlatformNotSupportedException(SR.GetResourceString(SR.ID0392)); |
||||
|
#endif
|
||||
|
} |
||||
|
|
||||
|
/// <summary>
|
||||
|
/// Uses the system browser to start authentication flows.
|
||||
|
/// </summary>
|
||||
|
/// <returns>The <see cref="OpenIddictClientSystemIntegrationBuilder"/>.</returns>
|
||||
|
public OpenIddictClientSystemIntegrationBuilder UseSystemBrowser() |
||||
|
=> Configure(options => options.AuthenticationMode = |
||||
|
OpenIddictClientSystemIntegrationAuthenticationMode.SystemBrowser); |
||||
|
|
||||
|
/// <summary>
|
||||
|
/// Sets the timeout after which authentication demands that
|
||||
|
/// are not completed are automatically aborted by OpenIddict.
|
||||
|
/// </summary>
|
||||
|
/// <param name="timeout">The authentication timeout.</param>
|
||||
|
/// <returns>The <see cref="OpenIddictClientSystemIntegrationBuilder"/>.</returns>
|
||||
|
public OpenIddictClientSystemIntegrationBuilder SetAuthenticationTimeout(TimeSpan timeout) |
||||
|
=> Configure(options => options.AuthenticationTimeout = timeout); |
||||
|
|
||||
|
/// <summary>
|
||||
|
/// Disables the built-in protocol activation processing logic.
|
||||
|
/// </summary>
|
||||
|
/// <returns>The <see cref="OpenIddictClientSystemIntegrationBuilder"/>.</returns>
|
||||
|
public OpenIddictClientSystemIntegrationBuilder DisableActivationHandling() |
||||
|
=> Configure(options => options.EnableActivationHandling = false); |
||||
|
|
||||
|
/// <summary>
|
||||
|
/// Enables the built-in protocol activation processing logic.
|
||||
|
/// </summary>
|
||||
|
/// <returns>The <see cref="OpenIddictClientSystemIntegrationBuilder"/>.</returns>
|
||||
|
public OpenIddictClientSystemIntegrationBuilder EnableActivationHandling() |
||||
|
=> Configure(options => options.EnableActivationHandling = true); |
||||
|
|
||||
|
/// <summary>
|
||||
|
/// Disables the built-in protocol activation redirection logic.
|
||||
|
/// </summary>
|
||||
|
/// <returns>The <see cref="OpenIddictClientSystemIntegrationBuilder"/>.</returns>
|
||||
|
public OpenIddictClientSystemIntegrationBuilder DisableActivationRedirection() |
||||
|
=> Configure(options => options.EnableActivationRedirection = false); |
||||
|
|
||||
|
/// <summary>
|
||||
|
/// Enables the built-in protocol activation redirection logic.
|
||||
|
/// </summary>
|
||||
|
/// <returns>The <see cref="OpenIddictClientSystemIntegrationBuilder"/>.</returns>
|
||||
|
public OpenIddictClientSystemIntegrationBuilder EnableActivationRedirection() |
||||
|
=> Configure(options => options.EnableActivationRedirection = true); |
||||
|
|
||||
|
/// <summary>
|
||||
|
/// Disables the built-in web server used to handle callbacks.
|
||||
|
/// </summary>
|
||||
|
/// <returns>The <see cref="OpenIddictClientSystemIntegrationBuilder"/>.</returns>
|
||||
|
public OpenIddictClientSystemIntegrationBuilder DisableEmbeddedWebServer() |
||||
|
=> Configure(options => options.EnableEmbeddedWebServer = false); |
||||
|
|
||||
|
/// <summary>
|
||||
|
/// Enables the built-in web server used to handle callbacks.
|
||||
|
/// </summary>
|
||||
|
/// <returns>The <see cref="OpenIddictClientSystemIntegrationBuilder"/>.</returns>
|
||||
|
public OpenIddictClientSystemIntegrationBuilder EnableEmbeddedWebServer() |
||||
|
=> Configure(options => options.EnableEmbeddedWebServer = true); |
||||
|
|
||||
|
/// <summary>
|
||||
|
/// Disables the pipe server used to process notifications (e.g protocol
|
||||
|
/// activation redirections) sent by other instances of the application.
|
||||
|
/// </summary>
|
||||
|
/// <returns>The <see cref="OpenIddictClientSystemIntegrationBuilder"/>.</returns>
|
||||
|
public OpenIddictClientSystemIntegrationBuilder DisablePipeServer() |
||||
|
=> Configure(options => options.EnablePipeServer = false); |
||||
|
|
||||
|
/// <summary>
|
||||
|
/// Enables the pipe server used to process protocol
|
||||
|
/// activations redirected by other instances of the application.
|
||||
|
/// </summary>
|
||||
|
/// <returns>The <see cref="OpenIddictClientSystemIntegrationBuilder"/>.</returns>
|
||||
|
public OpenIddictClientSystemIntegrationBuilder EnablePipeServer() |
||||
|
=> Configure(options => options.EnablePipeServer = true); |
||||
|
|
||||
|
/// <summary>
|
||||
|
/// Sets the identifier used to represent the current application
|
||||
|
/// instance and redirect protocol activations when necessary.
|
||||
|
/// </summary>
|
||||
|
/// <param name="identifier">The identifier of the current instance.</param>
|
||||
|
/// <returns>The <see cref="OpenIddictClientSystemIntegrationBuilder"/>.</returns>
|
||||
|
[EditorBrowsable(EditorBrowsableState.Advanced)] |
||||
|
public OpenIddictClientSystemIntegrationBuilder SetInstanceIdentifier(string identifier) |
||||
|
{ |
||||
|
if (string.IsNullOrEmpty(identifier)) |
||||
|
{ |
||||
|
throw new ArgumentException(SR.FormatID0366(nameof(identifier)), nameof(identifier)); |
||||
|
} |
||||
|
|
||||
|
return Configure(options => options.InstanceIdentifier = identifier); |
||||
|
} |
||||
|
|
||||
|
/// <summary>
|
||||
|
/// Sets the base name of the pipe created by OpenIddict to enable
|
||||
|
/// inter-process communication and handle protocol activation redirections.
|
||||
|
/// </summary>
|
||||
|
/// <param name="name">The name of the pipe.</param>
|
||||
|
/// <returns>The <see cref="OpenIddictClientSystemIntegrationBuilder"/>.</returns>
|
||||
|
[EditorBrowsable(EditorBrowsableState.Advanced)] |
||||
|
public OpenIddictClientSystemIntegrationBuilder SetPipeName(string name) |
||||
|
{ |
||||
|
if (string.IsNullOrEmpty(name)) |
||||
|
{ |
||||
|
throw new ArgumentException(SR.FormatID0366(nameof(name)), nameof(name)); |
||||
|
} |
||||
|
|
||||
|
return Configure(options => options.PipeName = name); |
||||
|
} |
||||
|
|
||||
|
/// <summary>
|
||||
|
/// Sets the options applied to the pipe created by OpenIddict to enable
|
||||
|
/// inter-process communication and handle protocol activation redirections.
|
||||
|
/// </summary>
|
||||
|
/// <param name="flags">The options flags applied to the pipe.</param>
|
||||
|
/// <returns>The <see cref="OpenIddictClientSystemIntegrationBuilder"/>.</returns>
|
||||
|
[EditorBrowsable(EditorBrowsableState.Advanced)] |
||||
|
public OpenIddictClientSystemIntegrationBuilder SetPipeOptions(PipeOptions flags) |
||||
|
=> Configure(options => options.PipeOptions = flags); |
||||
|
|
||||
|
/// <summary>
|
||||
|
/// Sets the security policy applied to the pipe created by OpenIddict to enable
|
||||
|
/// inter-process communication and handle protocol activation redirections.
|
||||
|
/// </summary>
|
||||
|
/// <param name="security">The security policy applied to the pipe.</param>
|
||||
|
/// <returns>The <see cref="OpenIddictClientSystemIntegrationBuilder"/>.</returns>
|
||||
|
[EditorBrowsable(EditorBrowsableState.Advanced), SupportedOSPlatform("windows")] |
||||
|
public OpenIddictClientSystemIntegrationBuilder SetPipeSecurity(PipeSecurity security) |
||||
|
{ |
||||
|
if (security is null) |
||||
|
{ |
||||
|
throw new ArgumentNullException(nameof(security)); |
||||
|
} |
||||
|
|
||||
|
return Configure(options => options.PipeSecurity = security); |
||||
|
} |
||||
|
|
||||
|
/// <summary>
|
||||
|
/// Determines whether the specified object is equal to the current object.
|
||||
|
/// </summary>
|
||||
|
/// <param name="obj">The object to compare with the current object.</param>
|
||||
|
/// <returns><see langword="true"/> if the specified object is equal to the current object; otherwise, false.</returns>
|
||||
|
[EditorBrowsable(EditorBrowsableState.Never)] |
||||
|
public override bool Equals(object? obj) => base.Equals(obj); |
||||
|
|
||||
|
/// <summary>
|
||||
|
/// Serves as the default hash function.
|
||||
|
/// </summary>
|
||||
|
/// <returns>A hash code for the current object.</returns>
|
||||
|
[EditorBrowsable(EditorBrowsableState.Never)] |
||||
|
public override int GetHashCode() => base.GetHashCode(); |
||||
|
|
||||
|
/// <summary>
|
||||
|
/// Returns a string that represents the current object.
|
||||
|
/// </summary>
|
||||
|
/// <returns>A string that represents the current object.</returns>
|
||||
|
[EditorBrowsable(EditorBrowsableState.Never)] |
||||
|
public override string? ToString() => base.ToString(); |
||||
|
} |
||||
@ -0,0 +1,172 @@ |
|||||
|
/* |
||||
|
* Licensed under the Apache License, Version 2.0 (http://www.apache.org/licenses/LICENSE-2.0)
|
||||
|
* See https://github.com/openiddict/openiddict-core for more information concerning
|
||||
|
* the license and the contributors participating to this project. |
||||
|
*/ |
||||
|
|
||||
|
using System.ComponentModel; |
||||
|
using System.IO.Pipes; |
||||
|
using System.Net; |
||||
|
using System.Runtime.CompilerServices; |
||||
|
using System.Runtime.InteropServices; |
||||
|
using System.Runtime.Versioning; |
||||
|
using System.Security.AccessControl; |
||||
|
using System.Security.Principal; |
||||
|
using System.Text; |
||||
|
using Microsoft.Extensions.Hosting; |
||||
|
using Microsoft.Extensions.Options; |
||||
|
using Microsoft.IdentityModel.Tokens; |
||||
|
using OpenIddict.Extensions; |
||||
|
|
||||
|
#if !SUPPORTS_HOST_ENVIRONMENT
|
||||
|
using IHostEnvironment = Microsoft.Extensions.Hosting.IHostingEnvironment; |
||||
|
#endif
|
||||
|
|
||||
|
namespace OpenIddict.Client.SystemIntegration; |
||||
|
|
||||
|
/// <summary>
|
||||
|
/// Contains the methods required to ensure that the OpenIddict client system integration configuration is valid.
|
||||
|
/// </summary>
|
||||
|
[EditorBrowsable(EditorBrowsableState.Advanced)] |
||||
|
public sealed class OpenIddictClientSystemIntegrationConfiguration : IConfigureOptions<OpenIddictClientOptions>, |
||||
|
IPostConfigureOptions<OpenIddictClientOptions>, |
||||
|
IPostConfigureOptions<OpenIddictClientSystemIntegrationOptions> |
||||
|
{ |
||||
|
private readonly IHostEnvironment _environment; |
||||
|
|
||||
|
/// <summary>
|
||||
|
/// Creates a new instance of the <see cref="OpenIddictClientSystemIntegrationConfiguration"/> class.
|
||||
|
/// </summary>
|
||||
|
/// <param name="environment">The host environment.</param>
|
||||
|
public OpenIddictClientSystemIntegrationConfiguration(IHostEnvironment environment) |
||||
|
=> _environment = environment ?? throw new ArgumentNullException(nameof(environment)); |
||||
|
|
||||
|
/// <inheritdoc/>
|
||||
|
public void Configure(OpenIddictClientOptions options) |
||||
|
{ |
||||
|
if (options is null) |
||||
|
{ |
||||
|
throw new ArgumentNullException(nameof(options)); |
||||
|
} |
||||
|
|
||||
|
// Register the built-in event handlers used by the OpenIddict client system integration components.
|
||||
|
options.Handlers.AddRange(OpenIddictClientSystemIntegrationHandlers.DefaultHandlers); |
||||
|
} |
||||
|
|
||||
|
/// <inheritdoc/>
|
||||
|
public void PostConfigure(string? name, OpenIddictClientOptions options) |
||||
|
{ |
||||
|
if (options is null) |
||||
|
{ |
||||
|
throw new ArgumentNullException(nameof(options)); |
||||
|
} |
||||
|
|
||||
|
// Ensure an explicit client URI was set when using the system integration.
|
||||
|
if (options.ClientUri is not { IsAbsoluteUri: true }) |
||||
|
{ |
||||
|
throw new InvalidOperationException(SR.GetResourceString(SR.ID0384)); |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
/// <inheritdoc/>
|
||||
|
public void PostConfigure(string? name, OpenIddictClientSystemIntegrationOptions options) |
||||
|
{ |
||||
|
if (options is null) |
||||
|
{ |
||||
|
throw new ArgumentNullException(nameof(options)); |
||||
|
} |
||||
|
|
||||
|
if (!RuntimeInformation.IsOSPlatform(OSPlatform.Linux) && |
||||
|
!RuntimeInformation.IsOSPlatform(OSPlatform.Windows)) |
||||
|
{ |
||||
|
throw new PlatformNotSupportedException(SR.GetResourceString(SR.ID0389)); |
||||
|
} |
||||
|
|
||||
|
// Note: the OpenIddict client system integration is currently only supported on Windows
|
||||
|
// and Linux. As such, using the system browser as the default authentication method in
|
||||
|
// conjunction with the embedded web server and activation handling should be always supported.
|
||||
|
options.AuthenticationMode ??= OpenIddictClientSystemIntegrationAuthenticationMode.SystemBrowser; |
||||
|
options.EnableActivationHandling ??= true; |
||||
|
options.EnableActivationRedirection ??= true; |
||||
|
options.EnablePipeServer ??= true; |
||||
|
options.EnableEmbeddedWebServer ??= HttpListener.IsSupported; |
||||
|
|
||||
|
// If no explicit instance identifier was specified, use a random GUID.
|
||||
|
if (string.IsNullOrEmpty(options.InstanceIdentifier)) |
||||
|
{ |
||||
|
options.InstanceIdentifier = Guid.NewGuid().ToString(); |
||||
|
} |
||||
|
|
||||
|
// If no explicit pipe name was specified, compute the SHA-256 hash of the
|
||||
|
// application name resolved from the host and use it as a unique identifier.
|
||||
|
if (string.IsNullOrEmpty(options.PipeName)) |
||||
|
{ |
||||
|
if (string.IsNullOrEmpty(_environment.ApplicationName)) |
||||
|
{ |
||||
|
throw new InvalidOperationException(SR.GetResourceString(SR.ID0386)); |
||||
|
} |
||||
|
|
||||
|
var builder = new StringBuilder(); |
||||
|
|
||||
|
// Note: on Windows, the name is deliberately prefixed with "LOCAL\" to support
|
||||
|
// partial trust/sandboxed applications that are executed in an AppContainer
|
||||
|
// and cannot communicate with applications outside the sandbox container.
|
||||
|
if (RuntimeInformation.IsOSPlatform(OSPlatform.Windows)) |
||||
|
{ |
||||
|
builder.Append(@"LOCAL\"); |
||||
|
} |
||||
|
|
||||
|
builder.Append(@"OpenIddict.Client.SystemIntegration-"); |
||||
|
builder.Append(Base64UrlEncoder.Encode(OpenIddictHelpers.ComputeSha256Hash( |
||||
|
Encoding.UTF8.GetBytes(_environment.ApplicationName)))); |
||||
|
|
||||
|
options.PipeName = builder.ToString(); |
||||
|
} |
||||
|
|
||||
|
#if SUPPORTS_CURRENT_USER_ONLY_PIPE_OPTION
|
||||
|
if (options.PipeOptions is null && !RuntimeInformation.IsOSPlatform(OSPlatform.Windows)) |
||||
|
{ |
||||
|
// Note: the CurrentUserOnly option is also supported on Windows, but is less
|
||||
|
// flexible than using a PipeSecurity object (e.g cross-process communication
|
||||
|
// between elevated and non-elevated processes is not possible with this option).
|
||||
|
// As such, it's not used on Windows (instead, an ACL-based PipeSecurity is used).
|
||||
|
options.PipeOptions = PipeOptions.CurrentUserOnly; |
||||
|
} |
||||
|
#endif
|
||||
|
|
||||
|
// Always configure the pipe to use asynchronous operations,
|
||||
|
// even if the flag was not explicitly set by the user.
|
||||
|
options.PipeOptions |= PipeOptions.Asynchronous; |
||||
|
|
||||
|
if (RuntimeInformation.IsOSPlatform(OSPlatform.Windows)) |
||||
|
{ |
||||
|
// If no explicit pipe security policy was specified, grant the current user
|
||||
|
// full control over the created pipe and allow cross-process communication
|
||||
|
// between elevated and non-elevated processes. Note: if the process executes
|
||||
|
// inside an AppContainer, don't override the default OS pipe security policy
|
||||
|
// to allow all applications with the same identity to access the named pipe.
|
||||
|
if (options.PipeSecurity is null) |
||||
|
{ |
||||
|
using var identity = WindowsIdentity.GetCurrent(TokenAccessLevels.Query); |
||||
|
|
||||
|
if (!IsRunningInAppContainer(identity)) |
||||
|
{ |
||||
|
options.PipeSecurity = new PipeSecurity(); |
||||
|
options.PipeSecurity.SetOwner(identity.User!); |
||||
|
options.PipeSecurity.AddAccessRule(new PipeAccessRule(identity.User!, |
||||
|
PipeAccessRights.FullControl, AccessControlType.Allow)); |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
[MethodImpl(MethodImplOptions.NoInlining)] |
||||
|
[SupportedOSPlatform("windows")] |
||||
|
static bool IsRunningInAppContainer(WindowsIdentity identity) |
||||
|
#if SUPPORTS_WINDOWS_RUNTIME
|
||||
|
=> OpenIddictClientSystemIntegrationHelpers.IsWindowsRuntimeSupported() && |
||||
|
OpenIddictClientSystemIntegrationHelpers.HasAppContainerToken(identity); |
||||
|
#else
|
||||
|
=> false; |
||||
|
#endif
|
||||
|
} |
||||
|
} |
||||
|
} |
||||
@ -0,0 +1,170 @@ |
|||||
|
/* |
||||
|
* Licensed under the Apache License, Version 2.0 (http://www.apache.org/licenses/LICENSE-2.0)
|
||||
|
* See https://github.com/openiddict/openiddict-core for more information concerning
|
||||
|
* the license and the contributors participating to this project. |
||||
|
*/ |
||||
|
|
||||
|
using System.ComponentModel; |
||||
|
using Microsoft.Extensions.Options; |
||||
|
|
||||
|
namespace OpenIddict.Client.SystemIntegration; |
||||
|
|
||||
|
/// <summary>
|
||||
|
/// Contains a collection of event handler filters commonly used by the system integration handlers.
|
||||
|
/// </summary>
|
||||
|
[EditorBrowsable(EditorBrowsableState.Advanced)] |
||||
|
public static class OpenIddictClientSystemIntegrationHandlerFilters |
||||
|
{ |
||||
|
/// <summary>
|
||||
|
/// Represents a filter that excludes the associated handlers
|
||||
|
/// if no explicit nonce was attached to the authentication context.
|
||||
|
/// </summary>
|
||||
|
public sealed class RequireAuthenticationNonce : IOpenIddictClientHandlerFilter<ProcessAuthenticationContext> |
||||
|
{ |
||||
|
/// <inheritdoc/>
|
||||
|
public ValueTask<bool> IsActiveAsync(ProcessAuthenticationContext context) |
||||
|
{ |
||||
|
if (context is null) |
||||
|
{ |
||||
|
throw new ArgumentNullException(nameof(context)); |
||||
|
} |
||||
|
|
||||
|
return new(!string.IsNullOrEmpty(context.Nonce)); |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
/// <summary>
|
||||
|
/// Represents a filter that excludes the associated handlers if no HTTP listener context can be found.
|
||||
|
/// </summary>
|
||||
|
public sealed class RequireHttpListenerContext : IOpenIddictClientHandlerFilter<BaseContext> |
||||
|
{ |
||||
|
/// <inheritdoc/>
|
||||
|
public ValueTask<bool> IsActiveAsync(BaseContext context) |
||||
|
{ |
||||
|
if (context is null) |
||||
|
{ |
||||
|
throw new ArgumentNullException(nameof(context)); |
||||
|
} |
||||
|
|
||||
|
return new(context.Transaction.GetHttpListenerContext() is not null); |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
/// <summary>
|
||||
|
/// Represents a filter that excludes the associated handlers if no interactive user session was detected.
|
||||
|
/// </summary>
|
||||
|
public sealed class RequireInteractiveSession : IOpenIddictClientHandlerFilter<BaseContext> |
||||
|
{ |
||||
|
/// <inheritdoc/>
|
||||
|
public ValueTask<bool> IsActiveAsync(BaseContext context) |
||||
|
{ |
||||
|
if (context is null) |
||||
|
{ |
||||
|
throw new ArgumentNullException(nameof(context)); |
||||
|
} |
||||
|
|
||||
|
return new(Environment.UserInteractive); |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
/// <summary>
|
||||
|
/// Represents a filter that excludes the associated handlers if no protocol activation was found.
|
||||
|
/// </summary>
|
||||
|
public sealed class RequireProtocolActivation : IOpenIddictClientHandlerFilter<BaseContext> |
||||
|
{ |
||||
|
/// <inheritdoc/>
|
||||
|
public ValueTask<bool> IsActiveAsync(BaseContext context) |
||||
|
{ |
||||
|
if (context is null) |
||||
|
{ |
||||
|
throw new ArgumentNullException(nameof(context)); |
||||
|
} |
||||
|
|
||||
|
return new(context.Transaction.GetProtocolActivation() is not null); |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
/// <summary>
|
||||
|
/// Represents a filter that excludes the associated handlers
|
||||
|
/// if the system browser integration was not enabled.
|
||||
|
/// </summary>
|
||||
|
public sealed class RequireSystemBrowser : IOpenIddictClientHandlerFilter<BaseContext> |
||||
|
{ |
||||
|
private readonly IOptionsMonitor<OpenIddictClientSystemIntegrationOptions> _options; |
||||
|
|
||||
|
public RequireSystemBrowser(IOptionsMonitor<OpenIddictClientSystemIntegrationOptions> options) |
||||
|
=> _options = options ?? throw new ArgumentNullException(nameof(options)); |
||||
|
|
||||
|
/// <inheritdoc/>
|
||||
|
public ValueTask<bool> IsActiveAsync(BaseContext context) |
||||
|
{ |
||||
|
if (context is null) |
||||
|
{ |
||||
|
throw new ArgumentNullException(nameof(context)); |
||||
|
} |
||||
|
|
||||
|
if (!context.Transaction.Properties.TryGetValue( |
||||
|
typeof(OpenIddictClientSystemIntegrationAuthenticationMode).FullName!, out var result) || |
||||
|
result is not OpenIddictClientSystemIntegrationAuthenticationMode mode) |
||||
|
{ |
||||
|
mode = _options.CurrentValue.AuthenticationMode.GetValueOrDefault(); |
||||
|
} |
||||
|
|
||||
|
return new(mode is OpenIddictClientSystemIntegrationAuthenticationMode.SystemBrowser); |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
/// <summary>
|
||||
|
/// Represents a filter that excludes the associated handlers if
|
||||
|
/// the web authentication broker integration was not enabled.
|
||||
|
/// </summary>
|
||||
|
public sealed class RequireWebAuthenticationBroker : IOpenIddictClientHandlerFilter<BaseContext> |
||||
|
{ |
||||
|
private readonly IOptionsMonitor<OpenIddictClientSystemIntegrationOptions> _options; |
||||
|
|
||||
|
public RequireWebAuthenticationBroker(IOptionsMonitor<OpenIddictClientSystemIntegrationOptions> options) |
||||
|
=> _options = options ?? throw new ArgumentNullException(nameof(options)); |
||||
|
|
||||
|
/// <inheritdoc/>
|
||||
|
public ValueTask<bool> IsActiveAsync(BaseContext context) |
||||
|
{ |
||||
|
if (context is null) |
||||
|
{ |
||||
|
throw new ArgumentNullException(nameof(context)); |
||||
|
} |
||||
|
|
||||
|
if (!context.Transaction.Properties.TryGetValue( |
||||
|
typeof(OpenIddictClientSystemIntegrationAuthenticationMode).FullName!, out var result) || |
||||
|
result is not OpenIddictClientSystemIntegrationAuthenticationMode mode) |
||||
|
{ |
||||
|
mode = _options.CurrentValue.AuthenticationMode.GetValueOrDefault(); |
||||
|
} |
||||
|
|
||||
|
#pragma warning disable CA1416
|
||||
|
return new(mode is OpenIddictClientSystemIntegrationAuthenticationMode.WebAuthenticationBroker); |
||||
|
#pragma warning restore CA1416
|
||||
|
} |
||||
|
} |
||||
|
|
||||
|
/// <summary>
|
||||
|
/// Represents a filter that excludes the associated handlers if no
|
||||
|
/// web authentication operation was triggered during the transaction.
|
||||
|
/// </summary>
|
||||
|
public sealed class RequireWebAuthenticationResult : IOpenIddictClientHandlerFilter<BaseContext> |
||||
|
{ |
||||
|
/// <inheritdoc/>
|
||||
|
public ValueTask<bool> IsActiveAsync(BaseContext context) |
||||
|
{ |
||||
|
if (context is null) |
||||
|
{ |
||||
|
throw new ArgumentNullException(nameof(context)); |
||||
|
} |
||||
|
|
||||
|
#if SUPPORTS_WINDOWS_RUNTIME
|
||||
|
return new(context.Transaction.GetWebAuthenticationResult() is not null); |
||||
|
#else
|
||||
|
return new(false); |
||||
|
#endif
|
||||
|
} |
||||
|
} |
||||
|
} |
||||
@ -0,0 +1,308 @@ |
|||||
|
/* |
||||
|
* Licensed under the Apache License, Version 2.0 (http://www.apache.org/licenses/LICENSE-2.0)
|
||||
|
* See https://github.com/openiddict/openiddict-core for more information concerning
|
||||
|
* the license and the contributors participating to this project. |
||||
|
*/ |
||||
|
|
||||
|
using System.Collections.Immutable; |
||||
|
using System.Diagnostics; |
||||
|
using System.Runtime.InteropServices; |
||||
|
using System.Text; |
||||
|
using Microsoft.Extensions.Primitives; |
||||
|
using OpenIddict.Extensions; |
||||
|
|
||||
|
#if SUPPORTS_WINDOWS_RUNTIME
|
||||
|
using Windows.Security.Authentication.Web; |
||||
|
#endif
|
||||
|
|
||||
|
namespace OpenIddict.Client.SystemIntegration; |
||||
|
|
||||
|
public static partial class OpenIddictClientSystemIntegrationHandlers |
||||
|
{ |
||||
|
public static class Authentication |
||||
|
{ |
||||
|
public static ImmutableArray<OpenIddictClientHandlerDescriptor> DefaultHandlers { get; } = ImmutableArray.Create( |
||||
|
/* |
||||
|
* Authorization request processing: |
||||
|
*/ |
||||
|
InvokeWebAuthenticationBroker.Descriptor, |
||||
|
LaunchSystemBrowser.Descriptor, |
||||
|
|
||||
|
/* |
||||
|
* Redirection request extraction: |
||||
|
*/ |
||||
|
ExtractGetHttpListenerRequest<ExtractRedirectionRequestContext>.Descriptor, |
||||
|
ExtractProtocolActivationParameters<ExtractRedirectionRequestContext>.Descriptor, |
||||
|
ExtractWebAuthenticationResultData<ExtractRedirectionRequestContext>.Descriptor, |
||||
|
|
||||
|
/* |
||||
|
* Redirection response handling: |
||||
|
*/ |
||||
|
AttachHttpResponseCode<ApplyRedirectionResponseContext>.Descriptor, |
||||
|
AttachCacheControlHeader<ApplyRedirectionResponseContext>.Descriptor, |
||||
|
ProcessEmptyHttpResponse.Descriptor, |
||||
|
ProcessUnactionableResponse<ApplyRedirectionResponseContext>.Descriptor); |
||||
|
|
||||
|
/// <summary>
|
||||
|
/// Contains the logic responsible for initiating authorization requests using the web authentication broker.
|
||||
|
/// Note: this handler is not used when the user session is not interactive.
|
||||
|
/// </summary>
|
||||
|
public class InvokeWebAuthenticationBroker : IOpenIddictClientHandler<ApplyAuthorizationRequestContext> |
||||
|
{ |
||||
|
private readonly OpenIddictClientSystemIntegrationService _service; |
||||
|
|
||||
|
public InvokeWebAuthenticationBroker(OpenIddictClientSystemIntegrationService service) |
||||
|
=> _service = service ?? throw new ArgumentNullException(nameof(service)); |
||||
|
|
||||
|
/// <summary>
|
||||
|
/// Gets the default descriptor definition assigned to this handler.
|
||||
|
/// </summary>
|
||||
|
public static OpenIddictClientHandlerDescriptor Descriptor { get; } |
||||
|
= OpenIddictClientHandlerDescriptor.CreateBuilder<ApplyAuthorizationRequestContext>() |
||||
|
.AddFilter<RequireInteractiveSession>() |
||||
|
.AddFilter<RequireWebAuthenticationBroker>() |
||||
|
.UseSingletonHandler<InvokeWebAuthenticationBroker>() |
||||
|
.SetOrder(100_000) |
||||
|
.SetType(OpenIddictClientHandlerType.BuiltIn) |
||||
|
.Build(); |
||||
|
|
||||
|
/// <inheritdoc/>
|
||||
|
#pragma warning disable CS1998
|
||||
|
public async ValueTask HandleAsync(ApplyAuthorizationRequestContext context) |
||||
|
#pragma warning restore CS1998
|
||||
|
{ |
||||
|
if (context is null) |
||||
|
{ |
||||
|
throw new ArgumentNullException(nameof(context)); |
||||
|
} |
||||
|
|
||||
|
Debug.Assert(context.Transaction.Request is not null, SR.GetResourceString(SR.ID4008)); |
||||
|
|
||||
|
#if SUPPORTS_WINDOWS_RUNTIME
|
||||
|
if (string.IsNullOrEmpty(context.RedirectUri)) |
||||
|
{ |
||||
|
return; |
||||
|
} |
||||
|
|
||||
|
// OpenIddict represents the complete interactive authentication dance as a two-phase process:
|
||||
|
// - The challenge, during which the user is redirected to the authorization server, either
|
||||
|
// by launching the system browser or, as in this case, using a web-view-like approach.
|
||||
|
//
|
||||
|
// - The authentication that takes place after the authorization server and the user approved
|
||||
|
// the demand and redirected the user agent to the client (using either protocol activation,
|
||||
|
// an embedded web server or by tracking the return URL of the web view created for the process).
|
||||
|
//
|
||||
|
// Unlike OpenIddict, WebAuthenticationBroker materializes this process as a single/one-shot API
|
||||
|
// that opens the system-managed authentication host, navigates to the specified request URI and
|
||||
|
// doesn't return until the specified callback URI is reached or the modal closed by the user.
|
||||
|
// To accomodate OpenIddict's model, successful results are processed as any other callback request.
|
||||
|
|
||||
|
try |
||||
|
{ |
||||
|
// Note: IAsyncOperation<T>.AsTask(context.CancellationToken) is deliberately not used here as
|
||||
|
// the asynchronous operation returned by the web authentication broker is not cancellable.
|
||||
|
switch (await WebAuthenticationBroker.AuthenticateAsync( |
||||
|
options : WebAuthenticationOptions.None, |
||||
|
requestUri : OpenIddictHelpers.AddQueryStringParameters( |
||||
|
uri: new Uri(context.AuthorizationEndpoint, UriKind.Absolute), |
||||
|
parameters: context.Transaction.Request.GetParameters().ToDictionary( |
||||
|
parameter => parameter.Key, |
||||
|
parameter => new StringValues((string?[]?) parameter.Value))), |
||||
|
callbackUri: new Uri(context.RedirectUri, UriKind.Absolute))) |
||||
|
{ |
||||
|
case { ResponseStatus: WebAuthenticationStatus.Success } result: |
||||
|
await _service.HandleWebAuthenticationResultAsync(result, context.CancellationToken); |
||||
|
context.HandleRequest(); |
||||
|
return; |
||||
|
|
||||
|
// Since the result of this operation is known by the time WebAuthenticationBroker.AuthenticateAsync()
|
||||
|
// returns, some errors can directly be handled and surfaced here, as part of the challenge handling.
|
||||
|
|
||||
|
case { ResponseStatus: WebAuthenticationStatus.UserCancel }: |
||||
|
context.Reject( |
||||
|
error: Errors.AccessDenied, |
||||
|
description: SR.GetResourceString(SR.ID2149), |
||||
|
uri: SR.FormatID8000(SR.ID2149)); |
||||
|
|
||||
|
return; |
||||
|
|
||||
|
case { ResponseStatus: WebAuthenticationStatus.ErrorHttp } result: |
||||
|
context.Reject( |
||||
|
error: result.ResponseErrorDetail switch |
||||
|
{ |
||||
|
400 => Errors.InvalidRequest, |
||||
|
401 => Errors.InvalidToken, |
||||
|
403 => Errors.InsufficientAccess, |
||||
|
429 => Errors.SlowDown, |
||||
|
500 => Errors.ServerError, |
||||
|
503 => Errors.TemporarilyUnavailable, |
||||
|
_ => Errors.ServerError |
||||
|
}, |
||||
|
description: SR.FormatID2161(result.ResponseErrorDetail), |
||||
|
uri: SR.FormatID8000(SR.ID2161)); |
||||
|
|
||||
|
return; |
||||
|
|
||||
|
default: |
||||
|
context.Reject( |
||||
|
error: Errors.ServerError, |
||||
|
description: SR.GetResourceString(SR.ID2136), |
||||
|
uri: SR.FormatID8000(SR.ID2136)); |
||||
|
|
||||
|
return; |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
catch |
||||
|
{ |
||||
|
context.Reject( |
||||
|
error: Errors.ServerError, |
||||
|
description: SR.GetResourceString(SR.ID2136), |
||||
|
uri: SR.FormatID8000(SR.ID2136)); |
||||
|
|
||||
|
return; |
||||
|
} |
||||
|
#else
|
||||
|
throw new PlatformNotSupportedException(SR.GetResourceString(SR.ID0392)); |
||||
|
#endif
|
||||
|
} |
||||
|
} |
||||
|
|
||||
|
/// <summary>
|
||||
|
/// Contains the logic responsible for initiating authorization requests using the system browser.
|
||||
|
/// Note: this handler is not used when the user session is not interactive.
|
||||
|
/// </summary>
|
||||
|
public class LaunchSystemBrowser : IOpenIddictClientHandler<ApplyAuthorizationRequestContext> |
||||
|
{ |
||||
|
/// <summary>
|
||||
|
/// Gets the default descriptor definition assigned to this handler.
|
||||
|
/// </summary>
|
||||
|
public static OpenIddictClientHandlerDescriptor Descriptor { get; } |
||||
|
= OpenIddictClientHandlerDescriptor.CreateBuilder<ApplyAuthorizationRequestContext>() |
||||
|
.AddFilter<RequireInteractiveSession>() |
||||
|
.AddFilter<RequireSystemBrowser>() |
||||
|
.UseSingletonHandler<LaunchSystemBrowser>() |
||||
|
.SetOrder(InvokeWebAuthenticationBroker.Descriptor.Order + 1_000) |
||||
|
.SetType(OpenIddictClientHandlerType.BuiltIn) |
||||
|
.Build(); |
||||
|
|
||||
|
/// <inheritdoc/>
|
||||
|
public async ValueTask HandleAsync(ApplyAuthorizationRequestContext context) |
||||
|
{ |
||||
|
if (context is null) |
||||
|
{ |
||||
|
throw new ArgumentNullException(nameof(context)); |
||||
|
} |
||||
|
|
||||
|
Debug.Assert(context.Transaction.Request is not null, SR.GetResourceString(SR.ID4008)); |
||||
|
|
||||
|
var uri = OpenIddictHelpers.AddQueryStringParameters( |
||||
|
uri: new Uri(context.AuthorizationEndpoint, UriKind.Absolute), |
||||
|
parameters: context.Transaction.Request.GetParameters().ToDictionary( |
||||
|
parameter => parameter.Key, |
||||
|
parameter => new StringValues((string?[]?) parameter.Value))); |
||||
|
|
||||
|
if (RuntimeInformation.IsOSPlatform(OSPlatform.Windows)) |
||||
|
{ |
||||
|
// Note: on Windows, multiple application models exist and must be supported to cover most scenarios:
|
||||
|
//
|
||||
|
// - Classical Win32 applications, for which no application-specific restriction is enforced.
|
||||
|
// - Win32 applications running in an AppContainer, that are very similar to UWP applications.
|
||||
|
// - Classical UWP applications, for which strict application restrictions are enforced.
|
||||
|
// - Full-trust UWP applications, that are rare but very similar to classical Win32 applications.
|
||||
|
// - Modern/hybrid Windows applications, that can be sandboxed or run as full-trust applications.
|
||||
|
//
|
||||
|
// Since .NET Standard 2.0 support for UWP was only introduced in Windows 10 1709 (also known
|
||||
|
// as Fall Creators Update) and OpenIddict requires Windows 10 1809 as the minimum supported
|
||||
|
// version, Windows 8/8.1's Metro-style/universal applications are deliberately not supported.
|
||||
|
//
|
||||
|
// While Process.Start()/ShellExecuteEx() can typically be used without any particular restriction
|
||||
|
// by non-sandboxed desktop applications to launch the default system browser, calling these
|
||||
|
// APIs in sandboxed applications will result in an UnauthorizedAccessException being thrown.
|
||||
|
//
|
||||
|
// To avoid that, the OpenIddict host needs to determine whether the platform supports Windows
|
||||
|
// Runtime APIs and favor the Launcher.LaunchUriAsync() API when it's offered by the platform.
|
||||
|
|
||||
|
#if SUPPORTS_WINDOWS_RUNTIME
|
||||
|
if (OpenIddictClientSystemIntegrationHelpers.IsWindowsRuntimeSupported() && await |
||||
|
OpenIddictClientSystemIntegrationHelpers.TryLaunchBrowserWithWindowsRuntimeAsync(uri)) |
||||
|
{ |
||||
|
context.HandleRequest(); |
||||
|
return; |
||||
|
} |
||||
|
#endif
|
||||
|
if (await OpenIddictClientSystemIntegrationHelpers.TryLaunchBrowserWithShellExecuteAsync(uri)) |
||||
|
{ |
||||
|
context.HandleRequest(); |
||||
|
return; |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
if (RuntimeInformation.IsOSPlatform(OSPlatform.Linux) && |
||||
|
await OpenIddictClientSystemIntegrationHelpers.TryLaunchBrowserWithXdgOpenAsync(uri)) |
||||
|
{ |
||||
|
context.HandleRequest(); |
||||
|
return; |
||||
|
} |
||||
|
|
||||
|
throw new InvalidOperationException(SR.GetResourceString(SR.ID0385)); |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
/// <summary>
|
||||
|
/// Contains the logic responsible for processing OpenID Connect responses that don't specify any parameter.
|
||||
|
/// Note: this handler is not used when the OpenID Connect request is not handled by the embedded web server.
|
||||
|
/// </summary>
|
||||
|
public sealed class ProcessEmptyHttpResponse : IOpenIddictClientHandler<ApplyRedirectionResponseContext> |
||||
|
{ |
||||
|
/// <summary>
|
||||
|
/// Gets the default descriptor definition assigned to this handler.
|
||||
|
/// </summary>
|
||||
|
public static OpenIddictClientHandlerDescriptor Descriptor { get; } |
||||
|
= OpenIddictClientHandlerDescriptor.CreateBuilder<ApplyRedirectionResponseContext>() |
||||
|
.AddFilter<RequireHttpListenerContext>() |
||||
|
.UseSingletonHandler<ProcessEmptyHttpResponse>() |
||||
|
.SetOrder(int.MaxValue - 100_000) |
||||
|
.SetType(OpenIddictClientHandlerType.BuiltIn) |
||||
|
.Build(); |
||||
|
|
||||
|
/// <inheritdoc/>
|
||||
|
public async ValueTask HandleAsync(ApplyRedirectionResponseContext context) |
||||
|
{ |
||||
|
if (context is null) |
||||
|
{ |
||||
|
throw new ArgumentNullException(nameof(context)); |
||||
|
} |
||||
|
|
||||
|
Debug.Assert(context.Transaction.Response is not null, SR.GetResourceString(SR.ID4007)); |
||||
|
|
||||
|
// This handler only applies to HTTP listener requests. If the HTTP context cannot be resolved,
|
||||
|
// this may indicate that the request was incorrectly processed by another server stack.
|
||||
|
var response = context.Transaction.GetHttpListenerContext()?.Response ?? |
||||
|
throw new InvalidOperationException(SR.GetResourceString(SR.ID0390)); |
||||
|
|
||||
|
// Always return a 200 status, even for responses indicating that the authentication failed.
|
||||
|
response.StatusCode = 200; |
||||
|
response.ContentType = "text/plain"; |
||||
|
|
||||
|
// Return a message indicating whether the authentication process
|
||||
|
// succeeded or failed and that will be visible by the user.
|
||||
|
var buffer = Encoding.UTF8.GetBytes(context.Transaction.Response.Error switch |
||||
|
{ |
||||
|
null or { Length: 0 } => "Login completed. Please return to the application.", |
||||
|
Errors.AccessDenied => "Authorization denied. Please return to the application.", |
||||
|
_ => "Authentication failed. Please return to the application." |
||||
|
}); |
||||
|
|
||||
|
#if SUPPORTS_STREAM_MEMORY_METHODS
|
||||
|
await response.OutputStream.WriteAsync(buffer); |
||||
|
#else
|
||||
|
await response.OutputStream.WriteAsync(buffer, 0, buffer.Length); |
||||
|
#endif
|
||||
|
await response.OutputStream.FlushAsync(); |
||||
|
|
||||
|
context.HandleRequest(); |
||||
|
} |
||||
|
} |
||||
|
} |
||||
|
} |
||||
File diff suppressed because it is too large
@ -0,0 +1,190 @@ |
|||||
|
/* |
||||
|
* Licensed under the Apache License, Version 2.0 (http://www.apache.org/licenses/LICENSE-2.0)
|
||||
|
* See https://github.com/openiddict/openiddict-core for more information concerning
|
||||
|
* the license and the contributors participating to this project. |
||||
|
*/ |
||||
|
|
||||
|
using System.ComponentModel; |
||||
|
using System.Globalization; |
||||
|
using System.Net; |
||||
|
using Microsoft.Extensions.Hosting; |
||||
|
using Microsoft.Extensions.Logging; |
||||
|
using Microsoft.Extensions.Options; |
||||
|
using OpenIddict.Extensions; |
||||
|
|
||||
|
namespace OpenIddict.Client.SystemIntegration; |
||||
|
|
||||
|
/// <summary>
|
||||
|
/// Contains the logic necessary to handle URI protocol activations that
|
||||
|
/// are redirected by other instances using inter-process communication.
|
||||
|
/// </summary>
|
||||
|
/// <remarks>
|
||||
|
/// Note: initial URI protocol activations are handled by <see cref="OpenIddictClientSystemIntegrationActivationHandler"/>.
|
||||
|
/// </remarks>
|
||||
|
[EditorBrowsable(EditorBrowsableState.Never)] |
||||
|
public sealed class OpenIddictClientSystemIntegrationHttpListener : BackgroundService |
||||
|
{ |
||||
|
private readonly TaskCompletionSource<int?> _source = new(); |
||||
|
private readonly ILogger<OpenIddictClientSystemIntegrationHttpListener> _logger; |
||||
|
private readonly IOptionsMonitor<OpenIddictClientSystemIntegrationOptions> _options; |
||||
|
private readonly OpenIddictClientSystemIntegrationService _service; |
||||
|
|
||||
|
/// <summary>
|
||||
|
/// Creates a new instance of the <see cref="OpenIddictClientSystemIntegrationHttpListener"/> class.
|
||||
|
/// </summary>
|
||||
|
/// <param name="logger">The logger.</param>
|
||||
|
/// <param name="options">The OpenIddict client system integration options.</param>
|
||||
|
/// <param name="service">The OpenIddict client system integration service.</param>
|
||||
|
public OpenIddictClientSystemIntegrationHttpListener( |
||||
|
ILogger<OpenIddictClientSystemIntegrationHttpListener> logger, |
||||
|
IOptionsMonitor<OpenIddictClientSystemIntegrationOptions> options, |
||||
|
OpenIddictClientSystemIntegrationService service) |
||||
|
{ |
||||
|
_logger = logger ?? throw new ArgumentNullException(nameof(logger)); |
||||
|
_options = options ?? throw new ArgumentNullException(nameof(options)); |
||||
|
_service = service ?? throw new ArgumentNullException(nameof(service)); |
||||
|
} |
||||
|
|
||||
|
/// <inheritdoc/>
|
||||
|
protected override async Task ExecuteAsync(CancellationToken stoppingToken) |
||||
|
{ |
||||
|
// If the embedded web server instantiation was not enabled, signal the task completion source with a
|
||||
|
// null value to inform the handlers that no HTTP listener is going to be created and return immediately.
|
||||
|
if (_options.CurrentValue.EnableEmbeddedWebServer is not true) |
||||
|
{ |
||||
|
_source.SetResult(result: null); |
||||
|
return; |
||||
|
} |
||||
|
|
||||
|
try |
||||
|
{ |
||||
|
// Note: finding a free port in the IANA dynamic port range can take a bit of time on busy systems.
|
||||
|
// To ensure the host initialization is not blocked, the whole process is offloaded to the thread pool.
|
||||
|
await Task.Run(cancellationToken: stoppingToken, function: async () => |
||||
|
{ |
||||
|
var (listener, port) = CreateHttpListener(stoppingToken) ?? |
||||
|
throw new InvalidOperationException(SR.GetResourceString(SR.ID0391)); |
||||
|
|
||||
|
// Inform the handlers that the HTTP listener was created and can now be accessed via the specified port.
|
||||
|
_source.SetResult(port); |
||||
|
|
||||
|
using (listener) |
||||
|
{ |
||||
|
// Note: while the received load should be minimal, 3 task workers are used
|
||||
|
// to be able to process multiple requests at the same time, if necessary.
|
||||
|
var tasks = new Task[3]; |
||||
|
|
||||
|
for (var index = 0; index < tasks.Length; index++) |
||||
|
{ |
||||
|
tasks[index] = ProcessRequestsAsync(listener, _service, _logger, stoppingToken); |
||||
|
} |
||||
|
|
||||
|
// Wait for all the workers to indicate they finished processing incoming requests.
|
||||
|
await Task.WhenAll(tasks); |
||||
|
} |
||||
|
}); |
||||
|
} |
||||
|
|
||||
|
// Ignore exceptions indicating that the host is shutting down and return immediately.
|
||||
|
catch (OperationCanceledException) when (stoppingToken.IsCancellationRequested) |
||||
|
{ |
||||
|
return; |
||||
|
} |
||||
|
|
||||
|
static (HttpListener Listener, int Port)? CreateHttpListener(CancellationToken cancellationToken) |
||||
|
{ |
||||
|
// Note: HttpListener doesn't offer a native way to select a random, non-busy port.
|
||||
|
// To work around this limitation, this local function tries to bind an HttpListener
|
||||
|
// on the first free port in the IANA dynamic ports range (typically: 49152 to 65535).
|
||||
|
//
|
||||
|
// For more information, see
|
||||
|
// https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml.
|
||||
|
|
||||
|
for (var port = 49152; port < 65535; port++) |
||||
|
{ |
||||
|
cancellationToken.ThrowIfCancellationRequested(); |
||||
|
|
||||
|
var listener = new HttpListener |
||||
|
{ |
||||
|
AuthenticationSchemes = AuthenticationSchemes.Anonymous, |
||||
|
IgnoreWriteExceptions = true, |
||||
|
|
||||
|
// Note: the prefix registration is deliberately not configurable to ensure
|
||||
|
// only the "localhost" authority is used, which enforces the built-in host
|
||||
|
// validation performed by HTTP.sys (or the managed .NET implementation on
|
||||
|
// non-Windows operating systems) and doesn't require running the application
|
||||
|
// as an administrator or adding a namespace reservation/ACL rule on Windows.
|
||||
|
Prefixes = { $"http://localhost:{port.ToString(CultureInfo.InvariantCulture)}/" } |
||||
|
}; |
||||
|
|
||||
|
try |
||||
|
{ |
||||
|
listener.Start(); |
||||
|
|
||||
|
return (listener, port); |
||||
|
} |
||||
|
|
||||
|
catch (HttpListenerException) |
||||
|
{ |
||||
|
listener.Close(); |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
return null; |
||||
|
} |
||||
|
|
||||
|
static async Task ProcessRequestsAsync(HttpListener listener, OpenIddictClientSystemIntegrationService service, |
||||
|
ILogger<OpenIddictClientSystemIntegrationHttpListener> logger, CancellationToken cancellationToken) |
||||
|
{ |
||||
|
while (true) |
||||
|
{ |
||||
|
cancellationToken.ThrowIfCancellationRequested(); |
||||
|
|
||||
|
try |
||||
|
{ |
||||
|
// Note: HttpListener.GetContextAsync() doesn't support cooperative cancellation. To ensure the host
|
||||
|
// can gracefully shut down without being blocked by an asynchronous call that would never complete,
|
||||
|
// Task.WaitAsync() is used to stop waiting on the task returned by HttpListener.GetContextAsync()
|
||||
|
// when the CancellationToken provided by the host indicates that the application is about to shut down.
|
||||
|
var context = await listener.GetContextAsync().WaitAsync(cancellationToken); |
||||
|
|
||||
|
using (context.Response) |
||||
|
{ |
||||
|
// Only process requests for which the request URL could be decoded/parsed correctly.
|
||||
|
if (context.Request.Url is { IsAbsoluteUri: true }) |
||||
|
{ |
||||
|
await service.HandleHttpRequestAsync(context, cancellationToken); |
||||
|
} |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
// Surface operation canceled exceptions when the host is shutting down.
|
||||
|
catch (OperationCanceledException) when (cancellationToken.IsCancellationRequested) |
||||
|
{ |
||||
|
throw; |
||||
|
} |
||||
|
|
||||
|
// Swallow other exceptions to ensure the worker doesn't exit when encountering an exception.
|
||||
|
catch (Exception exception) when (!OpenIddictHelpers.IsFatal(exception)) |
||||
|
{ |
||||
|
logger.LogWarning(exception, SR.GetResourceString(SR.ID6214)); |
||||
|
|
||||
|
continue; |
||||
|
} |
||||
|
} |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
/// <summary>
|
||||
|
/// Resolves the port associated to the <see cref="HttpListener"/> created by this service, or
|
||||
|
/// <see langword="null"/> if the embedded web server instantiation was disabled in the options.
|
||||
|
/// </summary>
|
||||
|
/// <param name="cancellationToken">The <see cref="CancellationToken"/> that can be used to abort the operation.</param>
|
||||
|
/// <returns>
|
||||
|
/// A <see cref="Task"/> that can be used to monitor the asynchronous operation, whose result
|
||||
|
/// returns the port associated to the <see cref="HttpListener"/> created by this service, or
|
||||
|
/// <see langword="null"/> if the embedded web server instantiation was disabled in the options.
|
||||
|
/// </returns>
|
||||
|
internal Task<int?> GetEmbeddedServerPortAsync(CancellationToken cancellationToken = default) |
||||
|
=> _source.Task.WaitAsync(cancellationToken); |
||||
|
} |
||||
@ -0,0 +1,103 @@ |
|||||
|
/* |
||||
|
* Licensed under the Apache License, Version 2.0 (http://www.apache.org/licenses/LICENSE-2.0)
|
||||
|
* See https://github.com/openiddict/openiddict-core for more information concerning
|
||||
|
* the license and the contributors participating to this project. |
||||
|
*/ |
||||
|
|
||||
|
using System.IO.Pipes; |
||||
|
using System.Runtime.Versioning; |
||||
|
|
||||
|
namespace OpenIddict.Client.SystemIntegration; |
||||
|
|
||||
|
/// <summary>
|
||||
|
/// Provides various settings needed to configure the OpenIddict client system integration.
|
||||
|
/// </summary>
|
||||
|
public sealed class OpenIddictClientSystemIntegrationOptions |
||||
|
{ |
||||
|
/// <summary>
|
||||
|
/// Gets or sets the authentication mode used to start authentication flows.
|
||||
|
/// </summary>
|
||||
|
/// <remarks>
|
||||
|
/// If this property is not explicitly set, its value is automatically set by OpenIddict.
|
||||
|
/// </remarks>
|
||||
|
public OpenIddictClientSystemIntegrationAuthenticationMode? AuthenticationMode { get; set; } |
||||
|
|
||||
|
/// <summary>
|
||||
|
/// Gets or sets the timeout after which authentication demands
|
||||
|
/// that are not completed are automatically aborted by OpenIddict.
|
||||
|
/// </summary>
|
||||
|
public TimeSpan AuthenticationTimeout { get; set; } = TimeSpan.FromMinutes(10); |
||||
|
|
||||
|
/// <summary>
|
||||
|
/// Gets or sets a boolean indicating whether protocol activation processing should be enabled.
|
||||
|
/// </summary>
|
||||
|
/// <remarks>
|
||||
|
/// If this property is not explicitly set, its value is automatically set by OpenIddict
|
||||
|
/// depending on the capabilities of the system on which the application is running.
|
||||
|
/// </remarks>
|
||||
|
public bool? EnableActivationHandling { get; set; } |
||||
|
|
||||
|
/// <summary>
|
||||
|
/// Gets or sets a boolean indicating whether protocol activation redirection should be enabled.
|
||||
|
/// </summary>
|
||||
|
/// <remarks>
|
||||
|
/// If this property is not explicitly set, its value is automatically set by OpenIddict
|
||||
|
/// depending on the capabilities of the system on which the application is running.
|
||||
|
/// </remarks>
|
||||
|
public bool? EnableActivationRedirection { get; set; } |
||||
|
|
||||
|
/// <summary>
|
||||
|
/// Gets or sets a boolean indicating whether a local web server
|
||||
|
/// should be started on a random port to handle callbacks.
|
||||
|
/// </summary>
|
||||
|
/// <remarks>
|
||||
|
/// If this property is not explicitly set, its value is automatically set by OpenIddict
|
||||
|
/// depending on the capabilities of the system on which the application is running.
|
||||
|
/// </remarks>
|
||||
|
public bool? EnableEmbeddedWebServer { get; set; } |
||||
|
|
||||
|
/// <summary>
|
||||
|
/// Gets or sets a boolean indicating whether a pipe server should be started to process notifications
|
||||
|
/// (e.g protocol activation redirections) sent by other instances of the application.
|
||||
|
/// </summary>
|
||||
|
/// <remarks>
|
||||
|
/// If this property is not explicitly set, its value is automatically set by OpenIddict
|
||||
|
/// depending on the capabilities of the system on which the application is running.
|
||||
|
/// </remarks>
|
||||
|
public bool? EnablePipeServer { get; set; } |
||||
|
|
||||
|
/// <summary>
|
||||
|
/// Gets or sets the identifier used to represent the current application
|
||||
|
/// instance and redirect protocol activations when necessary.
|
||||
|
/// </summary>
|
||||
|
public string? InstanceIdentifier { get; set; } |
||||
|
|
||||
|
/// <summary>
|
||||
|
/// Gets or sets the base name of the pipe created by OpenIddict to enable
|
||||
|
/// inter-process communication and handle protocol activation redirections.
|
||||
|
/// </summary>
|
||||
|
/// <remarks>
|
||||
|
/// If no value is explicitly set, a default name is automatically computed.
|
||||
|
/// </remarks>
|
||||
|
public string PipeName { get; set; } = default!; |
||||
|
|
||||
|
/// <summary>
|
||||
|
/// Gets or sets the pipe options applied to the pipe created by OpenIddict to enable
|
||||
|
/// inter-process communication and handle protocol activation redirections.
|
||||
|
/// </summary>
|
||||
|
/// <remarks>
|
||||
|
/// If no value is explicitly set, a default combination is automatically used.
|
||||
|
/// </remarks>
|
||||
|
public PipeOptions? PipeOptions { get; set; } |
||||
|
|
||||
|
/// <summary>
|
||||
|
/// Gets or sets the security policy applied to the pipe created by OpenIddict
|
||||
|
/// to enable inter-process communication and handle protocol activation redirections.
|
||||
|
/// </summary>
|
||||
|
/// <remarks>
|
||||
|
/// If no value is explicitly set, a default policy is automatically created
|
||||
|
/// (unless the application is running inside an AppContainer sandbox).
|
||||
|
/// </remarks>
|
||||
|
[SupportedOSPlatform("windows")] |
||||
|
public PipeSecurity? PipeSecurity { get; set; } |
||||
|
} |
||||
@ -0,0 +1,183 @@ |
|||||
|
/* |
||||
|
* Licensed under the Apache License, Version 2.0 (http://www.apache.org/licenses/LICENSE-2.0)
|
||||
|
* See https://github.com/openiddict/openiddict-core for more information concerning
|
||||
|
* the license and the contributors participating to this project. |
||||
|
*/ |
||||
|
|
||||
|
using System.ComponentModel; |
||||
|
using System.IO.Pipes; |
||||
|
using System.Runtime.InteropServices; |
||||
|
using Microsoft.Extensions.Hosting; |
||||
|
using Microsoft.Extensions.Logging; |
||||
|
using Microsoft.Extensions.Options; |
||||
|
using OpenIddict.Extensions; |
||||
|
|
||||
|
namespace OpenIddict.Client.SystemIntegration; |
||||
|
|
||||
|
/// <summary>
|
||||
|
/// Contains the logic necessary to handle URI protocol activations that
|
||||
|
/// are redirected by other instances using inter-process communication.
|
||||
|
/// </summary>
|
||||
|
/// <remarks>
|
||||
|
/// Note: initial URI protocol activations are handled by <see cref="OpenIddictClientSystemIntegrationActivationHandler"/>.
|
||||
|
/// </remarks>
|
||||
|
[EditorBrowsable(EditorBrowsableState.Never)] |
||||
|
public sealed class OpenIddictClientSystemIntegrationPipeListener : BackgroundService |
||||
|
{ |
||||
|
private readonly ILogger<OpenIddictClientSystemIntegrationPipeListener> _logger; |
||||
|
private readonly IOptionsMonitor<OpenIddictClientSystemIntegrationOptions> _options; |
||||
|
private readonly OpenIddictClientSystemIntegrationService _service; |
||||
|
|
||||
|
/// <summary>
|
||||
|
/// Creates a new instance of the <see cref="OpenIddictClientSystemIntegrationPipeListener"/> class.
|
||||
|
/// </summary>
|
||||
|
/// <param name="logger">The logger.</param>
|
||||
|
/// <param name="options">The OpenIddict client system integration options.</param>
|
||||
|
/// <param name="service">The OpenIddict client system integration service.</param>
|
||||
|
public OpenIddictClientSystemIntegrationPipeListener( |
||||
|
ILogger<OpenIddictClientSystemIntegrationPipeListener> logger, |
||||
|
IOptionsMonitor<OpenIddictClientSystemIntegrationOptions> options, |
||||
|
OpenIddictClientSystemIntegrationService service) |
||||
|
{ |
||||
|
_logger = logger ?? throw new ArgumentNullException(nameof(logger)); |
||||
|
_options = options ?? throw new ArgumentNullException(nameof(options)); |
||||
|
_service = service ?? throw new ArgumentNullException(nameof(service)); |
||||
|
} |
||||
|
|
||||
|
/// <inheritdoc/>
|
||||
|
protected override async Task ExecuteAsync(CancellationToken stoppingToken) |
||||
|
{ |
||||
|
if (_options.CurrentValue.EnablePipeServer is not true) |
||||
|
{ |
||||
|
return; |
||||
|
} |
||||
|
|
||||
|
try |
||||
|
{ |
||||
|
// Offload the whole process to avoid delaying the initialization of the host.
|
||||
|
await Task.Run(cancellationToken: stoppingToken, function: async () => |
||||
|
{ |
||||
|
// Note: while the received load should be minimal, 3 task workers are used
|
||||
|
// to be able to process multiple notifications at the same time, if necessary.
|
||||
|
var tasks = new Task[3]; |
||||
|
|
||||
|
for (var index = 0; index < tasks.Length; index++) |
||||
|
{ |
||||
|
tasks[index] = ProcessNotificationsAsync(_service, _logger, _options.CurrentValue, stoppingToken); |
||||
|
} |
||||
|
|
||||
|
// Wait for all the workers to indicate they finished processing incoming notifications.
|
||||
|
await Task.WhenAll(tasks); |
||||
|
}); |
||||
|
} |
||||
|
|
||||
|
// Ignore exceptions indicating that the host is shutting down and return immediately.
|
||||
|
catch (OperationCanceledException) when (stoppingToken.IsCancellationRequested) |
||||
|
{ |
||||
|
return; |
||||
|
} |
||||
|
|
||||
|
static async Task ProcessNotificationsAsync( |
||||
|
OpenIddictClientSystemIntegrationService service, ILogger<OpenIddictClientSystemIntegrationPipeListener> logger, |
||||
|
OpenIddictClientSystemIntegrationOptions options, CancellationToken cancellationToken) |
||||
|
{ |
||||
|
while (true) |
||||
|
{ |
||||
|
cancellationToken.ThrowIfCancellationRequested(); |
||||
|
|
||||
|
try |
||||
|
{ |
||||
|
using var buffer = new MemoryStream(); |
||||
|
using var reader = new BinaryReader(buffer); |
||||
|
using var stream = CreatePipeServerStream(options); |
||||
|
|
||||
|
// Wait for a writer to connect to the named pipe.
|
||||
|
//
|
||||
|
// Note: NamedPipeServerStream supports cooperative cancellation but it appears that cancellations
|
||||
|
// are not always properly handled in some obscure circumstances. To ensure the application shutdown
|
||||
|
// is not delayed by this issue, the Task.WaitAsync(CancellationToken) API is used to stop waiting
|
||||
|
// for the task returned by WaitForConnectionAsync() to complete when the application shuts down.
|
||||
|
await stream.WaitForConnectionAsync(cancellationToken).WaitAsync(cancellationToken); |
||||
|
|
||||
|
// Copy the content to the memory stream asynchronously and rewind it.
|
||||
|
await stream.CopyToAsync(buffer, bufferSize: 81_920, cancellationToken); |
||||
|
buffer.Seek(0L, SeekOrigin.Begin); |
||||
|
|
||||
|
// Process the inter-process notification based on its declared type.
|
||||
|
await (reader.ReadInt32() switch |
||||
|
{ |
||||
|
0x01 when ReadProtocolActivation(reader) is var activation |
||||
|
=> service.HandleProtocolActivationAsync(activation, cancellationToken), |
||||
|
|
||||
|
var value => throw new InvalidOperationException(SR.FormatID0387(value)) |
||||
|
}); |
||||
|
} |
||||
|
|
||||
|
// Ignore exceptions indicating that the host is shutting down and return immediately.
|
||||
|
catch (OperationCanceledException) when (cancellationToken.IsCancellationRequested) |
||||
|
{ |
||||
|
throw; |
||||
|
} |
||||
|
|
||||
|
// Swallow other exceptions to ensure the service doesn't exit when encountering an exception.
|
||||
|
catch (Exception exception) when (!OpenIddictHelpers.IsFatal(exception)) |
||||
|
{ |
||||
|
logger.LogWarning(exception, SR.GetResourceString(SR.ID6213)); |
||||
|
|
||||
|
continue; |
||||
|
} |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
static NamedPipeServerStream CreatePipeServerStream(OpenIddictClientSystemIntegrationOptions options) |
||||
|
// Note: the ACL-based PipeSecurity class is only supported on Windows. On other operating systems,
|
||||
|
// PipeOptions.CurrentUserOnly can be used as an alternative, but only for TFMs that implement it.
|
||||
|
=> RuntimeInformation.IsOSPlatform(OSPlatform.Windows) ? |
||||
|
#if SUPPORTS_NAMED_PIPE_CONSTRUCTOR_WITH_ACL
|
||||
|
new NamedPipeServerStream( |
||||
|
#elif SUPPORTS_NAMED_PIPE_STATIC_FACTORY_WITH_ACL
|
||||
|
NamedPipeServerStreamAcl.Create( |
||||
|
#else
|
||||
|
NamedPipeServerStreamConstructors.New( |
||||
|
#endif
|
||||
|
pipeName : $@"{options.PipeName}\{options.InstanceIdentifier}", |
||||
|
direction : PipeDirection.In, |
||||
|
maxNumberOfServerInstances: NamedPipeServerStream.MaxAllowedServerInstances, |
||||
|
transmissionMode : PipeTransmissionMode.Byte, |
||||
|
options : options.PipeOptions.GetValueOrDefault(), |
||||
|
inBufferSize : 0, |
||||
|
outBufferSize : 0, |
||||
|
pipeSecurity : options.PipeSecurity, |
||||
|
inheritability : HandleInheritability.None, |
||||
|
additionalAccessRights : default) : |
||||
|
new NamedPipeServerStream( |
||||
|
pipeName : $@"{options.PipeName}\{options.InstanceIdentifier}", |
||||
|
direction : PipeDirection.In, |
||||
|
maxNumberOfServerInstances: NamedPipeServerStream.MaxAllowedServerInstances, |
||||
|
transmissionMode : PipeTransmissionMode.Byte, |
||||
|
options : options.PipeOptions.GetValueOrDefault(), |
||||
|
inBufferSize : 0, |
||||
|
outBufferSize : 0); |
||||
|
|
||||
|
static OpenIddictClientSystemIntegrationActivation ReadProtocolActivation(BinaryReader reader) |
||||
|
{ |
||||
|
// Ensure the binary serialization format is supported.
|
||||
|
var version = reader.ReadInt32(); |
||||
|
if (version is not 0x01) |
||||
|
{ |
||||
|
throw new InvalidOperationException(SR.GetResourceString(SR.ID0388)); |
||||
|
} |
||||
|
|
||||
|
var value = reader.ReadString(); |
||||
|
if (string.IsNullOrEmpty(value) || !Uri.TryCreate(value, UriKind.Absolute, out Uri? uri)) |
||||
|
{ |
||||
|
throw new InvalidOperationException(SR.GetResourceString(SR.ID0388)); |
||||
|
} |
||||
|
|
||||
|
return new OpenIddictClientSystemIntegrationActivation(uri) |
||||
|
{ |
||||
|
IsActivationRedirected = true |
||||
|
}; |
||||
|
} |
||||
|
} |
||||
|
} |
||||
@ -0,0 +1,208 @@ |
|||||
|
/* |
||||
|
* Licensed under the Apache License, Version 2.0 (http://www.apache.org/licenses/LICENSE-2.0)
|
||||
|
* See https://github.com/openiddict/openiddict-core for more information concerning
|
||||
|
* the license and the contributors participating to this project. |
||||
|
*/ |
||||
|
|
||||
|
using System.ComponentModel; |
||||
|
using System.IO.Pipes; |
||||
|
using System.Net; |
||||
|
using System.Security.Principal; |
||||
|
using Microsoft.Extensions.DependencyInjection; |
||||
|
using Microsoft.Extensions.Options; |
||||
|
|
||||
|
#if SUPPORTS_WINDOWS_RUNTIME
|
||||
|
using Windows.Security.Authentication.Web; |
||||
|
#endif
|
||||
|
|
||||
|
namespace OpenIddict.Client.SystemIntegration; |
||||
|
|
||||
|
/// <summary>
|
||||
|
/// Contains the logic necessary to handle URI protocol activations (that
|
||||
|
/// are typically resolved when launching the application or redirected
|
||||
|
/// by other instances using inter-process communication).
|
||||
|
/// </summary>
|
||||
|
public sealed class OpenIddictClientSystemIntegrationService |
||||
|
{ |
||||
|
private readonly IOptionsMonitor<OpenIddictClientSystemIntegrationOptions> _options; |
||||
|
private readonly IServiceProvider _provider; |
||||
|
|
||||
|
/// <summary>
|
||||
|
/// Creates a new instance of the <see cref="OpenIddictClientSystemIntegrationService"/> class.
|
||||
|
/// </summary>
|
||||
|
/// <param name="options">The OpenIddict client system integration options.</param>
|
||||
|
/// <param name="provider">The service provider.</param>
|
||||
|
/// <exception cref="ArgumentNullException"><paramref name="provider"/> is <see langword="null"/>.</exception>
|
||||
|
public OpenIddictClientSystemIntegrationService( |
||||
|
IOptionsMonitor<OpenIddictClientSystemIntegrationOptions> options, |
||||
|
IServiceProvider provider) |
||||
|
{ |
||||
|
_options = options ?? throw new ArgumentNullException(nameof(options)); |
||||
|
_provider = provider ?? throw new ArgumentNullException(nameof(provider)); |
||||
|
} |
||||
|
|
||||
|
/// <summary>
|
||||
|
/// Handles the specified protocol activation.
|
||||
|
/// </summary>
|
||||
|
/// <param name="activation">The protocol activation details.</param>
|
||||
|
/// <param name="cancellationToken">The <see cref="CancellationToken"/> that can be used to abort the operation.</param>
|
||||
|
/// <returns>A <see cref="Task"/> that can be used to monitor the asynchronous operation.</returns>
|
||||
|
/// <exception cref="ArgumentNullException"><paramref name="activation"/> is <see langword="null"/>.</exception>
|
||||
|
[EditorBrowsable(EditorBrowsableState.Advanced)] |
||||
|
public Task HandleProtocolActivationAsync(OpenIddictClientSystemIntegrationActivation activation, |
||||
|
CancellationToken cancellationToken = default) |
||||
|
{ |
||||
|
if (activation is null) |
||||
|
{ |
||||
|
throw new ArgumentNullException(nameof(activation)); |
||||
|
} |
||||
|
|
||||
|
return HandleRequestAsync(activation, cancellationToken); |
||||
|
} |
||||
|
|
||||
|
/// <summary>
|
||||
|
/// Handles the specified HTTP request.
|
||||
|
/// </summary>
|
||||
|
/// <param name="request">The HTTP request received by the embedded web server.</param>
|
||||
|
/// <param name="cancellationToken">The <see cref="CancellationToken"/> that can be used to abort the operation.</param>
|
||||
|
/// <returns>A <see cref="Task"/> that can be used to monitor the asynchronous operation.</returns>
|
||||
|
/// <exception cref="ArgumentNullException"><paramref name="request"/> is <see langword="null"/>.</exception>
|
||||
|
internal Task HandleHttpRequestAsync(HttpListenerContext request, CancellationToken cancellationToken = default) |
||||
|
{ |
||||
|
if (request is null) |
||||
|
{ |
||||
|
throw new ArgumentNullException(nameof(request)); |
||||
|
} |
||||
|
|
||||
|
return HandleRequestAsync(request, cancellationToken); |
||||
|
} |
||||
|
|
||||
|
#if SUPPORTS_WINDOWS_RUNTIME
|
||||
|
/// <summary>
|
||||
|
/// Handles the specified web authentication result.
|
||||
|
/// </summary>
|
||||
|
/// <param name="result">The web authentication result.</param>
|
||||
|
/// <param name="cancellationToken">The <see cref="CancellationToken"/> that can be used to abort the operation.</param>
|
||||
|
/// <returns>A <see cref="Task"/> that can be used to monitor the asynchronous operation.</returns>
|
||||
|
/// <exception cref="ArgumentNullException"><paramref name="result"/> is <see langword="null"/>.</exception>
|
||||
|
internal Task HandleWebAuthenticationResultAsync(WebAuthenticationResult result, CancellationToken cancellationToken = default) |
||||
|
{ |
||||
|
if (result is null) |
||||
|
{ |
||||
|
throw new ArgumentNullException(nameof(result)); |
||||
|
} |
||||
|
|
||||
|
return HandleRequestAsync(result, cancellationToken); |
||||
|
} |
||||
|
#endif
|
||||
|
|
||||
|
/// <summary>
|
||||
|
/// Handles the request using the specified property.
|
||||
|
/// </summary>
|
||||
|
/// <param name="property">The property to add to the transaction.</param>
|
||||
|
/// <param name="cancellationToken">The <see cref="CancellationToken"/> that can be used to abort the operation.</param>
|
||||
|
/// <returns>A <see cref="Task"/> that can be used to monitor the asynchronous operation.</returns>
|
||||
|
/// <exception cref="ArgumentNullException"><paramref name="property"/> is <see langword="null"/>.</exception>
|
||||
|
private async Task HandleRequestAsync<TProperty>(TProperty property, CancellationToken cancellationToken) where TProperty : class |
||||
|
{ |
||||
|
if (property is null) |
||||
|
{ |
||||
|
throw new ArgumentNullException(nameof(property)); |
||||
|
} |
||||
|
|
||||
|
cancellationToken.ThrowIfCancellationRequested(); |
||||
|
|
||||
|
var scope = _provider.CreateScope(); |
||||
|
|
||||
|
try |
||||
|
{ |
||||
|
var dispatcher = scope.ServiceProvider.GetRequiredService<IOpenIddictClientDispatcher>(); |
||||
|
var factory = scope.ServiceProvider.GetRequiredService<IOpenIddictClientFactory>(); |
||||
|
|
||||
|
// Create a client transaction and store the specified instance so
|
||||
|
// it can be retrieved by the event handlers that need to access it.
|
||||
|
var transaction = await factory.CreateTransactionAsync(); |
||||
|
transaction.SetProperty(typeof(TProperty).FullName!, property); |
||||
|
|
||||
|
var context = new ProcessRequestContext(transaction) |
||||
|
{ |
||||
|
CancellationToken = cancellationToken |
||||
|
}; |
||||
|
|
||||
|
await dispatcher.DispatchAsync(context); |
||||
|
|
||||
|
if (context.IsRejected) |
||||
|
{ |
||||
|
await dispatcher.DispatchAsync(new ProcessErrorContext(transaction) |
||||
|
{ |
||||
|
CancellationToken = cancellationToken, |
||||
|
Error = context.Error ?? Errors.InvalidRequest, |
||||
|
ErrorDescription = context.ErrorDescription, |
||||
|
ErrorUri = context.ErrorUri, |
||||
|
Response = new OpenIddictResponse() |
||||
|
}); |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
finally |
||||
|
{ |
||||
|
if (scope is IAsyncDisposable disposable) |
||||
|
{ |
||||
|
await disposable.DisposeAsync(); |
||||
|
} |
||||
|
|
||||
|
else |
||||
|
{ |
||||
|
scope.Dispose(); |
||||
|
} |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
/// <summary>
|
||||
|
/// Redirects a protocol activation to the specified instance.
|
||||
|
/// </summary>
|
||||
|
/// <param name="activation">The protocol activation to redirect.</param>
|
||||
|
/// <param name="identifier">The identifier of the target instance.</param>
|
||||
|
/// <param name="cancellationToken">The <see cref="CancellationToken"/> that can be used to abort the operation.</param>
|
||||
|
/// <returns>A <see cref="Task"/> that can be used to monitor the asynchronous operation.</returns>
|
||||
|
/// <exception cref="ArgumentNullException"><paramref name="activation"/> is <see langword="null"/>.</exception>
|
||||
|
internal async Task RedirectProtocolActivationAsync( |
||||
|
OpenIddictClientSystemIntegrationActivation activation, |
||||
|
string identifier, CancellationToken cancellationToken = default) |
||||
|
{ |
||||
|
if (activation is null) |
||||
|
{ |
||||
|
throw new ArgumentNullException(nameof(activation)); |
||||
|
} |
||||
|
|
||||
|
if (string.IsNullOrEmpty(identifier)) |
||||
|
{ |
||||
|
throw new ArgumentException(SR.FormatID0366(nameof(identifier)), nameof(identifier)); |
||||
|
} |
||||
|
|
||||
|
using var buffer = new MemoryStream(); |
||||
|
using var writer = new BinaryWriter(buffer); |
||||
|
using var stream = new NamedPipeClientStream( |
||||
|
serverName : ".", |
||||
|
pipeName : $@"{_options.CurrentValue.PipeName}\{identifier}", |
||||
|
direction : PipeDirection.Out, |
||||
|
options : PipeOptions.Asynchronous, |
||||
|
impersonationLevel: TokenImpersonationLevel.None, |
||||
|
inheritability : HandleInheritability.None); |
||||
|
|
||||
|
// Wait for the target to accept the pipe connection.
|
||||
|
await stream.ConnectAsync(cancellationToken); |
||||
|
|
||||
|
// Write the type of message stored in the shared memory and the
|
||||
|
// version used to identify the binary serialization format.
|
||||
|
writer.Write(0x01); |
||||
|
writer.Write(0x01); |
||||
|
|
||||
|
// Write the protocol activation URI.
|
||||
|
writer.Write(activation.ActivationUri.AbsoluteUri); |
||||
|
|
||||
|
// Transfer the payload to the target.
|
||||
|
buffer.Seek(0L, SeekOrigin.Begin); |
||||
|
await buffer.CopyToAsync(stream, bufferSize: 81_920, cancellationToken); |
||||
|
} |
||||
|
} |
||||
@ -1,139 +0,0 @@ |
|||||
/* |
|
||||
* Licensed under the Apache License, Version 2.0 (http://www.apache.org/licenses/LICENSE-2.0)
|
|
||||
* See https://github.com/openiddict/openiddict-core for more information concerning
|
|
||||
* the license and the contributors participating to this project. |
|
||||
*/ |
|
||||
|
|
||||
using System.ComponentModel; |
|
||||
using System.IO.Pipes; |
|
||||
using OpenIddict.Client.Windows; |
|
||||
|
|
||||
namespace Microsoft.Extensions.DependencyInjection; |
|
||||
|
|
||||
/// <summary>
|
|
||||
/// Exposes the necessary methods required to configure
|
|
||||
/// the OpenIddict client Windows integration.
|
|
||||
/// </summary>
|
|
||||
public sealed class OpenIddictClientWindowsBuilder |
|
||||
{ |
|
||||
/// <summary>
|
|
||||
/// Initializes a new instance of <see cref="OpenIddictClientWindowsBuilder"/>.
|
|
||||
/// </summary>
|
|
||||
/// <param name="services">The services collection.</param>
|
|
||||
public OpenIddictClientWindowsBuilder(IServiceCollection services) |
|
||||
=> Services = services ?? throw new ArgumentNullException(nameof(services)); |
|
||||
|
|
||||
/// <summary>
|
|
||||
/// Gets the services collection.
|
|
||||
/// </summary>
|
|
||||
[EditorBrowsable(EditorBrowsableState.Never)] |
|
||||
public IServiceCollection Services { get; } |
|
||||
|
|
||||
/// <summary>
|
|
||||
/// Amends the default OpenIddict client Windows configuration.
|
|
||||
/// </summary>
|
|
||||
/// <param name="configuration">The delegate used to configure the OpenIddict options.</param>
|
|
||||
/// <remarks>This extension can be safely called multiple times.</remarks>
|
|
||||
/// <returns>The <see cref="OpenIddictClientWindowsBuilder"/>.</returns>
|
|
||||
public OpenIddictClientWindowsBuilder Configure(Action<OpenIddictClientWindowsOptions> configuration) |
|
||||
{ |
|
||||
if (configuration is null) |
|
||||
{ |
|
||||
throw new ArgumentNullException(nameof(configuration)); |
|
||||
} |
|
||||
|
|
||||
Services.Configure(configuration); |
|
||||
|
|
||||
return this; |
|
||||
} |
|
||||
|
|
||||
/// <summary>
|
|
||||
/// Disables the built-in protocol activation processing logic, which
|
|
||||
/// can be used to offload this task a separate dedicated executable.
|
|
||||
/// </summary>
|
|
||||
/// <returns>The <see cref="OpenIddictClientWindowsBuilder"/>.</returns>
|
|
||||
public OpenIddictClientWindowsBuilder DisableProtocolActivationProcessing() |
|
||||
=> Configure(options => options.DisableProtocolActivationProcessing = true); |
|
||||
|
|
||||
/// <summary>
|
|
||||
/// Sets the timeout after which authentication demands that
|
|
||||
/// are not completed are automatically aborted by OpenIddict.
|
|
||||
/// </summary>
|
|
||||
/// <param name="timeout">The authentication timeout.</param>
|
|
||||
/// <returns>The <see cref="OpenIddictClientWindowsBuilder"/>.</returns>
|
|
||||
public OpenIddictClientWindowsBuilder SetAuthenticationTimeout(TimeSpan timeout) |
|
||||
=> Configure(options => options.AuthenticationTimeout = timeout); |
|
||||
|
|
||||
/// <summary>
|
|
||||
/// Sets the identifier used to represent the current application
|
|
||||
/// instance and redirect protocol activations when necessary.
|
|
||||
/// </summary>
|
|
||||
/// <param name="identifier">The identifier of the current instance.</param>
|
|
||||
/// <returns>The <see cref="OpenIddictClientWindowsBuilder"/>.</returns>
|
|
||||
[EditorBrowsable(EditorBrowsableState.Advanced)] |
|
||||
public OpenIddictClientWindowsBuilder SetInstanceIdentifier(string identifier) |
|
||||
{ |
|
||||
if (string.IsNullOrEmpty(identifier)) |
|
||||
{ |
|
||||
throw new ArgumentException(SR.FormatID0366(nameof(identifier)), nameof(identifier)); |
|
||||
} |
|
||||
|
|
||||
return Configure(options => options.InstanceIdentifier = identifier); |
|
||||
} |
|
||||
|
|
||||
/// <summary>
|
|
||||
/// Sets the base name of the pipe created by OpenIddict to enable
|
|
||||
/// inter-process communication and handle protocol activation redirections.
|
|
||||
/// </summary>
|
|
||||
/// <param name="name">The name of the pipe.</param>
|
|
||||
/// <returns>The <see cref="OpenIddictClientWindowsBuilder"/>.</returns>
|
|
||||
[EditorBrowsable(EditorBrowsableState.Advanced)] |
|
||||
public OpenIddictClientWindowsBuilder SetPipeName(string name) |
|
||||
{ |
|
||||
if (string.IsNullOrEmpty(name)) |
|
||||
{ |
|
||||
throw new ArgumentException(SR.FormatID0366(nameof(name)), nameof(name)); |
|
||||
} |
|
||||
|
|
||||
return Configure(options => options.PipeName = name); |
|
||||
} |
|
||||
|
|
||||
/// <summary>
|
|
||||
/// Sets the security policy applied to the pipe created by OpenIddict to enable
|
|
||||
/// inter-process communication and handle protocol activation redirections.
|
|
||||
/// </summary>
|
|
||||
/// <param name="security">The security policy applied to the pipe.</param>
|
|
||||
/// <returns>The <see cref="OpenIddictClientWindowsBuilder"/>.</returns>
|
|
||||
[EditorBrowsable(EditorBrowsableState.Advanced)] |
|
||||
public OpenIddictClientWindowsBuilder SetPipeSecurity(PipeSecurity security) |
|
||||
{ |
|
||||
if (security is null) |
|
||||
{ |
|
||||
throw new ArgumentNullException(nameof(security)); |
|
||||
} |
|
||||
|
|
||||
return Configure(options => options.PipeSecurity = security); |
|
||||
} |
|
||||
|
|
||||
/// <summary>
|
|
||||
/// Determines whether the specified object is equal to the current object.
|
|
||||
/// </summary>
|
|
||||
/// <param name="obj">The object to compare with the current object.</param>
|
|
||||
/// <returns><see langword="true"/> if the specified object is equal to the current object; otherwise, false.</returns>
|
|
||||
[EditorBrowsable(EditorBrowsableState.Never)] |
|
||||
public override bool Equals(object? obj) => base.Equals(obj); |
|
||||
|
|
||||
/// <summary>
|
|
||||
/// Serves as the default hash function.
|
|
||||
/// </summary>
|
|
||||
/// <returns>A hash code for the current object.</returns>
|
|
||||
[EditorBrowsable(EditorBrowsableState.Never)] |
|
||||
public override int GetHashCode() => base.GetHashCode(); |
|
||||
|
|
||||
/// <summary>
|
|
||||
/// Returns a string that represents the current object.
|
|
||||
/// </summary>
|
|
||||
/// <returns>A string that represents the current object.</returns>
|
|
||||
[EditorBrowsable(EditorBrowsableState.Never)] |
|
||||
public override string? ToString() => base.ToString(); |
|
||||
} |
|
||||
@ -1,128 +0,0 @@ |
|||||
/* |
|
||||
* Licensed under the Apache License, Version 2.0 (http://www.apache.org/licenses/LICENSE-2.0)
|
|
||||
* See https://github.com/openiddict/openiddict-core for more information concerning
|
|
||||
* the license and the contributors participating to this project. |
|
||||
*/ |
|
||||
|
|
||||
using System.ComponentModel; |
|
||||
using System.IO.Pipes; |
|
||||
using System.Runtime.CompilerServices; |
|
||||
using System.Security.AccessControl; |
|
||||
using System.Security.Principal; |
|
||||
using System.Text; |
|
||||
using Microsoft.Extensions.Hosting; |
|
||||
using Microsoft.Extensions.Options; |
|
||||
using Microsoft.IdentityModel.Tokens; |
|
||||
using OpenIddict.Extensions; |
|
||||
|
|
||||
#if !SUPPORTS_HOST_ENVIRONMENT
|
|
||||
using IHostEnvironment = Microsoft.Extensions.Hosting.IHostingEnvironment; |
|
||||
#endif
|
|
||||
|
|
||||
namespace OpenIddict.Client.Windows; |
|
||||
|
|
||||
/// <summary>
|
|
||||
/// Contains the methods required to ensure that the OpenIddict client configuration is valid.
|
|
||||
/// </summary>
|
|
||||
[EditorBrowsable(EditorBrowsableState.Advanced)] |
|
||||
public sealed class OpenIddictClientWindowsConfiguration : IConfigureOptions<OpenIddictClientOptions>, |
|
||||
IPostConfigureOptions<OpenIddictClientOptions>, |
|
||||
IPostConfigureOptions<OpenIddictClientWindowsOptions> |
|
||||
{ |
|
||||
private readonly IHostEnvironment _environment; |
|
||||
|
|
||||
/// <summary>
|
|
||||
/// Creates a new instance of the <see cref="OpenIddictClientWindowsConfiguration"/> class.
|
|
||||
/// </summary>
|
|
||||
/// <param name="environment">The host environment.</param>
|
|
||||
public OpenIddictClientWindowsConfiguration(IHostEnvironment environment) |
|
||||
=> _environment = environment ?? throw new ArgumentNullException(nameof(environment)); |
|
||||
|
|
||||
/// <inheritdoc/>
|
|
||||
public void Configure(OpenIddictClientOptions options) |
|
||||
{ |
|
||||
if (options is null) |
|
||||
{ |
|
||||
throw new ArgumentNullException(nameof(options)); |
|
||||
} |
|
||||
|
|
||||
// Register the built-in event handlers used by the OpenIddict Windows client components.
|
|
||||
options.Handlers.AddRange(OpenIddictClientWindowsHandlers.DefaultHandlers); |
|
||||
} |
|
||||
|
|
||||
/// <inheritdoc/>
|
|
||||
public void PostConfigure(string? name, OpenIddictClientOptions options) |
|
||||
{ |
|
||||
if (options is null) |
|
||||
{ |
|
||||
throw new ArgumentNullException(nameof(options)); |
|
||||
} |
|
||||
|
|
||||
// Ensure an explicit client URI was set when using the Windows integration.
|
|
||||
if (options.ClientUri is not { IsAbsoluteUri: true }) |
|
||||
{ |
|
||||
throw new InvalidOperationException(SR.GetResourceString(SR.ID0384)); |
|
||||
} |
|
||||
} |
|
||||
|
|
||||
/// <inheritdoc/>
|
|
||||
public void PostConfigure(string? name, OpenIddictClientWindowsOptions options) |
|
||||
{ |
|
||||
if (options is null) |
|
||||
{ |
|
||||
throw new ArgumentNullException(nameof(options)); |
|
||||
} |
|
||||
|
|
||||
// If no explicit instance identifier was specified, use a random GUID.
|
|
||||
if (string.IsNullOrEmpty(options.InstanceIdentifier)) |
|
||||
{ |
|
||||
options.InstanceIdentifier = Guid.NewGuid().ToString(); |
|
||||
} |
|
||||
|
|
||||
// If no explicit pipe name was specified, compute the SHA-256 hash of the
|
|
||||
// application name resolved from the host and use it as a unique identifier.
|
|
||||
//
|
|
||||
// Note: the pipe name is deliberately prefixed with "LOCAL\" to support
|
|
||||
// partial trust/sandboxed applications that are executed in an AppContainer
|
|
||||
// and cannot communicate with applications outside the sandbox container.
|
|
||||
if (string.IsNullOrEmpty(options.PipeName)) |
|
||||
{ |
|
||||
if (string.IsNullOrEmpty(_environment.ApplicationName)) |
|
||||
{ |
|
||||
throw new InvalidOperationException(SR.GetResourceString(SR.ID0386)); |
|
||||
} |
|
||||
|
|
||||
options.PipeName = $@"LOCAL\OpenIddict.Client.Windows\{
|
|
||||
Base64UrlEncoder.Encode(OpenIddictHelpers.ComputeSha256Hash( |
|
||||
Encoding.UTF8.GetBytes(_environment.ApplicationName))) |
|
||||
}";
|
|
||||
} |
|
||||
|
|
||||
// If no explicit pipe security policy was specified, grant the current user
|
|
||||
// full control over the created pipe and allow cross-process communication
|
|
||||
// between elevated and non-elevated processes. Note: if the process executes
|
|
||||
// inside an AppContainer, don't override the default OS pipe security policy
|
|
||||
// to allow all applications with the same identity to access the named pipe.
|
|
||||
if (options.PipeSecurity is null) |
|
||||
{ |
|
||||
using var identity = WindowsIdentity.GetCurrent(TokenAccessLevels.Query); |
|
||||
|
|
||||
if (!IsRunningInAppContainer(identity)) |
|
||||
{ |
|
||||
options.PipeSecurity = new PipeSecurity(); |
|
||||
options.PipeSecurity.SetOwner(identity.User!); |
|
||||
options.PipeSecurity.AddAccessRule(new PipeAccessRule(identity.User!, |
|
||||
PipeAccessRights.FullControl, AccessControlType.Allow)); |
|
||||
} |
|
||||
} |
|
||||
|
|
||||
[MethodImpl(MethodImplOptions.NoInlining)] |
|
||||
static bool IsRunningInAppContainer(WindowsIdentity identity) |
|
||||
#if SUPPORTS_WINDOWS_RUNTIME
|
|
||||
=> OpenIddictClientWindowsHelpers.IsWindowsRuntimeSupported() && |
|
||||
OpenIddictClientWindowsHelpers.HasAppContainerToken(identity); |
|
||||
#else
|
|
||||
=> false; |
|
||||
#endif
|
|
||||
} |
|
||||
} |
|
||||
@ -1,68 +0,0 @@ |
|||||
/* |
|
||||
* Licensed under the Apache License, Version 2.0 (http://www.apache.org/licenses/LICENSE-2.0)
|
|
||||
* See https://github.com/openiddict/openiddict-core for more information concerning
|
|
||||
* the license and the contributors participating to this project. |
|
||||
*/ |
|
||||
|
|
||||
using System.ComponentModel; |
|
||||
|
|
||||
namespace OpenIddict.Client.Windows; |
|
||||
|
|
||||
/// <summary>
|
|
||||
/// Contains a collection of event handler filters commonly used by the Windows handlers.
|
|
||||
/// </summary>
|
|
||||
[EditorBrowsable(EditorBrowsableState.Advanced)] |
|
||||
public static class OpenIddictClientWindowsHandlerFilters |
|
||||
{ |
|
||||
/// <summary>
|
|
||||
/// Represents a filter that excludes the associated handlers
|
|
||||
/// if no explicit nonce was attached to the authentication context.
|
|
||||
/// </summary>
|
|
||||
public sealed class RequireAuthenticationNonce : IOpenIddictClientHandlerFilter<ProcessAuthenticationContext> |
|
||||
{ |
|
||||
/// <inheritdoc/>
|
|
||||
public ValueTask<bool> IsActiveAsync(ProcessAuthenticationContext context) |
|
||||
{ |
|
||||
if (context is null) |
|
||||
{ |
|
||||
throw new ArgumentNullException(nameof(context)); |
|
||||
} |
|
||||
|
|
||||
return new(!string.IsNullOrEmpty(context.Nonce)); |
|
||||
} |
|
||||
} |
|
||||
|
|
||||
/// <summary>
|
|
||||
/// Represents a filter that excludes the associated handlers if no interactive user session was detected.
|
|
||||
/// </summary>
|
|
||||
public sealed class RequireInteractiveSession : IOpenIddictClientHandlerFilter<BaseContext> |
|
||||
{ |
|
||||
/// <inheritdoc/>
|
|
||||
public ValueTask<bool> IsActiveAsync(BaseContext context) |
|
||||
{ |
|
||||
if (context is null) |
|
||||
{ |
|
||||
throw new ArgumentNullException(nameof(context)); |
|
||||
} |
|
||||
|
|
||||
return new(Environment.UserInteractive); |
|
||||
} |
|
||||
} |
|
||||
|
|
||||
/// <summary>
|
|
||||
/// Represents a filter that excludes the associated handlers if no Windows activation was found.
|
|
||||
/// </summary>
|
|
||||
public sealed class RequireWindowsActivation : IOpenIddictClientHandlerFilter<BaseContext> |
|
||||
{ |
|
||||
/// <inheritdoc/>
|
|
||||
public ValueTask<bool> IsActiveAsync(BaseContext context) |
|
||||
{ |
|
||||
if (context is null) |
|
||||
{ |
|
||||
throw new ArgumentNullException(nameof(context)); |
|
||||
} |
|
||||
|
|
||||
return new(context.Transaction.GetWindowsActivation() is not null); |
|
||||
} |
|
||||
} |
|
||||
} |
|
||||
@ -1,125 +0,0 @@ |
|||||
/* |
|
||||
* Licensed under the Apache License, Version 2.0 (http://www.apache.org/licenses/LICENSE-2.0)
|
|
||||
* See https://github.com/openiddict/openiddict-core for more information concerning
|
|
||||
* the license and the contributors participating to this project. |
|
||||
*/ |
|
||||
|
|
||||
using System.ComponentModel; |
|
||||
using System.IO.Pipes; |
|
||||
using Microsoft.Extensions.Hosting; |
|
||||
using Microsoft.Extensions.Logging; |
|
||||
using Microsoft.Extensions.Options; |
|
||||
|
|
||||
namespace OpenIddict.Client.Windows; |
|
||||
|
|
||||
/// <summary>
|
|
||||
/// Contains the logic necessary to handle URI protocol activations that
|
|
||||
/// are redirected by other instances using inter-process communication.
|
|
||||
/// </summary>
|
|
||||
/// <remarks>
|
|
||||
/// Note: initial URI protocol activations are handled by <see cref="OpenIddictClientWindowsHandler"/>.
|
|
||||
/// </remarks>
|
|
||||
[EditorBrowsable(EditorBrowsableState.Never)] |
|
||||
public sealed class OpenIddictClientWindowsListener : BackgroundService |
|
||||
{ |
|
||||
private readonly ILogger<OpenIddictClientWindowsListener> _logger; |
|
||||
private readonly IOptionsMonitor<OpenIddictClientWindowsOptions> _options; |
|
||||
private readonly OpenIddictClientWindowsService _service; |
|
||||
|
|
||||
/// <summary>
|
|
||||
/// Creates a new instance of the <see cref="OpenIddictClientWindowsHandler"/> class.
|
|
||||
/// </summary>
|
|
||||
/// <param name="logger">The logger.</param>
|
|
||||
/// <param name="options">The OpenIddict client Windows integration options.</param>
|
|
||||
/// <param name="service">The OpenIddict client Windows service.</param>
|
|
||||
public OpenIddictClientWindowsListener( |
|
||||
ILogger<OpenIddictClientWindowsListener> logger, |
|
||||
IOptionsMonitor<OpenIddictClientWindowsOptions> options, |
|
||||
OpenIddictClientWindowsService service) |
|
||||
{ |
|
||||
_logger = logger ?? throw new ArgumentNullException(nameof(logger)); |
|
||||
_options = options ?? throw new ArgumentNullException(nameof(options)); |
|
||||
_service = service ?? throw new ArgumentNullException(nameof(service)); |
|
||||
} |
|
||||
|
|
||||
/// <inheritdoc/>
|
|
||||
protected override async Task ExecuteAsync(CancellationToken stoppingToken) |
|
||||
{ |
|
||||
do |
|
||||
{ |
|
||||
try |
|
||||
{ |
|
||||
using var buffer = new MemoryStream(); |
|
||||
using var reader = new BinaryReader(buffer); |
|
||||
|
|
||||
#if SUPPORTS_NAMED_PIPE_CONSTRUCTOR_WITH_ACL
|
|
||||
using var stream = new NamedPipeServerStream( |
|
||||
#elif SUPPORTS_NAMED_PIPE_STATIC_FACTORY_WITH_ACL
|
|
||||
using var stream = NamedPipeServerStreamAcl.Create( |
|
||||
#else
|
|
||||
using var stream = NamedPipeServerStreamConstructors.New( |
|
||||
#endif
|
|
||||
pipeName : $@"{_options.CurrentValue.PipeName}\{_options.CurrentValue.InstanceIdentifier}", |
|
||||
direction : PipeDirection.In, |
|
||||
maxNumberOfServerInstances: 1, |
|
||||
transmissionMode : PipeTransmissionMode.Message, |
|
||||
options : PipeOptions.Asynchronous, |
|
||||
inBufferSize : 0, |
|
||||
outBufferSize : 0, |
|
||||
pipeSecurity : _options.CurrentValue.PipeSecurity, |
|
||||
inheritability : HandleInheritability.None, |
|
||||
additionalAccessRights : default); |
|
||||
|
|
||||
// Wait for a writer to connect to the named pipe.
|
|
||||
await stream.WaitForConnectionAsync(stoppingToken); |
|
||||
|
|
||||
// Copy the content to the memory stream asynchronously and rewind it.
|
|
||||
await stream.CopyToAsync(buffer, bufferSize: 81_920, stoppingToken); |
|
||||
buffer.Seek(0L, SeekOrigin.Begin); |
|
||||
|
|
||||
// Process the inter-process notification based on its declared type.
|
|
||||
await (reader.ReadInt32() switch |
|
||||
{ |
|
||||
0x01 when GetProtocolActivation(reader) is OpenIddictClientWindowsActivation activation |
|
||||
=> _service.HandleProtocolActivationAsync(activation, stoppingToken), |
|
||||
|
|
||||
var value => throw new InvalidOperationException(SR.FormatID0387(value)) |
|
||||
}); |
|
||||
} |
|
||||
|
|
||||
// Ignore operation canceled exceptions when the host is shutting down.
|
|
||||
catch (OperationCanceledException) when (stoppingToken.IsCancellationRequested) |
|
||||
{ |
|
||||
} |
|
||||
|
|
||||
// Swallow all exceptions to ensure the service doesn't exit when encountering an exception.
|
|
||||
catch (Exception exception) |
|
||||
{ |
|
||||
_logger.LogWarning(exception, SR.GetResourceString(SR.ID6213)); |
|
||||
} |
|
||||
} |
|
||||
|
|
||||
while (!stoppingToken.IsCancellationRequested); |
|
||||
|
|
||||
static OpenIddictClientWindowsActivation GetProtocolActivation(BinaryReader reader) |
|
||||
{ |
|
||||
// Ensure the binary serialization format is supported.
|
|
||||
var version = reader.ReadInt32(); |
|
||||
if (version is not 0x01) |
|
||||
{ |
|
||||
throw new InvalidOperationException(SR.GetResourceString(SR.ID0388)); |
|
||||
} |
|
||||
|
|
||||
var value = reader.ReadString(); |
|
||||
if (string.IsNullOrEmpty(value) || !Uri.TryCreate(value, UriKind.Absolute, out Uri? uri)) |
|
||||
{ |
|
||||
throw new InvalidOperationException(SR.GetResourceString(SR.ID0388)); |
|
||||
} |
|
||||
|
|
||||
return new OpenIddictClientWindowsActivation(uri) |
|
||||
{ |
|
||||
IsActivationRedirected = true |
|
||||
}; |
|
||||
} |
|
||||
} |
|
||||
} |
|
||||
@ -1,56 +0,0 @@ |
|||||
/* |
|
||||
* Licensed under the Apache License, Version 2.0 (http://www.apache.org/licenses/LICENSE-2.0)
|
|
||||
* See https://github.com/openiddict/openiddict-core for more information concerning
|
|
||||
* the license and the contributors participating to this project. |
|
||||
*/ |
|
||||
|
|
||||
using System.IO.Pipes; |
|
||||
|
|
||||
#if !SUPPORTS_HOST_ENVIRONMENT
|
|
||||
using IHostEnvironment = Microsoft.Extensions.Hosting.IHostingEnvironment; |
|
||||
#endif
|
|
||||
|
|
||||
namespace OpenIddict.Client.Windows; |
|
||||
|
|
||||
/// <summary>
|
|
||||
/// Provides various settings needed to configure the OpenIddict Windows client integration.
|
|
||||
/// </summary>
|
|
||||
public sealed class OpenIddictClientWindowsOptions |
|
||||
{ |
|
||||
/// <summary>
|
|
||||
/// Gets or sets the timeout after which authentication demands
|
|
||||
/// that are not completed are automatically aborted by OpenIddict.
|
|
||||
/// </summary>
|
|
||||
public TimeSpan AuthenticationTimeout { get; set; } = TimeSpan.FromMinutes(10); |
|
||||
|
|
||||
/// <summary>
|
|
||||
/// Gets or sets a boolean indicating whether protocol activation processing should be
|
|
||||
/// disabled, which can be used to offload this task to a separate dedicated executable.
|
|
||||
/// </summary>
|
|
||||
public bool DisableProtocolActivationProcessing { get; set; } |
|
||||
|
|
||||
/// <summary>
|
|
||||
/// Gets or sets the identifier used to represent the current application
|
|
||||
/// instance and redirect protocol activations when necessary.
|
|
||||
/// </summary>
|
|
||||
public string? InstanceIdentifier { get; set; } |
|
||||
|
|
||||
/// <summary>
|
|
||||
/// Gets or sets the base name of the pipe created by OpenIddict to enable
|
|
||||
/// inter-process communication and handle protocol activation redirections.
|
|
||||
/// </summary>
|
|
||||
/// <remarks>
|
|
||||
/// If no value is explicitly set, a default name is automatically computed.
|
|
||||
/// </remarks>
|
|
||||
public string PipeName { get; set; } = default!; |
|
||||
|
|
||||
/// <summary>
|
|
||||
/// Gets or sets the security policy applied to the pipe created by OpenIddict
|
|
||||
/// to enable inter-process communication and handle protocol activation redirections.
|
|
||||
/// </summary>
|
|
||||
/// <remarks>
|
|
||||
/// If no value is explicitly set, a default policy is automatically created
|
|
||||
/// (unless the application is running inside an AppContainer sandbox).
|
|
||||
/// </remarks>
|
|
||||
public PipeSecurity PipeSecurity { get; set; } = default!; |
|
||||
} |
|
||||
@ -1,92 +0,0 @@ |
|||||
/* |
|
||||
* Licensed under the Apache License, Version 2.0 (http://www.apache.org/licenses/LICENSE-2.0)
|
|
||||
* See https://github.com/openiddict/openiddict-core for more information concerning
|
|
||||
* the license and the contributors participating to this project. |
|
||||
*/ |
|
||||
|
|
||||
using System.ComponentModel; |
|
||||
using Microsoft.Extensions.DependencyInjection; |
|
||||
|
|
||||
namespace OpenIddict.Client.Windows; |
|
||||
|
|
||||
/// <summary>
|
|
||||
/// Contains the logic necessary to handle URI protocol activations (that
|
|
||||
/// are typically resolved when launching the application or redirected
|
|
||||
/// by other instances using inter-process communication).
|
|
||||
/// </summary>
|
|
||||
public sealed class OpenIddictClientWindowsService |
|
||||
{ |
|
||||
private readonly IServiceProvider _provider; |
|
||||
|
|
||||
/// <summary>
|
|
||||
/// Creates a new instance of the <see cref="OpenIddictClientWindowsService"/> class.
|
|
||||
/// </summary>
|
|
||||
/// <param name="provider">The service provider.</param>
|
|
||||
/// <exception cref="ArgumentNullException"><paramref name="provider"/> is <see langword="null"/>.</exception>
|
|
||||
public OpenIddictClientWindowsService(IServiceProvider provider) |
|
||||
=> _provider = provider ?? throw new ArgumentNullException(nameof(provider)); |
|
||||
|
|
||||
/// <summary>
|
|
||||
/// Handles the specified protocol activation.
|
|
||||
/// </summary>
|
|
||||
/// <param name="activation">The protocol activation details.</param>
|
|
||||
/// <param name="cancellationToken">The <see cref="CancellationToken"/> that can be used to abort the operation.</param>
|
|
||||
/// <returns>A <see cref="Task"/> that can be used to monitor the asynchronous operation.</returns>
|
|
||||
/// <exception cref="ArgumentNullException"><paramref name="activation"/> is <see langword="null"/>.</exception>
|
|
||||
[EditorBrowsable(EditorBrowsableState.Advanced)] |
|
||||
public async Task HandleProtocolActivationAsync( |
|
||||
OpenIddictClientWindowsActivation activation, CancellationToken cancellationToken = default) |
|
||||
{ |
|
||||
if (activation is null) |
|
||||
{ |
|
||||
throw new ArgumentNullException(nameof(activation)); |
|
||||
} |
|
||||
|
|
||||
cancellationToken.ThrowIfCancellationRequested(); |
|
||||
|
|
||||
var scope = _provider.CreateScope(); |
|
||||
|
|
||||
try |
|
||||
{ |
|
||||
var dispatcher = scope.ServiceProvider.GetRequiredService<IOpenIddictClientDispatcher>(); |
|
||||
var factory = scope.ServiceProvider.GetRequiredService<IOpenIddictClientFactory>(); |
|
||||
|
|
||||
// Create a client transaction and store the protocol activation details so they can be
|
|
||||
// retrieved by the Windows-specific client event handlers that need to access them.
|
|
||||
var transaction = await factory.CreateTransactionAsync(); |
|
||||
transaction.SetProperty(typeof(OpenIddictClientWindowsActivation).FullName!, activation); |
|
||||
|
|
||||
var context = new ProcessRequestContext(transaction) |
|
||||
{ |
|
||||
CancellationToken = cancellationToken |
|
||||
}; |
|
||||
|
|
||||
await dispatcher.DispatchAsync(context); |
|
||||
|
|
||||
if (context.IsRejected) |
|
||||
{ |
|
||||
await dispatcher.DispatchAsync(new ProcessErrorContext(transaction) |
|
||||
{ |
|
||||
CancellationToken = cancellationToken, |
|
||||
Error = context.Error ?? Errors.InvalidRequest, |
|
||||
ErrorDescription = context.ErrorDescription, |
|
||||
ErrorUri = context.ErrorUri, |
|
||||
Response = new OpenIddictResponse() |
|
||||
}); |
|
||||
} |
|
||||
} |
|
||||
|
|
||||
finally |
|
||||
{ |
|
||||
if (scope is IAsyncDisposable disposable) |
|
||||
{ |
|
||||
await disposable.DisposeAsync(); |
|
||||
} |
|
||||
|
|
||||
else |
|
||||
{ |
|
||||
scope.Dispose(); |
|
||||
} |
|
||||
} |
|
||||
} |
|
||||
} |
|
||||
Loading…
Reference in new issue