-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
17 changed files
with
2,810 additions
and
20 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
150 changes: 150 additions & 0 deletions
150
TeachingRecordSystem/src/TeachingRecordSystem.AuthorizeAccess/Controllers/OidcController.cs
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,150 @@ | ||
| using System.Security.Claims; | ||
| using Microsoft.AspNetCore; | ||
| using Microsoft.AspNetCore.Authentication; | ||
| using Microsoft.AspNetCore.Authorization; | ||
| using Microsoft.AspNetCore.Mvc; | ||
| using Microsoft.IdentityModel.Tokens; | ||
| using OpenIddict.Abstractions; | ||
| using OpenIddict.Server.AspNetCore; | ||
| using TeachingRecordSystem.AuthorizeAccess.Infrastructure.Security; | ||
| using TeachingRecordSystem.Core.DataStore.Postgres; | ||
| using static OpenIddict.Abstractions.OpenIddictConstants; | ||
|
|
||
| namespace TeachingRecordSystem.AuthorizeAccess.Controllers; | ||
|
|
||
| public class OidcController( | ||
| TrsDbContext dbContext, | ||
| IOpenIddictAuthorizationManager authorizationManager, | ||
| IOpenIddictScopeManager scopeManager) : Controller | ||
| { | ||
| [HttpGet("~/connect/authorize")] | ||
| [HttpPost("~/connect/authorize")] | ||
| [IgnoreAntiforgeryToken] | ||
| public async Task<IActionResult> Authorize() | ||
| { | ||
| var request = HttpContext.GetOpenIddictServerRequest() ?? | ||
| throw new InvalidOperationException("The OpenID Connect request cannot be retrieved."); | ||
|
|
||
| var clientId = request.ClientId!; | ||
| var client = await dbContext.ApplicationUsers.SingleAsync(u => u.ClientId == clientId); | ||
|
|
||
| var childAuthenticationScheme = AuthenticationSchemes.MatchToTeachingRecord; | ||
| var authenticateResult = await HttpContext.AuthenticateAsync(childAuthenticationScheme); | ||
|
|
||
| if (!authenticateResult.Succeeded) | ||
| { | ||
| var parameters = Request.HasFormContentType ? Request.Form.ToList() : Request.Query.ToList(); | ||
|
|
||
|
|
||
| var authenticationProperties = new AuthenticationProperties() | ||
| { | ||
| RedirectUri = Request.PathBase + Request.Path + QueryString.Create(parameters) | ||
| }; | ||
| authenticationProperties.Items.Add("OneLoginAuthenticationScheme", client.OneLoginAuthenticationSchemeName); | ||
|
|
||
| return Challenge(authenticationProperties, childAuthenticationScheme); | ||
| } | ||
|
|
||
| var user = authenticateResult.Principal; | ||
| var subject = user.FindFirstValue(ClaimTypes.Subject) ?? | ||
| throw new InvalidOperationException($"Principal does not contain a '{ClaimTypes.Subject}' claim."); | ||
|
|
||
| var authorizations = await authorizationManager.FindAsync( | ||
| subject: subject, | ||
| client: client.UserId.ToString(), | ||
| status: Statuses.Valid, | ||
| type: AuthorizationTypes.Permanent, | ||
| scopes: request.GetScopes()).ToListAsync(); | ||
|
|
||
| var identity = new ClaimsIdentity( | ||
| claims: user.Claims, | ||
| authenticationType: TokenValidationParameters.DefaultAuthenticationType, | ||
| nameType: ClaimTypes.Subject, | ||
| roleType: null); | ||
|
|
||
| identity.SetScopes(request.GetScopes()); | ||
| identity.SetResources(await scopeManager.ListResourcesAsync(identity.GetScopes()).ToListAsync()); | ||
|
|
||
| var authorization = authorizations.LastOrDefault(); | ||
| authorization ??= await authorizationManager.CreateAsync( | ||
| identity: identity, | ||
| subject: subject, | ||
| client: client.UserId.ToString(), | ||
| type: AuthorizationTypes.Permanent, | ||
| scopes: identity.GetScopes()); | ||
|
|
||
| identity.SetAuthorizationId(await authorizationManager.GetIdAsync(authorization)); | ||
| identity.SetDestinations(GetDestinations); | ||
|
|
||
| return SignIn(new ClaimsPrincipal(identity), OpenIddictServerAspNetCoreDefaults.AuthenticationScheme); | ||
| } | ||
|
|
||
| [HttpPost("~/connect/token")] | ||
| [IgnoreAntiforgeryToken] | ||
| [Produces("application/json")] | ||
| public async Task<IActionResult> Token() | ||
| { | ||
| var request = HttpContext.GetOpenIddictServerRequest() ?? | ||
| throw new InvalidOperationException("The OpenID Connect request cannot be retrieved."); | ||
|
|
||
| if (request.IsAuthorizationCodeGrantType() || request.IsRefreshTokenGrantType()) | ||
| { | ||
| var result = await HttpContext.AuthenticateAsync(OpenIddictServerAspNetCoreDefaults.AuthenticationScheme); | ||
|
|
||
| var identity = new ClaimsIdentity( | ||
| result.Principal!.Claims, | ||
| authenticationType: TokenValidationParameters.DefaultAuthenticationType, | ||
| nameType: ClaimTypes.Subject, | ||
| roleType: null); | ||
|
|
||
| identity.SetDestinations(GetDestinations); | ||
|
|
||
| return SignIn(new ClaimsPrincipal(identity), OpenIddictServerAspNetCoreDefaults.AuthenticationScheme); | ||
| } | ||
|
|
||
| throw new InvalidOperationException("The specified grant type is not supported."); | ||
| } | ||
|
|
||
| [Authorize(AuthenticationSchemes = OpenIddictServerAspNetCoreDefaults.AuthenticationScheme)] | ||
| [HttpGet("~/connect/userinfo")] | ||
| [HttpPost("~/connect/userinfo")] | ||
| [Produces("application/json")] | ||
| public IActionResult UserInfo() | ||
| { | ||
| var claims = new Dictionary<string, object>(StringComparer.Ordinal) | ||
| { | ||
| [ClaimTypes.Subject] = User.GetClaim(ClaimTypes.Subject)!, | ||
| [ClaimTypes.Trn] = User.GetClaim(ClaimTypes.Trn)! | ||
| }; | ||
|
|
||
| if (User.HasScope(Scopes.Email)) | ||
| { | ||
| claims[ClaimTypes.Email] = User.GetClaim(ClaimTypes.Email)!; | ||
| } | ||
|
|
||
| return Ok(claims); | ||
| } | ||
|
|
||
| private static IEnumerable<string> GetDestinations(Claim claim) | ||
| { | ||
| switch (claim.Type) | ||
| { | ||
| case ClaimTypes.Subject: | ||
| case ClaimTypes.Trn: | ||
| yield return Destinations.AccessToken; | ||
| yield return Destinations.IdentityToken; | ||
| yield break; | ||
|
|
||
| case ClaimTypes.Email: | ||
| if (claim.Subject!.HasScope(Scopes.Profile)) | ||
| { | ||
| yield return Destinations.IdentityToken; | ||
| } | ||
|
|
||
| yield break; | ||
|
|
||
| default: | ||
| yield break; | ||
| } | ||
| } | ||
| } |
23 changes: 23 additions & 0 deletions
23
...System/src/TeachingRecordSystem.AuthorizeAccess/Infrastructure/Oidc/ApplicationManager.cs
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,23 @@ | ||
| using Microsoft.Extensions.Options; | ||
| using OpenIddict.Abstractions; | ||
| using OpenIddict.Core; | ||
| using OpenIddict.EntityFrameworkCore.Models; | ||
|
|
||
| namespace TeachingRecordSystem.AuthorizeAccess.Infrastructure.Oidc; | ||
|
|
||
| public class ApplicationManager : OpenIddictApplicationManager<OpenIddictEntityFrameworkCoreApplication<Guid>> | ||
| { | ||
| public ApplicationManager( | ||
| IOpenIddictApplicationCache<OpenIddictEntityFrameworkCoreApplication<Guid>> cache, | ||
| ILogger<OpenIddictApplicationManager<OpenIddictEntityFrameworkCoreApplication<Guid>>> logger, | ||
| IOptionsMonitor<OpenIddictCoreOptions> options, | ||
| IOpenIddictApplicationStoreResolver resolver) : base(cache, logger, options, resolver) | ||
| { | ||
| } | ||
|
|
||
| protected override ValueTask<string> ObfuscateClientSecretAsync(string secret, CancellationToken cancellationToken = default) => | ||
| throw new NotSupportedException(); | ||
|
|
||
| protected override ValueTask<bool> ValidateClientSecretAsync(string secret, string comparand, CancellationToken cancellationToken = default) => | ||
| ValueTask.FromResult(secret.Equals(comparand)); | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.