oauth
parent
849aa6f407
commit
4b8c5cc984
@ -0,0 +1,41 @@
|
|||||||
|
|
||||||
|
using System;
|
||||||
|
using System.IO;
|
||||||
|
using System.Web;
|
||||||
|
using Microsoft.AspNet.DataProtection.Infrastructure;
|
||||||
|
using Microsoft.Extensions.DependencyInjection;
|
||||||
|
|
||||||
|
namespace Yavsc
|
||||||
|
{
|
||||||
|
|
||||||
|
public partial class Startup
|
||||||
|
{
|
||||||
|
public void ConfigureProtectionServices(IServiceCollection services)
|
||||||
|
{
|
||||||
|
|
||||||
|
services.AddDataProtection();
|
||||||
|
services.Add(ServiceDescriptor.Singleton(typeof(IApplicationDiscriminator),
|
||||||
|
typeof(SystemWebApplicationDiscriminator)));
|
||||||
|
|
||||||
|
services.ConfigureDataProtection(configure =>
|
||||||
|
{
|
||||||
|
configure.SetApplicationName(Configuration["Site:Title"]);
|
||||||
|
configure.SetDefaultKeyLifetime(TimeSpan.FromDays(45));
|
||||||
|
configure.PersistKeysToFileSystem(
|
||||||
|
new DirectoryInfo(Configuration["DataProtection:Keys:Dir"]));
|
||||||
|
});
|
||||||
|
|
||||||
|
}
|
||||||
|
private sealed class SystemWebApplicationDiscriminator : IApplicationDiscriminator
|
||||||
|
{
|
||||||
|
private readonly Lazy<string> _lazyDiscriminator = new Lazy<string>(GetAppDiscriminatorCore);
|
||||||
|
|
||||||
|
public string Discriminator => _lazyDiscriminator.Value;
|
||||||
|
|
||||||
|
private static string GetAppDiscriminatorCore()
|
||||||
|
{
|
||||||
|
return HttpRuntime.AppDomainAppId;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
@ -0,0 +1,174 @@
|
|||||||
|
using System;
|
||||||
|
using System.Security.Claims;
|
||||||
|
using Microsoft.AspNet.Authentication;
|
||||||
|
using Microsoft.AspNet.Authentication.OAuth;
|
||||||
|
using Microsoft.AspNet.Builder;
|
||||||
|
using Microsoft.AspNet.Http;
|
||||||
|
using Microsoft.Extensions.DependencyInjection;
|
||||||
|
using Microsoft.Extensions.OptionsModel;
|
||||||
|
using Microsoft.Extensions.WebEncoders;
|
||||||
|
using OAuth.AspNet.AuthServer;
|
||||||
|
using Yavsc.Auth;
|
||||||
|
using Yavsc.Models;
|
||||||
|
|
||||||
|
namespace Yavsc
|
||||||
|
{
|
||||||
|
|
||||||
|
public partial class Startup
|
||||||
|
{
|
||||||
|
private void ConfigureOAuthServices(IServiceCollection services)
|
||||||
|
{
|
||||||
|
services.Configure<SharedAuthenticationOptions>(options => options.SignInScheme = Constants.ExternalAuthenticationSheme);
|
||||||
|
services.AddAuthentication(options =>
|
||||||
|
{
|
||||||
|
options.SignInScheme = Constants.ExternalAuthenticationSheme;
|
||||||
|
});
|
||||||
|
services.Add(ServiceDescriptor.Singleton(typeof(IOptions<OAuth2AppSettings>), typeof(OptionsManager<OAuth2AppSettings>)));
|
||||||
|
// used by the YavscGoogleOAuth middelware (TODO drop it)
|
||||||
|
services.AddTransient<Microsoft.Extensions.WebEncoders.UrlEncoder, UrlEncoder>();
|
||||||
|
/* Obsolete:
|
||||||
|
var keyParamsFileInfo =
|
||||||
|
new FileInfo(Configuration["DataProtection:RSAParamFile"]);
|
||||||
|
var keyParams = (keyParamsFileInfo.Exists) ?
|
||||||
|
RSAKeyUtils.GetKeyParameters(keyParamsFileInfo.Name) :
|
||||||
|
RSAKeyUtils.GenerateKeyAndSave(keyParamsFileInfo.Name);
|
||||||
|
key = new RsaSecurityKey(keyParams);
|
||||||
|
|
||||||
|
services.Configure<TokenAuthOptions>(
|
||||||
|
to =>
|
||||||
|
{
|
||||||
|
to.Audience = Configuration["Site:Audience"];
|
||||||
|
to.Issuer = Configuration["Site:Authority"];
|
||||||
|
to.SigningCredentials =
|
||||||
|
new SigningCredentials(key, SecurityAlgorithms.RsaSha256Signature);
|
||||||
|
}
|
||||||
|
); */
|
||||||
|
}
|
||||||
|
private void ConfigureOAuthApp(IApplicationBuilder app)
|
||||||
|
{
|
||||||
|
app.UseIdentity();
|
||||||
|
// External authentication shared cookie:
|
||||||
|
app.UseCookieAuthentication(options =>
|
||||||
|
{
|
||||||
|
options.AuthenticationScheme = Constants.ExternalAuthenticationSheme;
|
||||||
|
options.AutomaticAuthenticate = false;
|
||||||
|
options.ExpireTimeSpan = TimeSpan.FromMinutes(5);
|
||||||
|
options.LoginPath = new PathString(Constants.LoginPath.Substring(1));
|
||||||
|
});
|
||||||
|
|
||||||
|
var gvents = new OAuthEvents();
|
||||||
|
var googleOptions = new YavscGoogleOptions
|
||||||
|
{
|
||||||
|
ClientId = Configuration["Authentication:Google:ClientId"],
|
||||||
|
ClientSecret = Configuration["Authentication:Google:ClientSecret"],
|
||||||
|
AccessType = "offline",
|
||||||
|
SaveTokensAsClaims = true,
|
||||||
|
UserInformationEndpoint = "https://www.googleapis.com/plus/v1/people/me",
|
||||||
|
Events = new OAuthEvents
|
||||||
|
{
|
||||||
|
OnCreatingTicket = async context =>
|
||||||
|
{
|
||||||
|
using (var serviceScope = app.ApplicationServices.GetRequiredService<IServiceScopeFactory>()
|
||||||
|
.CreateScope())
|
||||||
|
{
|
||||||
|
var gcontext = context as GoogleOAuthCreatingTicketContext;
|
||||||
|
context.Identity.AddClaim(new Claim(YavscClaimTypes.GoogleUserId, gcontext.GoogleUserId));
|
||||||
|
var service =
|
||||||
|
serviceScope.ServiceProvider.GetService<ApplicationDbContext>();
|
||||||
|
await service.StoreTokenAsync(gcontext.GoogleUserId, context.TokenResponse);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
};
|
||||||
|
googleOptions.Scope.Add("https://www.googleapis.com/auth/calendar");
|
||||||
|
app.UseMiddleware<Yavsc.Auth.GoogleMiddleware>(googleOptions);
|
||||||
|
|
||||||
|
// Facebook
|
||||||
|
app.UseFacebookAuthentication(options =>
|
||||||
|
{
|
||||||
|
options.AppId = Configuration["Authentication:Facebook:AppId"];
|
||||||
|
options.AppSecret = Configuration["Authentication:Facebook:AppSecret"];
|
||||||
|
options.Scope.Add("email");
|
||||||
|
options.UserInformationEndpoint = "https://graph.facebook.com/v2.5/me?fields=id,name,email,first_name,last_name";
|
||||||
|
});
|
||||||
|
/* Generic OAuth (here GitHub): options.Notifications = new OAuthAuthenticationNotifications
|
||||||
|
{
|
||||||
|
OnGetUserInformationAsync = async context =>
|
||||||
|
{
|
||||||
|
// Get the GitHub user
|
||||||
|
HttpRequestMessage userRequest = new HttpRequestMessage(HttpMethod.Get, context.Options.UserInformationEndpoint);
|
||||||
|
userRequest.Headers.Authorization = new AuthenticationHeaderValue("Bearer", context.AccessToken);
|
||||||
|
userRequest.Headers.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));
|
||||||
|
HttpResponseMessage userResponse = await context.Backchannel.SendAsync(userRequest, context.HttpContext.RequestAborted);
|
||||||
|
userResponse.EnsureSuccessStatusCode();
|
||||||
|
var text = await userResponse.Content.ReadAsStringAsync();
|
||||||
|
JObject user = JObject.Parse(text);
|
||||||
|
|
||||||
|
var identity = new ClaimsIdentity(
|
||||||
|
context.Options.AuthenticationType,
|
||||||
|
ClaimsIdentity.DefaultNameClaimType,
|
||||||
|
ClaimsIdentity.DefaultRoleClaimType);
|
||||||
|
|
||||||
|
JToken value;
|
||||||
|
var id = user.TryGetValue("id", out value) ? value.ToString() : null;
|
||||||
|
if (!string.IsNullOrEmpty(id))
|
||||||
|
{
|
||||||
|
identity.AddClaim(new Claim(ClaimTypes.NameIdentifier, id, ClaimValueTypes.String, context.Options.AuthenticationType));
|
||||||
|
}
|
||||||
|
var userName = user.TryGetValue("login", out value) ? value.ToString() : null;
|
||||||
|
if (!string.IsNullOrEmpty(userName))
|
||||||
|
{
|
||||||
|
identity.AddClaim(new Claim(ClaimsIdentity.DefaultNameClaimType, userName, ClaimValueTypes.String, context.Options.AuthenticationType));
|
||||||
|
}
|
||||||
|
var name = user.TryGetValue("name", out value) ? value.ToString() : null;
|
||||||
|
if (!string.IsNullOrEmpty(name))
|
||||||
|
{
|
||||||
|
identity.AddClaim(new Claim("urn:github:name", name, ClaimValueTypes.String, context.Options.AuthenticationType));
|
||||||
|
}
|
||||||
|
var link = user.TryGetValue("url", out value) ? value.ToString() : null;
|
||||||
|
if (!string.IsNullOrEmpty(link))
|
||||||
|
{
|
||||||
|
identity.AddClaim(new Claim("urn:github:url", link, ClaimValueTypes.String, context.Options.AuthenticationType));
|
||||||
|
}
|
||||||
|
|
||||||
|
context.Identity = identity;
|
||||||
|
}
|
||||||
|
}; */
|
||||||
|
app.UseOAuthAuthorizationServer(
|
||||||
|
|
||||||
|
options =>
|
||||||
|
{
|
||||||
|
options.AuthorizeEndpointPath = new PathString(Constants.AuthorizePath.Substring(1));
|
||||||
|
options.TokenEndpointPath = new PathString(Constants.TokenPath.Substring(1));
|
||||||
|
options.ApplicationCanDisplayErrors = true;
|
||||||
|
|
||||||
|
#if DEBUG
|
||||||
|
options.AllowInsecureHttp = true;
|
||||||
|
#endif
|
||||||
|
|
||||||
|
options.Provider = new OAuthAuthorizationServerProvider
|
||||||
|
{
|
||||||
|
OnValidateClientRedirectUri = ValidateClientRedirectUri,
|
||||||
|
OnValidateClientAuthentication = ValidateClientAuthentication,
|
||||||
|
OnGrantResourceOwnerCredentials = GrantResourceOwnerCredentials,
|
||||||
|
OnGrantClientCredentials = GrantClientCredetails
|
||||||
|
};
|
||||||
|
|
||||||
|
options.AuthorizationCodeProvider = new AuthenticationTokenProvider
|
||||||
|
{
|
||||||
|
OnCreate = CreateAuthenticationCode,
|
||||||
|
OnReceive = ReceiveAuthenticationCode,
|
||||||
|
};
|
||||||
|
|
||||||
|
options.RefreshTokenProvider = new AuthenticationTokenProvider
|
||||||
|
{
|
||||||
|
OnCreate = CreateRefreshToken,
|
||||||
|
OnReceive = ReceiveRefreshToken,
|
||||||
|
};
|
||||||
|
|
||||||
|
options.AutomaticAuthenticate = false;
|
||||||
|
}
|
||||||
|
);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
@ -0,0 +1,32 @@
|
|||||||
|
@using Microsoft.AspNet.Http.Authentication
|
||||||
|
@using Microsoft.AspNet.WebUtilities
|
||||||
|
@using System.Security.Claims
|
||||||
|
@{
|
||||||
|
AuthenticationManager authentication = Context.Authentication;
|
||||||
|
ClaimsPrincipal principal = authentication.AuthenticateAsync(Constants.ApplicationAuthenticationSheme).Result;
|
||||||
|
string[] scopes = QueryHelpers.ParseQuery(Context.Request.QueryString.Value)["scope"];
|
||||||
|
}
|
||||||
|
<!DOCTYPE html>
|
||||||
|
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||||
|
<head>
|
||||||
|
<title>Authorize</title>
|
||||||
|
</head>
|
||||||
|
<body>
|
||||||
|
<h1>Authorization Server</h1>
|
||||||
|
<h2>OAuth2 Authorize</h2>
|
||||||
|
<form method="POST">
|
||||||
|
<p>Hello, @principal.Identity.Name</p>
|
||||||
|
<p>A third party application want to do the following on your behalf:</p>
|
||||||
|
<ul>
|
||||||
|
@foreach (var scope in scopes)
|
||||||
|
{
|
||||||
|
<li>@scope</li>
|
||||||
|
}
|
||||||
|
</ul>
|
||||||
|
<p>
|
||||||
|
<input type="submit" name="submit.Grant" value="Grant" />
|
||||||
|
<input type="submit" name="submit.Login" value="Sign in as different user" />
|
||||||
|
</p>
|
||||||
|
</form>
|
||||||
|
</body>
|
||||||
|
</html>
|
||||||
@ -0,0 +1,20 @@
|
|||||||
|
@using Microsoft.AspNet.Http
|
||||||
|
@using System
|
||||||
|
@using System.Security.Claims
|
||||||
|
@{
|
||||||
|
var error = Context.Items["oauth.Error"];
|
||||||
|
var errorDescription = Context.Items["oauth.ErrorDescription"];
|
||||||
|
var errorUri = Context.Items["oauth.ErrorUri"];
|
||||||
|
}
|
||||||
|
<!DOCTYPE html>
|
||||||
|
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||||
|
<head>
|
||||||
|
<title>Authorize Error</title>
|
||||||
|
</head>
|
||||||
|
<body>
|
||||||
|
<h1>Katana.Sandbox.WebServer</h1>
|
||||||
|
<h2>OAuth2 Authorize Error</h2>
|
||||||
|
<p>Error: @error</p>
|
||||||
|
<p>@errorDescription</p>
|
||||||
|
</body>
|
||||||
|
</html>
|
||||||
File diff suppressed because it is too large
Load Diff
@ -1 +1 @@
|
|||||||
Subproject commit 3ce8e249032e49263b4d4e4c9009fd13a39f6415
|
Subproject commit 1fdf3cb799188891aa0fcb924cb7888d6d1bd92d
|
||||||
Loading…
Reference in New Issue