fixe l'impact OAuth sheme

Yavsc/ApiController/AccountController.cs

@@ -118,5 +118,22 @@ namespace Yavsc.WebApi.Controllers
             base.Dispose(disposing);
         }
 
+        [HttpGet("~/api/me"),Produces("application/json")]
+        public async Task<IActionResult> Me ()
+        {
+            
+            if (User==null) return new BadRequestObjectResult(
+                    new {
+                        error = "no user" 
+                    });
+            var uid = User.GetUserId();
+            if (uid == null) 
+                return new BadRequestObjectResult(
+                    new {
+                        error = "not identified" 
+                    });
+            return Ok(await UserManager.FindByIdAsync(uid));
+        }
+
     }
 }

Yavsc/Constants.cs

@@ -13,7 +13,7 @@ namespace Yavsc
         public const string ExternalLoginPath = "~/extsign";
         public const string LogoutPath = "~/signout";
         public const string MePath = "~/api/Me";
-        public const string ExternalAuthenticationSheme = "ExternalCookie";
+        
         public const string ApplicationAuthenticationSheme = "ServerCookie";
         public static readonly Scope[] SiteScopes = { 
             new Scope { Id = "profile", Description = "Your profile informations" },  

Yavsc/Controllers/AccountController.cs

@@ -129,7 +129,7 @@ namespace Yavsc.Controllers
                 var result = await _signInManager.PasswordSignInAsync(model.UserName, model.Password, model.RememberMe, lockoutOnFailure: false);
                 if (result.Succeeded)
                 {
-                    return RedirectToLocal(model.ReturnUrl);
+                    return Redirect(model.ReturnUrl);
                 }
                 if (result.RequiresTwoFactor)
                 {
@@ -219,7 +219,7 @@ namespace Yavsc.Controllers
             {
                 _logger.LogInformation(5, "User logged in with {Name} provider.", info.LoginProvider);
 
-                return RedirectToLocal(returnUrl);
+                return Redirect(returnUrl);
             }
             if (result.RequiresTwoFactor)
             {
@@ -286,7 +286,7 @@ namespace Yavsc.Controllers
                         await _signInManager.SignInAsync(user, isPersistent: false);
                         _logger.LogInformation(6, "User created an account using {Name} provider.", info.LoginProvider);
 
-                        return RedirectToLocal(returnUrl);
+                        return Redirect(returnUrl);
                     }
                 }
                 AddErrors(result);
@@ -489,7 +489,8 @@ namespace Yavsc.Controllers
             if (result.Succeeded)
             {
                 ViewData["StatusMessage"] = "Your code was verified";
-                return RedirectToLocal(model.ReturnUrl);
+                _logger.LogInformation($"Signed in. returning to {model.ReturnUrl}");
+                return Redirect(model.ReturnUrl);
             }
             if (result.IsLockedOut)
             {
@@ -543,17 +544,7 @@ namespace Yavsc.Controllers
             return await _userManager.FindByIdAsync(HttpContext.User.GetUserId());
         }
 
-        private IActionResult RedirectToLocal(string returnUrl)
-        {
-            if (Url.IsLocalUrl(returnUrl))
-            {
-                return Redirect(returnUrl);
-            }
-            else
-            {
-                return RedirectToAction(nameof(HomeController.Index), "Home");
-            }
-        }
+       
 
         #endregion
     }

Yavsc/Startup/Startup.OAuth.cs

@@ -20,7 +20,7 @@ namespace Yavsc
     {
         private void ConfigureOAuthServices(IServiceCollection services)
         {
-            services.Configure<SharedAuthenticationOptions>(options => options.SignInScheme = Constants.ExternalAuthenticationSheme);
+            services.Configure<SharedAuthenticationOptions>(options => options.SignInScheme = Constants.ApplicationAuthenticationSheme);
             
             services.Add(ServiceDescriptor.Singleton(typeof(IOptions<OAuth2AppSettings>), typeof(OptionsManager<OAuth2AppSettings>)));
             // used by the YavscGoogleOAuth middelware (TODO drop it)
@@ -62,14 +62,14 @@ namespace Yavsc
                     option.Cookies.ApplicationCookie.LoginPath = new PathString(Constants.LoginPath.Substring(1));
                     option.Cookies.ApplicationCookie.AccessDeniedPath = new PathString(Constants.AccessDeniedPath.Substring(1));
                     option.Cookies.ApplicationCookie.AutomaticAuthenticate = true;
-                    option.Cookies.ApplicationCookie.AuthenticationScheme = Constants.ApplicationAuthenticationSheme;
-                    option.Cookies.ApplicationCookieAuthenticationScheme = Constants.ApplicationAuthenticationSheme;
-                    option.Cookies.TwoFactorRememberMeCookie.ExpireTimeSpan = TimeSpan.FromDays(30);
-                    option.Cookies.TwoFactorRememberMeCookie.DataProtectionProvider = protector;
-                    option.Cookies.ExternalCookieAuthenticationScheme = Constants.ExternalAuthenticationSheme;
-                    option.Cookies.ExternalCookie.AutomaticAuthenticate = true;
-                    option.Cookies.ExternalCookie.AuthenticationScheme = Constants.ExternalAuthenticationSheme;
-                    option.Cookies.ExternalCookie.DataProtectionProvider = protector;
+                  //  option.AuthenticationScheme = Constants.ApplicationAuthenticationSheme;
+                 //   option.Cookies.ApplicationCookieAuthenticationScheme = Constants.ApplicationAuthenticationSheme;
+                   // option.Cookies.TwoFactorRememberMeCookie.ExpireTimeSpan = TimeSpan.FromDays(30);
+                   // option.Cookies.TwoFactorRememberMeCookie.DataProtectionProvider = protector;
+                    //option.Cookies.ExternalCookieAuthenticationScheme = Constants.ExternalAuthenticationSheme;
+                  //  option.Cookies.ExternalCookie.AutomaticAuthenticate = true;
+                    //option.Cookies.ExternalCookie.AuthenticationScheme = Constants.ExternalAuthenticationSheme;
+                  //  option.Cookies.ExternalCookie.DataProtectionProvider = protector;
                 }
             ).AddEntityFrameworkStores<ApplicationDbContext>()
                  .AddTokenProvider<EmailTokenProvider<ApplicationUser>>(Constants.EMailFactor)
@@ -83,11 +83,12 @@ namespace Yavsc
             // External authentication shared cookie:
             app.UseCookieAuthentication(options =>
             {
-                options.AuthenticationScheme = Constants.ExternalAuthenticationSheme;
+                //options.AuthenticationScheme = Constants.ExternalAuthenticationSheme;
                 options.AutomaticAuthenticate = true;
                 options.ExpireTimeSpan = TimeSpan.FromMinutes(5);
                 options.LoginPath = new PathString(Constants.LoginPath.Substring(1));
                 options.AccessDeniedPath = new PathString(Constants.AccessDeniedPath.Substring(1));
+                options.AuthenticationScheme = Constants.ApplicationAuthenticationSheme;
             });
 
             var gvents = new OAuthEvents();
@@ -168,7 +169,7 @@ namespace Yavsc
                               context.Identity = identity;
                           }
                       }; */
-                      /*
+                      
             app.UseOAuthAuthorizationServer(
 
                 options =>
@@ -177,7 +178,6 @@ namespace Yavsc
                     options.TokenEndpointPath = new PathString(Constants.TokenPath.Substring(1));
                     options.ApplicationCanDisplayErrors = true;
                     options.AllowInsecureHttp = true;
-                    options.AuthenticationScheme = Constants.ApplicationAuthenticationSheme;
                     
                     options.Provider = new OAuthAuthorizationServerProvider
                     {
@@ -202,7 +202,7 @@ namespace Yavsc
                     options.AutomaticAuthenticate = true;
                     options.AutomaticChallenge = true;
                 } 
-            );*/
+            );
         }
     }
 }