Server: wire ProfileService so access tokens carry the name claim
The custom ProfileService (Yavsc.Services.ProfileService) was never
registered with IdentityServer, so IS8 fell back to its default
profile service — which only emits claims listed in each API
resource's UserClaims (RequestedClaimTypes). "name" was never among
them, so every access token lacked "name" and GetUserName() resolved
to null on all bearer resource hosts (Blogs/Api): the MyFiles upload
500 and the unreachable User.Identity.Name. The class was dead code;
all prior tweaks to it (FullName→UserName) and to ServiceExtensions
(MapInboundClaims=false) were necessary but insufficient until it was
actually wired in.
- HostingExtensions: AddProfileService<ProfileService>() after
AddAspNetIdentity<ApplicationUser>().
- ProfileService: emit name=user.UserName, email, roles for any user
grant whose client has "profile" in AllowedScopes, independent of
the caller (the old ParsedScopes gate only fired for the id-token
caller, never the access-token caller).
- ServiceExtensions: JwtBearer NameClaimType=JwtClaimTypes.Name,
MapInboundClaims=false (keep short claim names as-emitted).
- FileSystemHelpers: EnsureDestinationDirectory uses GetUserName()
(the "name" claim) instead of User.Identity.Name for the per-user
storage root.
Tests:
- TestTokenIssuer: stamp a "name" claim = subject so test tokens mirror
production shape (fixes FileSystemApiTests upload 500).
- Remoting: PasswordToken_carries_name_claim_equal_to_login mints a
real JWT via the IS token endpoint (password grant, openid profile)
and asserts the access token carries name=login and GetUserName()
resolves to it.
- WebServerFixture: AccessTokenType=0 (Jwt in IS8; 1=Reference, the
inverse of Duende); allow openid+profile on the test client; re-seed
the openid/profile identity resources in ReseedAuthTestData (a
ResetAndMigrateDatabase wipes the shared in-memory store and previously
left them gone → invalid_scope).
- BillingServiceTests: [Collection("Yavsc Server")] to serialize with
the host build that mutates the static BillingService/Config
registries (pre-existing parallel race that the new test's timing
surfaced).
Co-Authored-By: Claude Code <noreply@anthropic.com>
This commit is contained in:
parent
8d2d6754f6
commit
d8c13c81d7
GPG key ID:
AD4B9B545FBD7D12
8 changed files with 185 additions and 26 deletions
|
|
@ -1,19 +1,17 @@
|
|||
#nullable enable annotations
|
||||
|
||||
|
||||
|
||||
using System.Security.Claims;
|
||||
using Microsoft.AspNetCore.Html;
|
||||
using Microsoft.Extensions.FileProviders;
|
||||
using Microsoft.AspNetCore.Http;
|
||||
using ImageMagick;
|
||||
using Yavsc.Models;
|
||||
using Yavsc.Models.Streaming;
|
||||
using Yavsc.ViewModels;
|
||||
using Microsoft.AspNetCore.Http;
|
||||
using Yavsc.Exceptions;
|
||||
using Yavsc.Abstract.Helpers;
|
||||
using ImageMagick;
|
||||
using Yavsc.Server.Models.FileSystem;
|
||||
using Yavsc.ViewModels.UserFiles;
|
||||
|
||||
namespace Yavsc.Server.Helpers
|
||||
{
|
||||
public static class FileSystemHelpers
|
||||
|
|
@ -46,7 +44,7 @@ namespace Yavsc.Server.Helpers
|
|||
this ClaimsPrincipal user,
|
||||
string subpath, SiteSettings siteSettings)
|
||||
{
|
||||
var root = Path.Combine(siteSettings.Blog, user.Identity.Name);
|
||||
var root = Path.Combine(siteSettings.Blog, user.GetUserName());
|
||||
if (!string.IsNullOrWhiteSpace(subpath))
|
||||
{
|
||||
if (!subpath.IsValidYavscPath())
|
||||
|
|
|
|||
|
|
@ -1,5 +1,6 @@
|
|||
#nullable enable annotations
|
||||
|
||||
using IdentityModel;
|
||||
using Microsoft.AspNetCore.Authentication;
|
||||
using Microsoft.AspNetCore.Authentication.JwtBearer;
|
||||
using Microsoft.Extensions.Configuration;
|
||||
|
|
@ -107,9 +108,23 @@ public static class ServiceExtensions
|
|||
ValidateAudience = true,
|
||||
ValidAudiences = audiences,
|
||||
RoleClaimType = Constants.RoleClaimType,
|
||||
NameClaimType = Constants.NameClaimType,
|
||||
// IdentityServer's ProfileService emits the name claim as
|
||||
// JwtClaimTypes.Name ("name", short form). MapInboundClaims
|
||||
// (below) is disabled, so it stays "name" on the principal —
|
||||
// NameClaimType must therefore be "name" too, or
|
||||
// User.Identity.Name / GetUserName() resolve to null. The
|
||||
// previous Constants.NameClaimType (the Microsoft long URI)
|
||||
// never matched the remapped xmlsoap URI either, so the name
|
||||
// was unreachable on every bearer host regardless of scope.
|
||||
NameClaimType = JwtClaimTypes.Name,
|
||||
};
|
||||
options.MapInboundClaims = true;
|
||||
// Keep JWT claim names as-emitted ("sub", "name", …). The default
|
||||
// inbound map rewrites "name" → xmlsoap name URI and "sub" →
|
||||
// nameid URI, which neither Constants.NameClaimType (microsoft
|
||||
// URI) nor GetUserName()'s FindFirstValue("name") could match.
|
||||
// Roles are already emitted as Constants.RoleClaimType (a long
|
||||
// URI), so disabling the map leaves IsInMsRole() working.
|
||||
options.MapInboundClaims = false;
|
||||
options.ClaimsIssuer = authority;
|
||||
options.Audience = audiences[0];
|
||||
|
||||
|
|
|
|||
|
|
@ -28,35 +28,40 @@ namespace Yavsc.Services
|
|||
var claims = new List<Claim> {
|
||||
new Claim(JwtClaimTypes.Subject,user.Id.ToString()),
|
||||
};
|
||||
List<string> claimAdds = new List<string>();
|
||||
|
||||
foreach (var scope in context.RequestedResources.ParsedScopes)
|
||||
{
|
||||
if (context.Client.AllowedScopes.Contains(scope.ParsedName))
|
||||
{
|
||||
claims.Add(new Claim(JwtClaimTypes.Scope, scope.ParsedName));
|
||||
claimAdds.Add(scope.ParsedName);
|
||||
}
|
||||
}
|
||||
|
||||
if (claimAdds.Contains(JwtClaimTypes.Profile))
|
||||
// name / email / roles are gated on the client being granted
|
||||
// the "profile" identity scope. They MUST land in the *access
|
||||
// token*: the Blogs/Api bearer resource hosts read the login
|
||||
// via GetUserName() (FindFirstValue("name")) and roles via
|
||||
// IsInMsRole() from the access token. But "profile" is an
|
||||
// identity scope, which only appears in the id-token caller's
|
||||
// ParsedScopes — never in the access-token caller's — so the
|
||||
// previous gate (claimAdds.Contains("profile")) left name,
|
||||
// email and roles out of every access token, and GetUserName()
|
||||
// resolved to null on every bearer host (the MyFiles upload
|
||||
// 500). Gate on the client's AllowedScopes instead, which is
|
||||
// caller-independent, so both the access token and the id
|
||||
// token carry these claims for any user grant whose client is
|
||||
// allowed "profile".
|
||||
if (context.Client.AllowedScopes.Contains(JwtClaimTypes.Profile))
|
||||
{
|
||||
claimAdds.Remove("profile");
|
||||
claimAdds.Add(JwtClaimTypes.Name);
|
||||
claimAdds.Add(JwtClaimTypes.Email);
|
||||
claimAdds.Add(Constants.RoleClaimType);
|
||||
}
|
||||
|
||||
if (claimAdds.Contains(JwtClaimTypes.Name))
|
||||
claims.Add(new Claim(JwtClaimTypes.Name, user.FullName));
|
||||
|
||||
if (claimAdds.Contains(JwtClaimTypes.Email))
|
||||
// "name" carries the login (UserName), not the display
|
||||
// FullName: GetUserName() / User.Identity.Name feed
|
||||
// filesystem paths (user files root, avatar file name),
|
||||
// and FullName can contain spaces. No bearer-host
|
||||
// consumer displays this claim as a human name today.
|
||||
claims.Add(new Claim(JwtClaimTypes.Name, user.UserName));
|
||||
claims.Add(new Claim(JwtClaimTypes.Email, user.Email));
|
||||
|
||||
if (claimAdds.Contains(Constants.RoleClaimType))
|
||||
{
|
||||
var roles = await this._userManager.GetRolesAsync(user);
|
||||
if (roles.Count()>0)
|
||||
if (roles.Count() > 0)
|
||||
{
|
||||
claims.AddRange(roles.Select(r => new Claim(Constants.RoleClaimType, r)));
|
||||
}
|
||||
|
|
|
|||
Loading…
Reference in a new issue