public async Task <IActionResult> Index(ConfirmConsentsViewModel confirmConsentsViewModel, CancellationToken token)
{
try
{
var unprotectedUrl = _dataProtector.Unprotect(confirmConsentsViewModel.ReturnUrl);
var query = unprotectedUrl.GetQueries().ToJObj();
var claimName = User.Claims.FirstOrDefault(c => c.Type == ClaimTypes.NameIdentifier);
var user = await _oauthUserRepository.FindOAuthUserByLogin(claimName.Value, token);
var consent = _userConsentFetcher.FetchFromAuthorizationRequest(user, query);
if (consent == null)
{
consent = _userConsentFetcher.BuildFromAuthorizationRequest(query);
user.Consents.Add(consent);
await _oAuthUserCommandRepository.Update(user, token);
await _oAuthUserCommandRepository.SaveChanges(token);
}
return(Redirect(unprotectedUrl));
}
catch (CryptographicException)
{
ModelState.AddModelError("invalid_request", "invalid_request");
return(View(confirmConsentsViewModel));
}
}
public async Task Refresh(JObject previousQueryParameters, HandlerContext currentContext)
{
if (!previousQueryParameters.ContainsKey(UserClaims.Subject))
{
return;
}
currentContext.SetUser(await _oauthUserRepository.FindOAuthUserByLogin(previousQueryParameters[UserClaims.Subject].ToString()));
var openidClient = (OpenIdClient)currentContext.Client;
var payload = await BuildIdToken(currentContext, previousQueryParameters).ConfigureAwait(false);
var idToken = await _jwtBuilder.BuildClientToken(currentContext.Client, payload, openidClient.IdTokenSignedResponseAlg, openidClient.IdTokenEncryptedResponseAlg, openidClient.IdTokenEncryptedResponseEnc);
currentContext.Response.Add(Name, idToken);
}
protected async Task <AuthorizationResponse> BuildResponse(HandlerContext context, CancellationToken cancellationToken)
{
var requestedResponseTypes = context.Request.Data.GetResponseTypesFromAuthorizationRequest();
if (!requestedResponseTypes.Any())
{
throw new OAuthException(ErrorCodes.INVALID_REQUEST, string.Format(ErrorMessages.MISSING_PARAMETER, AuthorizationRequestParameters.ResponseType));
}
var responseTypeHandlers = _responseTypeHandlers.Where(r => requestedResponseTypes.Contains(r.ResponseType));
var unsupportedResponseType = requestedResponseTypes.Where(r => !_responseTypeHandlers.Any(rh => rh.ResponseType == r));
if (unsupportedResponseType.Any())
{
throw new OAuthException(ErrorCodes.UNSUPPORTED_RESPONSE_TYPE, string.Format(ErrorMessages.MISSING_RESPONSE_TYPES, string.Join(" ", unsupportedResponseType)));
}
context.SetClient(await Validate(context.Request.Data, cancellationToken));
context.SetUser(await _oauthUserRepository.FindOAuthUserByLogin(context.Request.UserSubject, cancellationToken));
foreach (var validator in _authorizationRequestValidators)
{
await validator.Validate(context, cancellationToken);
}
var state = context.Request.Data.GetStateFromAuthorizationRequest();
var redirectUri = context.Request.Data.GetRedirectUriFromAuthorizationRequest();
if (!string.IsNullOrWhiteSpace(state))
{
context.Response.Add(AuthorizationResponseParameters.State, state);
}
_authorizationRequestEnricher.Enrich(context);
if (!context.Client.RedirectionUrls.Contains(redirectUri))
{
redirectUri = context.Client.RedirectionUrls.First();
}
foreach (var responseTypeHandler in responseTypeHandlers)
{
await responseTypeHandler.Enrich(context, cancellationToken);
}
_tokenProfiles.First(t => t.Profile == context.Client.PreferredTokenProfile).Enrich(context);
return(new RedirectURLAuthorizationResponse(redirectUri, context.Response.Parameters));
}
public virtual async Task <OAuthUser> Authenticate(string login, string password)
{
var user = await _oauthUserRepository.FindOAuthUserByLogin(login);
if (user == null)
{
throw new BaseUIException(Exceptions.ErrorCodes.UNKNOWN_USER);
}
var credential = user.Credentials.FirstOrDefault(c => c.CredentialType == Constants.AMR);
if (credential == null || credential.Value != PasswordHelper.ComputeHash(password))
{
throw new BaseUIException(Exceptions.ErrorCodes.INVALID_CREDENTIALS);
}
return(user);
}
private async Task <IActionResult> Common(JObject content, CancellationToken cancellationToken)
{
try
{
var accessToken = ExtractAccessToken(content);
var jwsPayload = await Extract(accessToken);
if (jwsPayload == null)
{
throw new OAuthException(ErrorCodes.INVALID_TOKEN, OAuth.ErrorMessages.BAD_TOKEN);
}
var subject = jwsPayload.GetSub();
var scopes = jwsPayload.GetScopes();
var audiences = jwsPayload.GetAudiences();
var claims = jwsPayload.GetClaimsFromAccessToken(AuthorizationRequestClaimTypes.UserInfo);
var authTime = jwsPayload.GetAuthTime();
var user = await _oauthUserRepository.FindOAuthUserByLogin(subject, cancellationToken);
if (user == null)
{
return(new UnauthorizedResult());
}
var filteredClients = await _oauthClientRepository.FindOAuthClientByIds(audiences, cancellationToken);
if (!filteredClients.Any())
{
throw new OAuthException(ErrorCodes.INVALID_CLIENT, ErrorMessages.INVALID_AUDIENCE);
}
var oauthClient = (OpenIdClient)filteredClients.First();
if (!user.HasOpenIDConsent(oauthClient.ClientId, scopes, claims, AuthorizationRequestClaimTypes.UserInfo))
{
throw new OAuthException(ErrorCodes.INVALID_REQUEST, ErrorMessages.NO_CONSENT);
}
var token = await _tokenQueryRepository.Get(accessToken, cancellationToken);
if (token == null)
{
_logger.LogError("Cannot get user information because access token has been rejected");
throw new OAuthException(ErrorCodes.INVALID_TOKEN, OAuth.ErrorMessages.ACCESS_TOKEN_REJECTED);
}
var oauthScopes = (await _oauthScopeRepository.FindOAuthScopesByNames(scopes, cancellationToken)).Cast <OpenIdScope>();
var payload = new JwsPayload();
IdTokenBuilder.EnrichWithScopeParameter(payload, oauthScopes, user, subject);
_claimsJwsPayloadEnricher.EnrichWithClaimsParameter(payload, claims, user, authTime, AuthorizationRequestClaimTypes.UserInfo);
foreach (var claimsSource in _claimsSources)
{
await claimsSource.Enrich(payload, oauthClient).ConfigureAwait(false);
}
string contentType = "application/json";
var result = JsonConvert.SerializeObject(payload).ToString();
if (!string.IsNullOrWhiteSpace(oauthClient.UserInfoSignedResponseAlg))
{
result = await _jwtBuilder.BuildClientToken(oauthClient, payload, oauthClient.UserInfoSignedResponseAlg, oauthClient.UserInfoEncryptedResponseAlg, oauthClient.UserInfoEncryptedResponseEnc);
contentType = "application/jwt";
}
return(new ContentResult
{
Content = result,
ContentType = contentType
});
}
catch (OAuthException ex)
{
var jObj = new JObject
{
{ ErrorResponseParameters.Error, ex.Code },
{ ErrorResponseParameters.ErrorDescription, ex.Message }
};
return(new ContentResult
{
Content = jObj.ToString(),
ContentType = "application/json",
StatusCode = (int)HttpStatusCode.BadRequest
});
}
}