public async Task ReceiveAsync(AuthenticationTokenReceiveContext context)
{
var allowedOrigin = context.OwinContext.Get<string>("as:clientAllowedOrigin");
if (context.OwinContext.Response.Headers.Keys.Contains("Access-Control-Allow-Origin"))
{
context.OwinContext.Response.Headers["Access-Control-Allow-Origin"] = allowedOrigin;
}
else
{
context.OwinContext.Response.Headers.Add("Access-Control-Allow-Origin", new[] {allowedOrigin});
}
var hashedTokenId = TokenHelper.GetHash(context.Token);
using (var _repo = new AuthRepository())
{
var refreshToken = await _repo.FindRefreshToken(hashedTokenId);
if (refreshToken != null)
{
//Get protectedTicket from refreshToken class
context.DeserializeTicket(refreshToken.ProtectedTicket);
var result = await _repo.RemoveRefreshToken(hashedTokenId);
}
}
}
public override Task ValidateClientAuthentication(OAuthValidateClientAuthenticationContext context)
{
var clientId = string.Empty;
var clientSecret = string.Empty;
Client client = null;
if (!context.TryGetBasicCredentials(out clientId, out clientSecret))
{
context.TryGetFormCredentials(out clientId, out clientSecret);
}
if (context.ClientId == null)
{
context.Validated();
return Task.FromResult<object>(null);
}
using (var _repo = new AuthRepository())
{
client = _repo.FindClient(context.ClientId);
}
if (client == null)
{
context.SetError("invalid_clientId",
string.Format("Client '{0}' is not registered in the system.", context.ClientId));
return Task.FromResult<object>(null);
}
if (client.ApplicationType == ApplicationTypes.NativeConfidential)
{
if (string.IsNullOrWhiteSpace(clientSecret))
{
context.SetError("invalid_clientId", "Client secret should be sent.");
return Task.FromResult<object>(null);
}
if (client.Secret != TokenHelper.GetHash(clientSecret))
{
context.SetError("invalid_clientId", "Client secret is invalid.");
return Task.FromResult<object>(null);
}
}
if (!client.Active)
{
context.SetError("invalid_clientId", "Client is inactive.");
return Task.FromResult<object>(null);
}
context.OwinContext.Set("as:clientAllowedOrigin", client.AllowedOrigin);
context.OwinContext.Set("as:clientRefreshTokenLifeTime", client.RefreshTokenLifeTime.ToString());
context.Validated();
return Task.FromResult<object>(null);
}
public async Task CreateAsync(AuthenticationTokenCreateContext context)
{
var clientid = context.Ticket.Properties.Dictionary["as:client_id"];
if (string.IsNullOrEmpty(clientid))
{
return;
}
var refreshTokenId = Guid.NewGuid().ToString("n");
using (var _repo = new AuthRepository())
{
var refreshTokenLifeTime = context.OwinContext.Get<string>("as:clientRefreshTokenLifeTime");
var token = new RefreshToken
{
Id = TokenHelper.GetHash(refreshTokenId),
ClientId = clientid,
Subject = context.Ticket.Properties.Dictionary["userName"],
IssuedUtc = DateTime.UtcNow,
ExpiresUtc = DateTime.UtcNow.AddMinutes(Convert.ToDouble(refreshTokenLifeTime))
};
context.Ticket.Properties.IssuedUtc = token.IssuedUtc;
context.Ticket.Properties.ExpiresUtc = token.ExpiresUtc;
token.ProtectedTicket = context.SerializeTicket();
var result = await _repo.AddRefreshToken(token);
if (result)
{
context.SetToken(refreshTokenId);
}
}
}
public RefreshTokensController()
{
authRepository = new AuthRepository();
}
public AccountController()
{
repo = new AuthRepository();
}
public override async Task GrantResourceOwnerCredentials(OAuthGrantResourceOwnerCredentialsContext context)
{
IdentityUser user;
var userClaims = new List<Claim>();
var allowedOrigin = context.OwinContext.Get<string>("as:clientAllowedOrigin") ?? "*";
if (context.OwinContext.Response.Headers.Keys.Contains("Access-Control-Allow-Origin"))
{
context.OwinContext.Response.Headers["Access-Control-Allow-Origin"] = allowedOrigin;
}
else
{
context.OwinContext.Response.Headers.Add("Access-Control-Allow-Origin", new[] {allowedOrigin});
}
using (var repo = new AuthRepository())
{
user = await repo.FindUser(context.UserName, context.Password);
if (user == null)
{
context.SetError("invalid_grant", "The user name or password is incorrect.");
return;
}
foreach (var userRole in user.Roles)
{
var role = repo.FindRole(userRole.RoleId);
IQueryable<Claim> claims = null;
if (role != null && role.CanAccessAllModules)
{
claims = repo.GetAllClaims();
}
else
{
claims = repo.FindRoleClaims(userRole.RoleId);
}
userClaims.AddRange(claims);
}
}
var identity = new ClaimsIdentity(context.Options.AuthenticationType);
var props = new AuthenticationProperties(new Dictionary<string, string>
{
{
"UserId", user.Id
},
{
"as:client_id", (context.ClientId == null) ? string.Empty : context.ClientId
},
{
"userName", context.UserName
}
});
var ticket = new AuthenticationTicket(identity, props);
context.Validated(ticket);
foreach (var claim in userClaims)
{
if (!identity.Claims.Any(x => x.Type == claim.ClaimType && x.Value == claim.ClaimValue))
{
identity.AddClaim(new System.Security.Claims.Claim(claim.ClaimType, claim.ClaimValue));
}
}
identity.AddClaim(new System.Security.Claims.Claim("UserName", user.UserName));
identity.AddClaim(new System.Security.Claims.Claim("UserId", user.Id));
context.Validated(identity);
}
