public async Task <ActionResult <AuthorizationResponse> > Authenticate([FromBody] AuthorizationRequest authorizationRequest) { RoadkillIdentityUser identityUser = await _userManager.FindByEmailAsync(authorizationRequest.Email); if (identityUser == null) { return(NotFound($"The user with the email {authorizationRequest.Email} could not be found.")); } SignInResult result = await _signInManager.PasswordSignInAsync(identityUser, authorizationRequest.Password, true, false); if (result.Succeeded) { IList <Claim> existingClaims = await _userManager.GetClaimsAsync(identityUser); if (existingClaims.Count == 0) { return(StatusCode(StatusCodes.Status403Forbidden)); } // When testing on localhost, RemoteIpAddress is null. var ipAddress = HttpContext.Connection.RemoteIpAddress ?? IPAddress.Loopback; string ip = ipAddress.ToString(); var token = new AuthorizationResponse() { JwtToken = _jwtTokenService.CreateToken(existingClaims, identityUser.Email), RefreshToken = await _jwtTokenService.CreateRefreshToken(identityUser.Email, ip) }; return(Ok(token)); } // don't use Forbid() as it goes through ASP.NET Core's authentication middleware return(StatusCode(StatusCodes.Status403Forbidden)); }
public async Task Authenticate_should_return_jwt_and_refresh_token_logging_ip() { // given string ipAddress = "9.8.7.6"; string refreshToken = "refresh token"; string jwtToken = "jwt token"; string email = "*****@*****.**"; string password = "******"; var roadkillUser = new RoadkillIdentityUser() { Id = "1", UserName = email, NormalizedUserName = email.ToUpperInvariant(), Email = email, NormalizedEmail = email.ToUpperInvariant(), RoleClaims = new List <string>() }; var model = new AuthorizationRequest() { Email = email, Password = password }; _userManagerMock.FindByEmailAsync(email) .Returns(Task.FromResult(roadkillUser)); _signinManagerMock.PasswordSignInAsync(roadkillUser, password, true, false) .Returns(Task.FromResult(SignInResult.Success)); var claims = new List <Claim>() { new Claim("any", "thing") } as IList <Claim>; _userManagerMock.GetClaimsAsync(roadkillUser) .Returns(Task.FromResult(claims)); _jwtTokenService .CreateToken(claims, roadkillUser.Email) .Returns(jwtToken); var httpContext = new DefaultHttpContext(); httpContext.Connection.RemoteIpAddress = IPAddress.Parse(ipAddress); _authorizationController.ControllerContext.HttpContext = httpContext; _jwtTokenService .CreateRefreshToken(roadkillUser.Email, ipAddress) .Returns(refreshToken); // when ActionResult <AuthorizationResponse> actionResult = await _authorizationController.Authenticate(model); // then actionResult.Result.ShouldBeOfType <OkObjectResult>(); var okResult = actionResult.Result as OkObjectResult; var response = okResult.Value as AuthorizationResponse; response.ShouldNotBeNull(); response.JwtToken.ShouldBe(jwtToken); response.RefreshToken.ShouldBe(refreshToken); }