/// <summary>
/// Validate the issuer. The issuer is considered as valid if it is the same
/// uri or it has the same http scheme and authority as the trusted issuer uri
/// from the configuration file or default uri, plus if it is not fully the
/// same it has to have a tenant Id, and optionally v2.0 but nothing more...
/// </summary>
/// <param name="issuer">Issuer to validate (will be tenanted)</param>
/// <param name="config">Authentication configuration</param>
/// <returns>The <c>issuer</c> if it's valid</returns>
private static string ValidateIssuer(string issuer, IOAuthServerConfig config)
{
var uri = new Uri(issuer);
var trustedIssuer = new Uri(string.IsNullOrEmpty(config?.TrustedIssuer) ?
kDefaultIssuerUri : config.TrustedIssuer);
if (uri == trustedIssuer)
{
return(issuer); // Configured issuer correct.
}
if (uri.Scheme != trustedIssuer.Scheme ||
uri.Authority != trustedIssuer.Authority)
{
throw new SecurityTokenInvalidIssuerException(
"Issuer has wrong authority.");
}
var parts = uri.AbsolutePath.Split(new char[] { '/' },
StringSplitOptions.RemoveEmptyEntries);
if (parts.Length == 0)
{
throw new SecurityTokenInvalidIssuerException(
"Issuer is not tenanted.");
}
if (parts.Length >= 1 && !Guid.TryParse(parts[0], out _))
{
throw new SecurityTokenInvalidIssuerException(
"No valid tenant Id for the issuer.");
}
if (parts.Length > 1 && parts[2] != "v2.0")
{
throw new SecurityTokenInvalidIssuerException(
"Only accepted protocol versions are AAD v1.0 or V2.0");
}
return(issuer);
}
/// <summary>
/// Create validator
/// </summary>
/// <param name="config"></param>
/// <param name="logger"></param>
public JwtTokenEndpointValidator(IOAuthServerConfig config, ILogger logger)
{
_config = config ?? throw new ArgumentNullException(nameof(config));
_logger = logger ?? throw new ArgumentNullException(nameof(logger));
_tokenHandler = new JwtSecurityTokenHandler();
}
