/// <summary>
/// This methos validates the Simple Web Token.
/// </summary>
/// <param name="token">A simple web token.</param>
/// <returns>A Claims Collection which contains all the claims from the token.</returns>
public ClaimsIdentityCollection ValidateToken(SecurityToken token)
{
SimpleWebToken realToken = token as SimpleWebToken;
if (realToken == null)
{
throw new InvalidTokenReceivedException("The received token is of incorrect token type.Expected SimpleWebToken");
}
if (StringComparer.OrdinalIgnoreCase.Compare(realToken.AudienceUri.ToString(), RelyingPartyRealm) != 0)
{
throw new InvalidTokenReceivedException("The Audience Uri of the incoming token is not expected. Expected AudienceUri is " + RelyingPartyRealm);
}
if (StringComparer.OrdinalIgnoreCase.Compare(realToken.Issuer, tenantUri) != 0)
{
throw new InvalidTokenReceivedException("The Issuer of the token is not trusted. Trusted issuer is " + tenantUri);
}
if (!realToken.SignVerify(Convert.FromBase64String(symmetricSignatureKey)))
{
throw new InvalidTokenReceivedException("Signature verification of the incoming token failed.");
}
if (DateTime.Compare(realToken.ValidTo, DateTime.UtcNow) <= 0)
{
throw new ExpiredTokenReceivedException("The incoming token has expired. Get a new access token from the Authorization Server.");
}
ClaimsIdentityCollection identities = new ClaimsIdentityCollection();
ClaimsIdentity identity = new ClaimsIdentity();
foreach (var claim in realToken.Claims)
{
identity.Claims.Add(claim);
}
identities.Add(identity);
return(identities);
}
/// <summary>
/// Reads a serialized token and converts it into a <see cref="SecurityToken"/>.
/// </summary>
/// <param name="rawToken">The token in serialized form.</param>
/// <returns>The parsed form of the token.</returns>
public SecurityToken ReadToken(string rawToken)
{
char parameterSeparator = '&';
Uri audienceUri = null;
string issuer = null;
string signature = null;
string unsignedString = null;
string expires = null;
if (string.IsNullOrEmpty(rawToken))
{
throw new ArgumentNullException("rawToken");
}
//
// Find the last parameter. The signature must be last per SWT specification.
//
int lastSeparator = rawToken.LastIndexOf(parameterSeparator);
// Check whether the last parameter is an hmac.
//
if (lastSeparator > 0)
{
string lastParamStart = parameterSeparator + Digest256Label + "=";
string lastParam = rawToken.Substring(lastSeparator);
// Strip the trailing hmac to obtain the original unsigned string for later hmac verification.
// e.g. name1=value1&name2=value2&HMACSHA256=XXX123 -> name1=value1&name2=value2
//
if (lastParam.StartsWith(lastParamStart, StringComparison.Ordinal))
{
unsignedString = rawToken.Substring(0, lastSeparator);
}
}
else
{
throw new InvalidTokenReceivedException("The Simple Web Token must have a signature at the end. The incoming token did not have a signature at the end of the token.");
}
// Signature is a mandatory parameter, and it must be the last one.
// If there's no trailing hmac, Return error.
//
if (unsignedString == null)
{
throw new InvalidTokenReceivedException("The Simple Web Token must have a signature at the end. The incoming token did not have a signature at the end of the token.");
}
// Create a collection of SWT claims
//
NameValueCollection rawClaims = ParseToken(rawToken);
audienceUri = new Uri(rawClaims[AudienceLabel]);
if (audienceUri != null)
{
rawClaims.Remove(AudienceLabel);
}
else
{
throw new InvalidTokenReceivedException("Then incoming token does not have an AudienceUri.");
}
expires = rawClaims[ExpiresOnLabel];
if (expires != null)
{
rawClaims.Remove(ExpiresOnLabel);
}
else
{
throw new InvalidTokenReceivedException("Then incoming token does not have an expiry time.");
}
issuer = rawClaims[IssuerLabel];
if (issuer != null)
{
rawClaims.Remove(IssuerLabel);
}
else
{
throw new InvalidTokenReceivedException("Then incoming token does not have an Issuer");
}
signature = rawClaims[Digest256Label];
if (signature != null)
{
rawClaims.Remove(Digest256Label);
}
else
{
throw new InvalidTokenReceivedException("Then incoming token does not have a signature");
}
List <Claim> claims = DecodeClaims(issuer, rawClaims);
SimpleWebToken swt = new SimpleWebToken(audienceUri, issuer, DecodeExpiry(expires), claims, signature, unsignedString);
return(swt);
}
/// <summary>
/// Reads a serialized token and converts it into a <see cref="SecurityToken"/>.
/// </summary>
/// <param name="rawToken">The token in serialized form.</param>
/// <returns>The parsed form of the token.</returns>
public SecurityToken ReadToken( string rawToken )
{
char parameterSeparator = '&';
Uri audienceUri = null;
string issuer = null;
string signature = null;
string unsignedString = null;
string expires = null;
if ( string.IsNullOrEmpty( rawToken ) )
{
throw new ArgumentNullException( "rawToken" );
}
//
// Find the last parameter. The signature must be last per SWT specification.
//
int lastSeparator = rawToken.LastIndexOf( parameterSeparator );
// Check whether the last parameter is an hmac.
//
if ( lastSeparator > 0 )
{
string lastParamStart = parameterSeparator + Digest256Label + "=";
string lastParam = rawToken.Substring( lastSeparator );
// Strip the trailing hmac to obtain the original unsigned string for later hmac verification.
// e.g. name1=value1&name2=value2&HMACSHA256=XXX123 -> name1=value1&name2=value2
//
if ( lastParam.StartsWith( lastParamStart, StringComparison.Ordinal ) )
{
unsignedString = rawToken.Substring( 0, lastSeparator );
}
}
else
{
throw new InvalidTokenReceivedException( "The Simple Web Token must have a signature at the end. The incoming token did not have a signature at the end of the token." );
}
// Signature is a mandatory parameter, and it must be the last one.
// If there's no trailing hmac, Return error.
//
if ( unsignedString == null )
{
throw new InvalidTokenReceivedException( "The Simple Web Token must have a signature at the end. The incoming token did not have a signature at the end of the token." );
}
// Create a collection of SWT claims
//
NameValueCollection rawClaims = ParseToken( rawToken );
audienceUri = new Uri( rawClaims[AudienceLabel] );
if ( audienceUri != null )
{
rawClaims.Remove( AudienceLabel );
}
else
{
throw new InvalidTokenReceivedException( "Then incoming token does not have an AudienceUri." );
}
expires = rawClaims[ExpiresOnLabel];
if ( expires != null )
{
rawClaims.Remove( ExpiresOnLabel );
}
else
{
throw new InvalidTokenReceivedException( "Then incoming token does not have an expiry time." );
}
issuer = rawClaims[IssuerLabel];
if ( issuer != null )
{
rawClaims.Remove( IssuerLabel );
}
else
{
throw new InvalidTokenReceivedException( "Then incoming token does not have an Issuer" );
}
signature = rawClaims[Digest256Label];
if ( signature != null )
{
rawClaims.Remove( Digest256Label );
}
else
{
throw new InvalidTokenReceivedException( "Then incoming token does not have a signature" );
}
List<Claim> claims = DecodeClaims( issuer, rawClaims );
SimpleWebToken swt = new SimpleWebToken( audienceUri, issuer, DecodeExpiry( expires ), claims, signature, unsignedString );
return swt;
}
