/// <summary> /// Determines whether a described authorization is (still) valid. /// </summary> /// <param name="authorization">The authorization.</param> /// <returns> /// <c>true</c> if the original authorization is still valid; otherwise, <c>false</c>. /// </returns> /// <remarks> /// <para> /// When establishing that an authorization is still valid, /// it's very important to only match on recorded authorizations that /// meet these criteria: /// </para> /// 1) The client identifier matches. /// 2) The user account matches. /// 3) The scope on the recorded authorization must include all scopes in the given authorization. /// 4) The date the recorded authorization was issued must be <em>no later</em> that the date the given authorization /// was issued. /// <para> /// One possible scenario is where the user authorized a client, later revoked authorization, /// and even later reinstated authorization. This subsequent recorded authorization /// would not satisfy requirement #4 in the above list. This is important because the revocation /// the user went through should invalidate all previously issued tokens as a matter of /// security in the event the user was revoking access in order to sever authorization on a stolen /// account or piece of hardware in which the tokens were stored. /// </para> /// </remarks> public bool IsAuthorizationValid(IAuthorizationDescription authorization) { Guard.NotNull(() => authorization, authorization); // Verify the user still exists if (IsUserExists(authorization.User)) { //Verify the application still exists if (IsClientExist(authorization.ClientIdentifier)) { //Verify the scope is valid if ((authorization.Scope.Count == 1) && (authorization.Scope.First().EqualsIgnoreCase(AccessScope.Profile))) { return(true); } } } //TODO: When we support user configuration of applications and scopes of access //TODO: Verify the scopes the user permits //TODO: verify that the user still permits this application //TODO: Verify the date issued is no sooner than the date the user permitted the application // TODO: This is where we should check (e.g. in our authorization database) //that the resource owner has not revoked the authorization associated with the request. return(false); }
public bool IsAuthorizationValid(IAuthorizationDescription authorization) { //这里可以改进 //只要到达这步,说明authorization.Scope已经获得认证了,不需要再重新校验 //return this.IsAuthorizationValid(authorization.Scope, authorization.ClientIdentifier, authorization.UtcIssued, authorization.User); return(true); }
// Determine whether the given authorization is still ok public bool IsAuthorizationValid(IAuthorizationDescription authorization) { // If db precision exceeds token time precision (which is common), the following query would // often disregard a token that is minted immediately after the authorization record is stored in the db. // To compensate for this, we'll increase the timestamp on the token's issue date by 1 second. var grantedAuths = _authorizationRepository.FindCurrent(authorization.ClientIdentifier, authorization.User, authorization.UtcIssued + TimeSpan.FromSeconds(1)).ToList(); if (!grantedAuths.Any()) { // No granted authorizations prior to the issuance of this token, so it must have been revoked. // Even if later authorizations restore this client's ability to call in, we can't allow // access tokens issued before the re-authorization because the revoked authorization should // effectively and permanently revoke all access and refresh tokens. return(false); } // Determine the set of all scopes the user has authorized for this client var grantedScopes = new HashSet <string>(OAuthUtilities.ScopeStringComparer); foreach (var auth in grantedAuths) { grantedScopes.UnionWith(OAuthUtilities.SplitScopes(auth.Scope)); } // See if what's requested is authorized return(authorization.Scope.IsSubsetOf(grantedScopes)); }
/// <summary> /// Initializes a new instance of the <see cref="RefreshToken"/> class. /// </summary> /// <param name="authorization">The authorization this refresh token should describe.</param> internal RefreshToken(IAuthorizationDescription authorization) { this.ClientIdentifier = authorization.ClientIdentifier; this.UtcCreationDate = authorization.UtcIssued; this.UserDataAndNonce = authorization.UserDataAndNonce; this.Scope.ResetContents(authorization.Scope); }
public void ApplyAuthorization(IAuthorizationDescription authorization) { this.ClientIdentifier = authorization.ClientIdentifier; this.UtcCreationDate = authorization.UtcIssued; this.User = authorization.User; this.Scope.ResetContents(authorization.Scope); }
public bool IsAuthorizationValid(IAuthorizationDescription authorization) { if (authorization == null) { throw new ArgumentNullException(nameof(authorization)); } return(IsAuthorizationValid(authorization.Scope, authorization.ClientIdentifier, authorization.UtcIssued, authorization.User)); }
/// <summary> /// Initializes a new instance of the <see cref="RefreshToken"/> class. /// </summary> /// <param name="authorization">The authorization this refresh token should describe.</param> internal RefreshToken(IAuthorizationDescription authorization) { Contract.Requires<ArgumentNullException>(authorization != null); this.ClientIdentifier = authorization.ClientIdentifier; this.UtcCreationDate = authorization.UtcIssued; this.User = authorization.User; this.Scope.ResetContents(authorization.Scope); }
/// <summary> /// Initializes this instance of the <see cref="AccessToken"/> class. /// </summary> /// <param name="authorization">The authorization to apply to this access token.</param> internal void ApplyAuthorization(IAuthorizationDescription authorization) { Requires.NotNull(authorization, "authorization"); this.ClientIdentifier = authorization.ClientIdentifier; this.UtcCreationDate = authorization.UtcIssued; this.User = authorization.User; this.Scope.ResetContents(authorization.Scope); }
/// <summary> /// Determines whether a described authorization is (still) valid. /// </summary> /// <param name="authorization">The authorization.</param> /// <returns> /// <c>true</c> if the original authorization is still valid; otherwise, <c>false</c>. /// </returns> /// <remarks> /// <para>When establishing that an authorization is still valid, /// it's very important to only match on recorded authorizations that /// meet these criteria:</para> /// 1) The client identifier matches. /// 2) The user account matches. /// 3) The scope on the recorded authorization must include all scopes in the given authorization. /// 4) The date the recorded authorization was issued must be <em>no later</em> that the date the given authorization was issued. /// <para>One possible scenario is where the user authorized a client, later revoked authorization, /// and even later reinstated authorization. This subsequent recorded authorization /// would not satisfy requirement #4 in the above list. This is important because the revocation /// the user went through should invalidate all previously issued tokens as a matter of /// security in the event the user was revoking access in order to sever authorization on a stolen /// account or piece of hardware in which the tokens were stored. </para> /// </remarks> public bool IsAuthorizationValid(IAuthorizationDescription authorization) { // If your application supports access revocation (highly recommended), // this method should return false if the specified authorization is not // discovered in your current authorizations table. //// TODO: code here return(true); }
/// <summary> /// Initializes a new instance of the <see cref="AccessToken"/> class. /// </summary> /// <param name="authorization">The authorization to be described by the access token.</param> /// <param name="lifetime">The lifetime of the access token.</param> internal AccessToken(IAuthorizationDescription authorization, TimeSpan? lifetime) { Contract.Requires<ArgumentNullException>(authorization != null); this.ClientIdentifier = authorization.ClientIdentifier; this.UtcCreationDate = authorization.UtcIssued; this.User = authorization.User; this.Scope.ResetContents(authorization.Scope); this.Lifetime = lifetime; }
/// <summary> /// Initializes a new instance of the <see cref="RefreshToken"/> class. /// </summary> /// <param name="authorization">The authorization this refresh token should describe.</param> internal RefreshToken(IAuthorizationDescription authorization) { Requires.NotNull(authorization, "authorization"); this.ClientIdentifier = authorization.ClientIdentifier; this.UtcCreationDate = authorization.UtcIssued; this.User = authorization.User; this.Scope.ResetContents(authorization.Scope); }
/// <summary> /// Initializes a new instance of the <see cref="AccessToken"/> class. /// </summary> /// <param name="authorization">The authorization to be described by the access token.</param> /// <param name="lifetime">The lifetime of the access token.</param> internal AccessToken(IAuthorizationDescription authorization, TimeSpan? lifetime) { Requires.NotNull(authorization, "authorization"); this.ClientIdentifier = authorization.ClientIdentifier; this.UtcCreationDate = authorization.UtcIssued; this.User = authorization.User; this.Scope.ResetContents(authorization.Scope); this.Lifetime = lifetime; }
public bool IsAuthorizationValid(IAuthorizationDescription authorization) { if (authorization.ClientIdentifier == "RP" && authorization.Scope.Count == 1 && authorization.Scope.First() == "http://localhost/demo" && authorization.User == "Max Muster") { return(true); } return(false); }
public bool IsAuthorizationValid(IAuthorizationDescription authorization) { var client = DataStore.Instance.Clients .First(c => c.ClientIdentifier == authorization.ClientIdentifier); var authorizations = client.ClientAuthorizations .Where(a => a.UserId == authorization.User && a.IssueDate <= authorization.UtcIssued.AddSeconds(1) && (!a.ExpirationDateUtc.HasValue || a.ExpirationDateUtc.Value >= DateTime.UtcNow)); if (!authorizations.Any()) // No authorizations { return(false); } var grantedScopes = new HashSet <string>(); authorizations.ToList().ForEach(a => grantedScopes.UnionWith(a.Scope)); return(authorization.Scope.IsSubsetOf(grantedScopes)); }
/// <summary> /// Determines whether a described authorization is (still) valid. /// </summary> /// <param name="authorization">The authorization.</param> /// <returns> /// <c>true</c> if the original authorization is still valid; otherwise, <c>false</c>. /// </returns> /// <remarks> /// <para>When establishing that an authorization is still valid, /// it's very important to only match on recorded authorizations that /// meet these criteria:</para> /// 1) The client identifier matches. /// 2) The user account matches. /// 3) The scope on the recorded authorization must include all scopes in the given authorization. /// 4) The date the recorded authorization was issued must be <em>no later</em> that the date the given authorization was issued. /// <para>One possible scenario is where the user authorized a client, later revoked authorization, /// and even later reinstated authorization. This subsequent recorded authorization /// would not satisfy requirement #4 in the above list. This is important because the revocation /// the user went through should invalidate all previously issued tokens as a matter of /// security in the event the user was revoking access in order to sever authorization on a stolen /// account or piece of hardware in which the tokens were stored. </para> /// </remarks> public bool IsAuthorizationValid(IAuthorizationDescription authorization) { // Try to find a user with the specified username and password var user = this.db.Users.FirstOrDefault(u => u.OpenIDClaimedIdentifier == authorization.User); // If no user was found with the specified username/password combination, the authorization is not valid if (user == null) { return(false); } // Try to find the authorization the user has with the specified client var userAuthorizationForClient = user.Authorizations.FirstOrDefault(a => a.Client.ClientIdentifier == authorization.ClientIdentifier); // If no user authorization was found, that means that the user is not authorized for the specified client. // As a consequence, the authorization is not valid if (userAuthorizationForClient == null) { return(false); } // We check once again if the user is authorized for the specified scopes return(RequestedScopeIsValid(authorization.Scope, OAuthUtilities.SplitScopes(userAuthorizationForClient.Scope))); }
public bool IsAuthorizationValid(IAuthorizationDescription authorization) { return this.IsAuthorizationValid(authorization.Scope, authorization.ClientIdentifier, authorization.UtcIssued, authorization.User); }
public bool IsAuthorizationValid(IAuthorizationDescription authorization) { throw new NotImplementedException(); }
bool IAuthorizationServerHost.IsAuthorizationValid(IAuthorizationDescription authorization) { throw new NotImplementedException(); }
public bool IsAuthorizationValid(IAuthorizationDescription authorization) { // possibly only called on refresh token so always return false for now return false; }
public bool IsAuthorizationValid(IAuthorizationDescription authorization) { return(this.IsAuthorizationValid(authorization.Scope, authorization.ClientIdentifier, authorization.UtcIssued, authorization.User)); }
/// <summary> /// Determines whether a described authorization is (still) valid. /// </summary> /// <param name="authorization">The authorization.</param> /// <returns> /// <c>true</c> if the original authorization is still valid; otherwise, <c>false</c>. /// </returns> /// <remarks> /// <para>When establishing that an authorization is still valid, /// it's very important to only match on recorded authorizations that /// meet these criteria:</para> /// 1) The client identifier matches. /// 2) The user account matches. /// 3) The scope on the recorded authorization must include all scopes in the given authorization. /// 4) The date the recorded authorization was issued must be <em>no later</em> that the date the given authorization was issued. /// <para>One possible scenario is where the user authorized a client, later revoked authorization, /// and even later reinstated authorization. This subsequent recorded authorization /// would not satisfy requirement #4 in the above list. This is important because the revocation /// the user went through should invalidate all previously issued tokens as a matter of /// security in the event the user was revoking access in order to sever authorization on a stolen /// account or piece of hardware in which the tokens were stored. </para> /// </remarks> bool IAuthorizationServerHost.IsAuthorizationValid(IAuthorizationDescription authorization) { Requires.NotNull(authorization, "authorization"); throw new NotImplementedException(); }
/// <summary> /// Determines whether a described authorization is (still) valid. /// </summary> /// <param name="authorization">The authorization.</param> /// <returns> /// <c>true</c> if the original authorization is still valid; otherwise, <c>false</c>. /// </returns> /// <remarks> /// <para>When establishing that an authorization is still valid, /// it's very important to only match on recorded authorizations that /// meet these criteria:</para> /// 1) The client identifier matches. /// 2) The user account matches. /// 3) The scope on the recorded authorization must include all scopes in the given authorization. /// 4) The date the recorded authorization was issued must be <em>no later</em> that the date the given authorization was issued. /// <para>One possible scenario is where the user authorized a client, later revoked authorization, /// and even later reinstated authorization. This subsequent recorded authorization /// would not satisfy requirement #4 in the above list. This is important because the revocation /// the user went through should invalidate all previously issued tokens as a matter of /// security in the event the user was revoking access in order to sever authorization on a stolen /// account or piece of hardware in which the tokens were stored. </para> /// </remarks> public bool IsAuthorizationValid(IAuthorizationDescription authorization) { // If your application supports access revocation (highly recommended), // this method should return false if the specified authorization is not // discovered in your current authorizations table. //// TODO: code here return true; }
/// <summary> /// Determines whether a described authorization is (still) valid. /// </summary> /// <param name="authorization">The authorization.</param> /// <returns> /// <c>true</c> if the original authorization is still valid; otherwise, <c>false</c>. /// </returns> /// <remarks> /// <para>When establishing that an authorization is still valid, /// it's very important to only match on recorded authorizations that /// meet these criteria:</para> /// 1) The client identifier matches. /// 2) The user account matches. /// 3) The scope on the recorded authorization must include all scopes in the given authorization. /// 4) The date the recorded authorization was issued must be <em>no later</em> that the date the given authorization was issued. /// <para>One possible scenario is where the user authorized a client, later revoked authorization, /// and even later reinstated authorization. This subsequent recorded authorization /// would not satisfy requirement #4 in the above list. This is important because the revocation /// the user went through should invalidate all previously issued tokens as a matter of /// security in the event the user was revoking access in order to sever authorization on a stolen /// account or piece of hardware in which the tokens were stored. </para> /// </remarks> public bool IsAuthorizationValid(IAuthorizationDescription authorization) { // Try to find a user with the specified username and password var user = this.db.Users.FirstOrDefault(u => u.OpenIDClaimedIdentifier == authorization.User); // If no user was found with the specified username/password combination, the authorization is not valid if (user == null) { return false; } // Try to find the authorization the user has with the specified client var userAuthorizationForClient = user.Authorizations.FirstOrDefault(a => a.Client.ClientIdentifier == authorization.ClientIdentifier); // If no user authorization was found, that means that the user is not authorized for the specified client. // As a consequence, the authorization is not valid if (userAuthorizationForClient == null) { return false; } // We check once again if the user is authorized for the specified scopes return RequestedScopeIsValid(authorization.Scope, OAuthUtilities.SplitScopes(userAuthorizationForClient.Scope)); }
/// <summary> /// Determines whether a described authorization is (still) valid. /// </summary> /// <param name="authorization">The authorization.</param> /// <returns> /// <c>true</c> if the original authorization is still valid; otherwise, <c>false</c>. /// </returns> /// <remarks> /// <para>When establishing that an authorization is still valid, /// it's very important to only match on recorded authorizations that /// meet these criteria:</para> /// 1) The client identifier matches. /// 2) The user account matches. /// 3) The scope on the recorded authorization must include all scopes in the given authorization. /// 4) The date the recorded authorization was issued must be <em>no later</em> that the date the given authorization was issued. /// <para>One possible scenario is where the user authorized a client, later revoked authorization, /// and even later reinstated authorization. This subsequent recorded authorization /// would not satisfy requirement #4 in the above list. This is important because the revocation /// the user went through should invalidate all previously issued tokens as a matter of /// security in the event the user was revoking access in order to sever authorization on a stolen /// account or piece of hardware in which the tokens were stored. </para> /// </remarks> bool IAuthorizationServer.IsAuthorizationValid(IAuthorizationDescription authorization) { Contract.Requires<ArgumentNullException>(authorization != null); throw new NotImplementedException(); }
public bool IsAuthorizationValid(IAuthorizationDescription authorization) { throw new NotImplementedException(); }
/// <summary> /// Determines whether a described authorization is (still) valid. /// </summary> /// <param name="authorization">The authorization.</param> /// <returns> /// <c>true</c> if the original authorization is still valid; otherwise, <c>false</c>. /// </returns> /// <remarks> /// <para>When establishing that an authorization is still valid, /// it's very important to only match on recorded authorizations that /// meet these criteria:</para> /// 1) The client identifier matches. /// 2) The user account matches. /// 3) The scope on the recorded authorization must include all scopes in the given authorization. /// 4) The date the recorded authorization was issued must be <em>no later</em> that the date the given authorization was issued. /// <para>One possible scenario is where the user authorized a client, later revoked authorization, /// and even later reinstated authorization. This subsequent recorded authorization /// would not satisfy requirement #4 in the above list. This is important because the revocation /// the user went through should invalidate all previously issued tokens as a matter of /// security in the event the user was revoking access in order to sever authorization on a stolen /// account or piece of hardware in which the tokens were stored. </para> /// </remarks> public bool IsAuthorizationValid(IAuthorizationDescription authorization) { HashSet <string> requestedScopes = authorization.Scope; string clientIdentifier = authorization.ClientIdentifier; DateTime issuedUtc = authorization.UtcIssued; string userData = authorization.UserDataAndNonce; // Get the client for the consumer key var client = GetSpecificClient(clientIdentifier); if (client != null) { string[] userNonce = userData.Split(new char[] { '_' }); string userID = userNonce[0]; string nonce = userNonce[1]; // Get the nonce var nonceData = GetSpecificNonce(clientIdentifier, nonce); if (nonceData != null) { // Get the specific OAuth consumer. var oAuthConsumer = GetSpecificOAuthConsumers(nonceData.OAuthConsumerID); if (oAuthConsumer != null) { // If the verification code has been set // then grant access. if (!String.IsNullOrEmpty(oAuthConsumer.VerificationCode) && (oAuthConsumer.UserID != null)) { // Get the specifice user authorization. var clientAuth = GetSpecificClientAuthorization(client.ClientID, nonceData.Code); if (clientAuth != null) { // If the verification code has been set // then grant access. if ((clientAuth.UserID != null) && (clientAuth.ExpirationDateUtc.HasValue)) { // Add one second onto the creation date. issuedUtc += TimeSpan.FromSeconds(1); if ((clientAuth.CreatedOnUtc <= issuedUtc) && (clientAuth.ExpirationDateUtc.Value >= DateTime.UtcNow)) { return(true); } else { return(false); } } else { return(false); } } else { throw new Exception("No request authorization has been found, can not find a verification code."); } } else { return(false); } } else { throw new Exception("No request authorization has been found, can not find a verification code."); } } else { throw new Exception("No request nonce has been found, can not find a verification code."); } } else { throw new Exception("The client for consumer key : " + clientIdentifier + " does not exist."); } }
// Determine whether the given authorization is still ok public bool IsAuthorizationValid(IAuthorizationDescription authorization) { // If db precision exceeds token time precision (which is common), the following query would // often disregard a token that is minted immediately after the authorization record is stored in the db. // To compensate for this, we'll increase the timestamp on the token's issue date by 1 second. var grantedAuths = _authorizationRepository.FindCurrent(authorization.ClientIdentifier, authorization.User, authorization.UtcIssued + TimeSpan.FromSeconds(1)).ToList(); if (!grantedAuths.Any()) { // No granted authorizations prior to the issuance of this token, so it must have been revoked. // Even if later authorizations restore this client's ability to call in, we can't allow // access tokens issued before the re-authorization because the revoked authorization should // effectively and permanently revoke all access and refresh tokens. return false; } // Determine the set of all scopes the user has authorized for this client var grantedScopes = new HashSet<string>(OAuthUtilities.ScopeStringComparer); foreach (var auth in grantedAuths) { grantedScopes.UnionWith(OAuthUtilities.SplitScopes(auth.Scope)); } // See if what's requested is authorized return authorization.Scope.IsSubsetOf(grantedScopes); }
public bool IsAuthorizationValid(IAuthorizationDescription authorization) { //TODO: Maybe put some code here. This is mainly used for revocation of authorization grants - if //need to do it, we can, but for now assume that we don't need to do any revocation beyond expiry. return true; }
/// <summary> /// Determines whether a described authorization is (still) valid. /// </summary> /// <param name="authorization">The authorization.</param> /// <returns> /// <c>true</c> if the original authorization is still valid; otherwise, <c>false</c>. /// </returns> /// <remarks> /// <para>When establishing that an authorization is still valid, /// it's very important to only match on recorded authorizations that /// meet these criteria:</para> /// 1) The client identifier matches. /// 2) The user account matches. /// 3) The scope on the recorded authorization must include all scopes in the given authorization. /// 4) The date the recorded authorization was issued must be <em>no later</em> that the date the given authorization was issued. /// <para>One possible scenario is where the user authorized a client, later revoked authorization, /// and even later reinstated authorization. This subsequent recorded authorization /// would not satisfy requirement #4 in the above list. This is important because the revocation /// the user went through should invalidate all previously issued tokens as a matter of /// security in the event the user was revoking access in order to sever authorization on a stolen /// account or piece of hardware in which the tokens were stored. </para> /// </remarks> public bool IsAuthorizationValid(IAuthorizationDescription authorization) { // This method will never be called as we store our tokens in-memory so any attempt to // refresh a token will fail before this method is called as the server will not recognize // the token as being one it issued. For demo purposes, we show what the implementation // might look like return UserIsAuthorizedForRequestedScopes(authorization.User, authorization.Scope); }
public bool IsAuthorizationValid(IAuthorizationDescription authorization) { return true; }
/// <summary> /// Determines whether a described authorization is (still) valid. /// </summary> /// <param name="authorization">The authorization.</param> /// <returns> /// <c>true</c> if the original authorization is still valid; otherwise, <c>false</c>. /// </returns> /// <remarks> /// <para>When establishing that an authorization is still valid, /// it's very important to only match on recorded authorizations that /// meet these criteria:</para> /// 1) The client identifier matches. /// 2) The user account matches. /// 3) The scope on the recorded authorization must include all scopes in the given authorization. /// 4) The date the recorded authorization was issued must be <em>no later</em> that the date the given authorization was issued. /// <para>One possible scenario is where the user authorized a client, later revoked authorization, /// and even later reinstated authorization. This subsequent recorded authorization /// would not satisfy requirement #4 in the above list. This is important because the revocation /// the user went through should invalidate all previously issued tokens as a matter of /// security in the event the user was revoking access in order to sever authorization on a stolen /// account or piece of hardware in which the tokens were stored. </para> /// </remarks> bool IAuthorizationServerHost.IsAuthorizationValid(IAuthorizationDescription authorization) { Requires.NotNull(authorization, "authorization"); throw new NotImplementedException(); }
public bool IsAuthorizationValid(IAuthorizationDescription authorization) { //TODO: Maybe put some code here. This is mainly used for revocation of authorization grants - if //need to do it, we can, but for now assume that we don't need to do any revocation beyond expiry. return(true); }
public bool IsAuthorizationValid(IAuthorizationDescription authorization) { return(true); }
/// <summary> /// Determines whether a described authorization is (still) valid. /// </summary> /// <param name="authorization">The authorization.</param> /// <returns> /// <c>true</c> if the original authorization is still valid; otherwise, <c>false</c>. /// </returns> /// <remarks> /// <para>When establishing that an authorization is still valid, /// it's very important to only match on recorded authorizations that /// meet these criteria:</para> /// 1) The client identifier matches. /// 2) The user account matches. /// 3) The scope on the recorded authorization must include all scopes in the given authorization. /// 4) The date the recorded authorization was issued must be <em>no later</em> that the date the given authorization was issued. /// <para>One possible scenario is where the user authorized a client, later revoked authorization, /// and even later reinstated authorization. This subsequent recorded authorization /// would not satisfy requirement #4 in the above list. This is important because the revocation /// the user went through should invalidate all previously issued tokens as a matter of /// security in the event the user was revoking access in order to sever authorization on a stolen /// account or piece of hardware in which the tokens were stored. </para> /// </remarks> bool IAuthorizationServerHost.IsAuthorizationValid(IAuthorizationDescription authorization) { throw new NotImplementedException(); }
/// <summary> /// Determines whether a described authorization is (still) valid. /// </summary> /// <param name="authorization">The authorization.</param> /// <returns> /// <c>true</c> if the original authorization is still valid; otherwise, <c>false</c>. /// </returns> /// <remarks> /// <para>When establishing that an authorization is still valid, /// it's very important to only match on recorded authorizations that /// meet these criteria:</para> /// 1) The client identifier matches. /// 2) The user account matches. /// 3) The scope on the recorded authorization must include all scopes in the given authorization. /// 4) The date the recorded authorization was issued must be <em>no later</em> that the date the given authorization was issued. /// <para>One possible scenario is where the user authorized a client, later revoked authorization, /// and even later reinstated authorization. This subsequent recorded authorization /// would not satisfy requirement #4 in the above list. This is important because the revocation /// the user went through should invalidate all previously issued tokens as a matter of /// security in the event the user was revoking access in order to sever authorization on a stolen /// account or piece of hardware in which the tokens were stored. </para> /// </remarks> public bool IsAuthorizationValid(IAuthorizationDescription authorization) { // We check once again if the user is authorized for the specified scopes return(UserIsAuthorizedForRequestedScopes(authorization.User, authorization.Scope)); }
/// <summary> /// Determines whether a described authorization is (still) valid. /// </summary> /// <param name="authorization">The authorization.</param> /// <returns> /// <c>true</c> if the original authorization is still valid; otherwise, <c>false</c>. /// </returns> /// <remarks> /// <para>When establishing that an authorization is still valid, /// it's very important to only match on recorded authorizations that /// meet these criteria:</para> /// 1) The client identifier matches. /// 2) The user account matches. /// 3) The scope on the recorded authorization must include all scopes in the given authorization. /// 4) The date the recorded authorization was issued must be <em>no later</em> that the date the given authorization was issued. /// <para>One possible scenario is where the user authorized a client, later revoked authorization, /// and even later reinstated authorization. This subsequent recorded authorization /// would not satisfy requirement #4 in the above list. This is important because the revocation /// the user went through should invalidate all previously issued tokens as a matter of /// security in the event the user was revoking access in order to sever authorization on a stolen /// account or piece of hardware in which the tokens were stored. </para> /// </remarks> public bool IsAuthorizationValid(IAuthorizationDescription authorization) { // We check once again if the user is authorized for the specified scopes return UserIsAuthorizedForRequestedScopes(authorization.User, authorization.Scope); }