protected override Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
{
if (request.Headers.Authorization != null)
{
if (request.Headers.Authorization.Scheme == "Bearer")
{
//If there are authorization headers that use the Bearer token scheme, try to digest the token and, if available,
//set the current user context.
try
{
var AuthServerPublicKey = (RSACryptoServiceProvider)AuthorizationServerHost.AuthorizationServerCertificate.PublicKey.Key;
var ResourceServerPrivateKey = (RSACryptoServiceProvider)AuthorizationServerHost.ResourceServerCertificate.PrivateKey;
var resourceServer = new ResourceServer(new StandardAccessTokenAnalyzer(AuthServerPublicKey, ResourceServerPrivateKey));
var principal = resourceServer.GetPrincipal(request);
HttpContext.Current.User = principal;
Thread.CurrentPrincipal = principal;
}
catch (ProtocolFaultResponseException ex)
{
//A protocol fault response exception is thrown in the case that a client cannot be properly authenticated by the provided
//token. To diagnose any errors you may be getting, you can re-throw or log ex.ErrorResponseMessage.
//For now, let's just inform the client that they're unauthorized for this resource.
SendUnauthorizedResponse();
}
}
}
else
{
//This API does not allow unauthenticated access, return an unauthorized status code.
SendUnauthorizedResponse();
}
return base.SendAsync(request, cancellationToken);
}
public void GetPrincipalWithMissingAccessToken() {
var resourceServer = new ResourceServer(new StandardAccessTokenAnalyzer(AsymmetricKey, null));
var requestHeaders = new NameValueCollection {
{ "Authorization", "Bearer " },
};
var request = new HttpRequestInfo("GET", new Uri("http://localhost/resource"), headers: requestHeaders);
Assert.That(() => resourceServer.GetPrincipal(request), Throws.InstanceOf<ProtocolException>());
}
private static IPrincipal VerifyOAuth2(HttpRequestMessageProperty httpDetails, Uri requestUri, params string[] requiredScopes) {
// for this sample where the auth server and resource server are the same site,
// we use the same public/private key.
using (var signing = Global.CreateAuthorizationServerSigningServiceProvider()) {
using (var encrypting = Global.CreateResourceServerEncryptionServiceProvider()) {
var resourceServer = new ResourceServer(new StandardAccessTokenAnalyzer(signing, encrypting));
return resourceServer.GetPrincipal(httpDetails, requestUri, requiredScopes);
}
}
}
public override void OnAuthorization(HttpActionContext actionContext)
{
try
{
base.OnAuthorization(actionContext);
// Bail if no auth header or the header isn't bearing a token for us
var authHeader = actionContext.Request.Headers.FirstOrDefault(x => x.Key == "Authorization");
if (authHeader.Value == null || !authHeader.Value.Any())
{
actionContext.Response = new HttpResponseMessage(HttpStatusCode.Unauthorized);
return;
}
var authHeaderValue = authHeader.Value.FirstOrDefault(x => x.StartsWith("Bearer "));
if (authHeaderValue == null)
{
actionContext.Response = new HttpResponseMessage(HttpStatusCode.Unauthorized);
return;
}
// Have the DotNetOpenAuth resource server inspect the provided request using the configured keys
// This checks both that the token is ok and that the token grants the scope required by
// the required scope parameters to this attribute
var resourceServer = new DNOA.ResourceServer(new StandardAccessTokenAnalyzer(SignatureVerifier, Decrypter));
var principal = resourceServer.GetPrincipal(actionContext.Request,RequiredScopes);
if (principal != null)
{
// Things look good. Set principal for the resource to use in identifying the user so it can act accordingly
Thread.CurrentPrincipal = principal;
HttpContext.Current.User = principal;
// Dont understand why the call to GetPrincipal is setting actionContext.Response to be unauthorized
// even when the principal returned is non-null
// If I do this code the same way in a delegating handler, that doesn't happen
actionContext.Response = null;
}
else
{
actionContext.Response = new HttpResponseMessage(HttpStatusCode.Unauthorized);
}
}
catch (SecurityTokenValidationException)
{
actionContext.Response = new HttpResponseMessage(HttpStatusCode.Unauthorized);
}
catch (ProtocolFaultResponseException)
{
actionContext.Response = new HttpResponseMessage(HttpStatusCode.Unauthorized);
}
catch (Exception)
{
actionContext.Response = new HttpResponseMessage(HttpStatusCode.BadRequest);
}
}
public override void OnAuthorization(HttpActionContext actionContext)
{
try
{
base.OnAuthorization(actionContext);
// Bail if no auth header or the header isn't bearing a token for us
var authHeader = actionContext.Request.Headers.FirstOrDefault(x => x.Key == "Authorization");
if (authHeader.Value == null || !authHeader.Value.Any())
{
actionContext.Response = new HttpResponseMessage(HttpStatusCode.Unauthorized);
return;
}
var authHeaderValue = authHeader.Value.FirstOrDefault(x => x.StartsWith("Bearer "));
if (authHeaderValue == null)
{
actionContext.Response = new HttpResponseMessage(HttpStatusCode.Unauthorized);
return;
}
// Have the DotNetOpenAuth resource server inspect the provided request using the configured keys
// This checks both that the token is ok and that the token grants the scope required by
// the required scope parameters to this attribute
var resourceServer = new DNOA.ResourceServer(new StandardAccessTokenAnalyzer(SignatureVerifier, Decrypter));
var principal = resourceServer.GetPrincipal(actionContext.Request, RequiredScopes);
if (principal != null)
{
// Things look good. Set principal for the resource to use in identifying the user so it can act accordingly
Thread.CurrentPrincipal = principal;
HttpContext.Current.User = principal;
// Dont understand why the call to GetPrincipal is setting actionContext.Response to be unauthorized
// even when the principal returned is non-null
// If I do this code the same way in a delegating handler, that doesn't happen
actionContext.Response = null;
}
else
{
actionContext.Response = new HttpResponseMessage(HttpStatusCode.Unauthorized);
}
}
catch (SecurityTokenValidationException)
{
actionContext.Response = new HttpResponseMessage(HttpStatusCode.Unauthorized);
}
catch (ProtocolFaultResponseException)
{
actionContext.Response = new HttpResponseMessage(HttpStatusCode.Unauthorized);
}
catch (Exception)
{
actionContext.Response = new HttpResponseMessage(HttpStatusCode.BadRequest);
}
}
public override void Execute(IHttpRequest request, IHttpResponse response, object requestDto)
{
try {
var authServerKeys = AppHostBase.Instance.Container.ResolveNamed <ICryptoKeyPair>("authServer");
var dataServerKeys = AppHostBase.Instance.Container.ResolveNamed <ICryptoKeyPair>("dataServer");
var tokenAnalyzer = new StandardAccessTokenAnalyzer(authServerKeys.PublicSigningKey, dataServerKeys.PrivateEncryptionKey);
var oauth2ResourceServer = new DotNetOpenAuth.OAuth2.ResourceServer(tokenAnalyzer);
var wrappedRequest = new HttpRequestWrapper((HttpRequest)request.OriginalRequest);
HttpContext.Current.User = oauth2ResourceServer.GetPrincipal(wrappedRequest, oauth2Scopes);
} catch (ProtocolFaultResponseException x) {
HandleOAuth2Exception(request, response, x);
}
}
protected override bool AuthorizeCore(HttpContextBase httpContext) {
var rsa = new RSACryptoServiceProvider();
rsa.ImportCspBlob(Convert.FromBase64String(ConfigurationManager.AppSettings["PrivateAsymmetricKey"]));
var analyzer = new StandardAccessTokenAnalyzer(rsa, rsa);
var resourceServer = new ResourceServer(analyzer);
try {
httpContext.User = resourceServer.GetPrincipal(
httpContext.Request, this.Roles.Split(new[] { ' ' }, StringSplitOptions.RemoveEmptyEntries));
} catch (ProtocolException) {
httpContext.User = null;
}
return httpContext.User != null;
}
public override void OnAuthorization(HttpActionContext actionContext)
{
try
{
var tokenAnalyzer =
new StandardAccessTokenAnalyzer(
AuthServer.PublicSigningKey,
DataServer.PrivateEncryptionKey);
var oauth2ResourceServer = new DotNetOpenAuth.OAuth2.ResourceServer(tokenAnalyzer);
((ApiController)actionContext.ControllerContext.Controller).User =
oauth2ResourceServer.GetPrincipal(actionContext.Request.GetRequestBase(), _oauth2Scopes) as PlayerPrincipal;
}
catch (ProtocolFaultResponseException ex)
{
HandleUnauthorizedRequest(actionContext, ex);
}
}
/// <summary>
/// Handles the AuthenticateRequest event of the HttpApplication.
/// </summary>
/// <param name="sender">The source of the event.</param>
/// <param name="e">The <see cref="System.EventArgs"/> instance containing the event data.</param>
private void context_AuthenticateRequest(object sender, EventArgs e) {
// Don't read OAuth messages directed at the OAuth controller or else we'll fail nonce checks.
if (this.IsOAuthControllerRequest()) {
return;
}
using (var crypto = OAuthResourceServer.CreateRSA()) {
var tokenAnalyzer = new SpecialAccessTokenAnalyzer(crypto, crypto);
var resourceServer = new ResourceServer(tokenAnalyzer);
try {
IPrincipal principal = resourceServer.GetPrincipal(new HttpRequestWrapper(this.application.Context.Request));
this.application.Context.User = principal;
} catch (ProtocolFaultResponseException ex) {
ex.CreateErrorResponse().Send();
}
}
}
protected override bool CheckAccessCore(OperationContext operationContext) {
if (!base.CheckAccessCore(operationContext)) {
return false;
}
var httpDetails = operationContext.RequestContext.RequestMessage.Properties[HttpRequestMessageProperty.Name] as HttpRequestMessageProperty;
var requestUri = operationContext.RequestContext.RequestMessage.Properties.Via;
using (var crypto = OAuthResourceServer.CreateRSA()) {
var tokenAnalyzer = new SpecialAccessTokenAnalyzer(crypto, crypto);
var resourceServer = new ResourceServer(tokenAnalyzer);
try {
IPrincipal principal = resourceServer.GetPrincipal(httpDetails, requestUri, operationContext.IncomingMessageHeaders.Action);
var policy = new OAuthPrincipalAuthorizationPolicy(principal);
var policies = new List<IAuthorizationPolicy> {
policy,
};
var securityContext = new ServiceSecurityContext(policies.AsReadOnly());
if (operationContext.IncomingMessageProperties.Security != null) {
operationContext.IncomingMessageProperties.Security.ServiceSecurityContext = securityContext;
} else {
operationContext.IncomingMessageProperties.Security = new SecurityMessageProperty {
ServiceSecurityContext = securityContext,
};
}
securityContext.AuthorizationContext.Properties["Identities"] = new List<IIdentity> {
principal.Identity,
};
return true;
} catch (ProtocolFaultResponseException ex) {
// Return the appropriate unauthorized response to the client.
ex.CreateErrorResponse().Send();
} catch (DotNetOpenAuth.Messaging.ProtocolException/* ex*/) {
////Logger.Error("Error processing OAuth messages.", ex);
}
}
return false;
}
protected override bool AuthorizeCore(HttpContextBase httpContext)
{
bool isAuthorized = false;
try
{
HttpRequestBase request = httpContext.Request;
if (!string.IsNullOrEmpty(request.Headers["Authorization"]))
{
if (request.Headers["Authorization"].StartsWith("Bearer "))
{
RSACryptoServiceProvider authorizationServerSigningPublicKey = AuthorizationServerHost.CreateRsaCryptoServiceProvider(AuthorizationServerHost.AuthorizationServerSigningPublicKey);
RSACryptoServiceProvider resourceServerEncryptionPrivateKey = AuthorizationServerHost.CreateRsaCryptoServiceProvider(AuthorizationServerHost.ResourceServerEncryptionPrivateKey);
StandardAccessTokenAnalyzer tokenAnalyzer = new StandardAccessTokenAnalyzer(authorizationServerSigningPublicKey, resourceServerEncryptionPrivateKey);
ResourceServer resourceServer = new ResourceServer(tokenAnalyzer);
IPrincipal principal = resourceServer.GetPrincipal(request);
if (principal.Identity.IsAuthenticated)
{
HttpContext.Current.User = principal;
Thread.CurrentPrincipal = principal;
isAuthorized = true;
}
var _token = resourceServer.GetAccessToken(request);
if (this.RequiredScopes.Any())
{
var token = resourceServer.GetAccessToken(request, this.RequiredScopes);
}
}
}
}
catch
{
isAuthorized = false;
}
return isAuthorized;
}
public static IPrincipal VerifyOAuth2(HttpRequestMessage requestMessage, params string[] requiredScopes)
{
// for this sample where the auth server and resource server are the same site,
// we use the same public/private key.
try
{
using (RSACryptoServiceProvider authorizationRas = AuthorizationServerHelper.CreateAuthorizationServerSigningServiceProvider())
{
using (RSACryptoServiceProvider resourceRas = ResourceServerHelper.CreateResourceServerEncryptionServiceProvider())
{
var resourceServer = new ResourceServer(new StandardAccessTokenAnalyzer(authorizationRas, resourceRas));
return resourceServer.GetPrincipal(requestMessage);//, requiredScopes 这一版先不验证scope
}
}
}
catch (ProtocolFaultResponseException ex)//处理password auth方式授权过期，暂时没找合适的处理入口
{
return null;
}
}
public override void Execute(IHttpRequest request, IHttpResponse response, object requestDto) {
try {
var authServerKeys = AppHostBase.Instance.Container.ResolveNamed<ICryptoKeyPair>("authServer");
var dataServerKeys = AppHostBase.Instance.Container.ResolveNamed<ICryptoKeyPair>("dataServer");
var tokenAnalyzer = new StandardAccessTokenAnalyzer(authServerKeys.PublicSigningKey, dataServerKeys.PrivateEncryptionKey);
var oauth2ResourceServer = new DotNetOpenAuth.OAuth2.ResourceServer(tokenAnalyzer);
var wrappedRequest = new HttpRequestWrapper((HttpRequest)request.OriginalRequest);
HttpContext.Current.User = oauth2ResourceServer.GetPrincipal(wrappedRequest, oauth2Scopes);
} catch (ProtocolFaultResponseException x) {
HandleOAuth2Exception(request, response, x);
}
}
