// GET /{appName}/oauth/authorize
        //
        public ActionResult Index(string appName, AuthorizeRequest request)
        {
            Tracing.Start("OAuth2 Authorize Endoint");

            // make sure application is registered
            var application = _config.FindApplication(appName);
            if (application == null)
            {
                Tracing.Error("Application not found: " + appName);
                return HttpNotFound();
            }

            ValidatedRequest validatedRequest;
            try
            {
                validatedRequest = new AuthorizeRequestValidator().Validate(application, request);
            }
            catch (AuthorizeRequestValidationException ex)
            {
                Tracing.Error("Aborting OAuth2 authorization request");
                return this.AuthorizeValidationError(ex);
            }

            if (validatedRequest.ShowConsent)
            {
                // show consent screen
                Tracing.Verbose("Showing consent screen");

                return View("Consent", validatedRequest);
            }

            Tracing.Verbose("No consent configured for application/client");
            return PerformGrant(validatedRequest);
        }
        // GET /{appName}/oauth/authorize
        //
        public ActionResult Index(string appName, AuthorizeRequest request)
        {
            Tracing.Start("OAuth2 Authorize Endoint");

            // make sure application is registered
            var application = _config.FindApplication(appName);

            if (application == null)
            {
                Tracing.Error("Application not found: " + appName);
                return(HttpNotFound());
            }

            ValidatedRequest validatedRequest;

            try
            {
                validatedRequest = new AuthorizeRequestValidator().Validate(application, request);
            }
            catch (AuthorizeRequestValidationException ex)
            {
                Tracing.Error("Aborting OAuth2 authorization request");
                return(this.AuthorizeValidationError(ex));
            }

            if (validatedRequest.ShowConsent)
            {
                validatedRequest.RememberOptions = GetRememberOptions(application);

                // todo: check first if a remembered consent decision exists
                if (validatedRequest.ResponseType == OAuthConstants.ResponseTypes.Token)
                {
                    var handle = _handleManager.Find(
                        ClaimsPrincipal.Current.GetSubject(),
                        validatedRequest.Client,
                        validatedRequest.Application,
                        validatedRequest.Scopes,
                        StoredGrantType.ConsentDecision);

                    if (handle != null)
                    {
                        Tracing.Verbose("Stored consent decision found.");

                        return(PerformGrant(validatedRequest));
                    }
                }

                // show consent screen
                Tracing.Verbose("Showing consent screen");
                return(View("Consent", validatedRequest));
            }

            Tracing.Verbose("No consent configured for application/client");


            // workaround for bug #139
            validatedRequest.RequestedRefreshTokenExpiration = DateTime.UtcNow.AddYears(50);
            return(PerformGrant(validatedRequest));
        }
        // GET /{appName}/oauth/authorize
        //
        public ActionResult Index(string appName, AuthorizeRequest request)
        {
            Tracing.Start("OAuth2 Authorize Endoint");

            // make sure application is registered
            var application = _config.FindApplication(appName);
            if (application == null)
            {
                Tracing.Error("Application not found: " + appName);
                return HttpNotFound();
            }

            ValidatedRequest validatedRequest;
            try
            {
                validatedRequest = new AuthorizeRequestValidator().Validate(application, request);
            }
            catch (AuthorizeRequestValidationException ex)
            {
                Tracing.Error("Aborting OAuth2 authorization request");
                return this.AuthorizeValidationError(ex);
            }

            if (validatedRequest.ShowConsent)
            {
                validatedRequest.RememberOptions = GetRememberOptions(application);

                // todo: check first if a remembered consent decision exists
                if (validatedRequest.ResponseType == OAuthConstants.ResponseTypes.Token)
                {
                    var handle = _handleManager.Find(
                        ClaimsPrincipal.Current.GetSubject(),
                        validatedRequest.Client,
                        validatedRequest.Application,
                        validatedRequest.Scopes,
                        StoredGrantType.ConsentDecision);

                    if (handle != null)
                    {
                        Tracing.Verbose("Stored consent decision found.");

                        return PerformGrant(validatedRequest);
                    }
                }

                // show consent screen
                Tracing.Verbose("Showing consent screen");
                return View("Consent", validatedRequest);
            }

            Tracing.Verbose("No consent configured for application/client");

            
            // workaround for bug #139
            validatedRequest.RequestedRefreshTokenExpiration = DateTime.UtcNow.AddYears(50);
            return PerformGrant(validatedRequest);
        }
        public void ValidRequestMultipleScope()
        {
            var validator = new AuthorizeRequestValidator(_clientManager);
            var app = _testConfig.FindApplication("test");
            var request = new AuthorizeRequest
            {
                client_id = "codeclient",
                response_type = "code",
                scope = "read search",
                redirect_uri = "https://prod.local"
            };

            var result = validator.Validate(app, request);
        }
        public void ValidRequestMultipleScope()
        {
            var validator = new AuthorizeRequestValidator();
            var app = _testConfig.FindApplication("test");
            var request = new AuthorizeRequest
            {
                client_id = "implicitclient",
                response_type = "token",
                scope = "read browse",
                redirect_uri = "https://test2.local"
            };

            var result = validator.Validate(app, request);
        }
        public void NoParameters()
        {
            var validator = new AuthorizeRequestValidator();
            var app = _testConfig.FindApplication("test");

            try
            {
                var result = validator.Validate(app, null);
            }
            catch (AuthorizeRequestResourceOwnerException ex)
            {
                // todo: inspect exception
                return;
            }

            Assert.Fail("No exception thrown.");
        }
        public void NoParameters()
        {
            var validator = new AuthorizeRequestValidator();
            var app = _testConfig.FindApplication("test");

            try
            {
                var result = validator.Validate(app, null);
            }
            catch (AuthorizeRequestClientException ex)
            {
                Assert.IsTrue(ex.Error == OAuthConstants.Errors.InvalidRequest);
                return;
            }

            Assert.Fail("No exception thrown.");
        }
        public void MissingRedirectUri()
        {
            var validator = new AuthorizeRequestValidator();
            var app = _testConfig.FindApplication("test");
            var request = new AuthorizeRequest
            {
                client_id = "codeclient",
                response_type = "code",
                scope = "read"
            };

            try
            {
                var result = validator.Validate(app, request);
            }
            catch (AuthorizeRequestResourceOwnerException ex)
            {
                // todo: check error code
                return;
            }

            Assert.Fail("No exception thrown.");
        }
        public void DisabledClient()
        {
            var validator = new AuthorizeRequestValidator();
            var app = _testConfig.FindApplication("test");
            var request = new AuthorizeRequest
            {
                client_id = "disabledclient",
                response_type = "code",
                scope = "read",
                redirect_uri = "https://prod.local"
            };

            try
            {
                var result = validator.Validate(app, request);
            }
            catch (AuthorizeRequestResourceOwnerException ex)
            {
                return;
            }

            Assert.Fail("No exception thrown.");
        }
        public void MalformedRedirectUri1()
        {
            var validator = new AuthorizeRequestValidator(_clientManager);
            var app = _testConfig.FindApplication("test");
            var request = new AuthorizeRequest
            {
                client_id = "codeclient",
                response_type = "code",
                scope = "read",
                redirect_uri = "https:/prod.local"
            };

            try
            {
                var result = validator.Validate(app, request);
            }
            catch (AuthorizeRequestResourceOwnerException ex)
            {
                // todo: check error code
                return;
            }

            Assert.Fail("No exception thrown.");
        }
        public void UnauthorizedResponseType()
        {
            var validator = new AuthorizeRequestValidator();
            var app = _testConfig.FindApplication("test");
            var request = new AuthorizeRequest
            {
                client_id = "implicitclient",
                response_type = "code",
                scope = "read",
                redirect_uri = "https://test2.local"
            };

            try
            {
                var result = validator.Validate(app, request);
            }
            catch (AuthorizeRequestClientException ex)
            {
                Assert.AreEqual(OAuthConstants.Errors.UnsupportedResponseType, ex.Error);
                return;
            }

            Assert.Fail("No exception thrown.");
        }
        public void UnauthorizedRedirectUri()
        {
            var validator = new AuthorizeRequestValidator();
            var app = _testConfig.FindApplication("test");
            var request = new AuthorizeRequest
            {
                client_id = "implicitclient",
                response_type = "token",
                scope = "read",
                redirect_uri = "https://unauthorized.com"
            };

            try
            {
                var result = validator.Validate(app, request);
            }
            catch (AuthorizeRequestResourceOwnerException ex)
            {
                // todo: check error code
                return;
            }

            Assert.Fail("No exception thrown.");
        }
        public ActionResult HandleConsentResponse(string appName, string button, string[] scopes, AuthorizeRequest request, int? rememberDuration = null)
        {
            Tracing.Start("OAuth2 Authorize Endoint - Consent response");

            // make sure application is registered
            var application = _config.FindApplication(appName);
            if (application == null)
            {
                Tracing.Error("Application not found: " + appName);
                return HttpNotFound();
            }

            if (button == "no")
            {
                Tracing.Information("User denies access token request.");
                return new ClientErrorResult(new Uri(request.redirect_uri), OAuthConstants.Errors.AccessDenied, request.response_type, request.state);
            }

            if (button == "yes")
            {
                Tracing.Information("User allows access token request.");

                ValidatedRequest validatedRequest;
                try
                {
                    validatedRequest = new AuthorizeRequestValidator().Validate(application, request);
                }
                catch (AuthorizeRequestValidationException ex)
                {
                    Tracing.Error("Aborting OAuth2 authorization request");
                    return this.AuthorizeValidationError(ex);
                }

                if (scopes == null || scopes.Length == 0)
                {
                    ModelState.AddModelError("", "Please choose at least one permission.");
                    return View("Consent", validatedRequest);
                }

                // parse scopes form post and substitue scopes
                validatedRequest.Scopes.RemoveAll(x => !scopes.Contains(x.Name));

                // store consent decision if 
                //  checkbox was checked
                //  and storage is allowed 
                //  and flow == implicit
                if (validatedRequest.Application.AllowRememberConsentDecision &&
                    validatedRequest.ResponseType == OAuthConstants.ResponseTypes.Token &&
                    rememberDuration == -1)
                {
                    var handle = StoredGrant.CreateConsentDecision(
                        ClaimsPrincipal.Current.GetSubject(),
                        validatedRequest.Client,
                        validatedRequest.Application,
                        validatedRequest.Scopes);

                    _handleManager.Add(handle);

                    Tracing.Information("Consent decision stored.");
                }

                // parse refresh token lifetime if 
                // code flow is used 
                // and refresh tokens are allowed
                if (validatedRequest.RequestingRefreshToken &&
                    rememberDuration != null &&
                    validatedRequest.Client.Flow == OAuthFlow.Code)
                {
                    if (rememberDuration == -1)
                    {
                        validatedRequest.RequestedRefreshTokenExpiration = DateTime.UtcNow.AddYears(50);
                    }
                    else
                    {
                        validatedRequest.RequestedRefreshTokenExpiration = DateTime.UtcNow.AddHours(rememberDuration.Value);
                    }

                    Tracing.Information("Selected refresh token lifetime in hours: " + rememberDuration);
                }

                var grantResult = PerformGrant(validatedRequest);
                if (grantResult != null) return grantResult;
            }

            return new ClientErrorResult(
                new Uri(request.redirect_uri),
                OAuthConstants.Errors.InvalidRequest,
                request.response_type,
                request.state);
        }
Esempio n. 14
0
        public ActionResult HandleConsentResponse(string appName, string button, string[] scopes, AuthorizeRequest request, int?rememberDuration = null)
        {
            Tracing.Start("OAuth2 Authorize Endoint - Consent response");

            // make sure application is registered
            var application = _config.FindApplication(appName);

            if (application == null)
            {
                Tracing.Error("Application not found: " + appName);
                return(HttpNotFound());
            }

            if (button == "no")
            {
                Tracing.Information("User denies access token request.");
                return(new ClientErrorResult(new Uri(request.redirect_uri), OAuthConstants.Errors.AccessDenied, request.response_type, request.state));
            }

            if (button == "yes")
            {
                Tracing.Information("User allows access token request.");

                ValidatedRequest validatedRequest;
                try
                {
                    validatedRequest = new AuthorizeRequestValidator().Validate(application, request);
                }
                catch (AuthorizeRequestValidationException ex)
                {
                    Tracing.Error("Aborting OAuth2 authorization request");
                    return(this.AuthorizeValidationError(ex));
                }

                if (scopes == null || scopes.Length == 0)
                {
                    ModelState.AddModelError("", "Please choose at least one permission.");
                    return(View("Consent", validatedRequest));
                }

                // parse scopes form post and substitue scopes
                validatedRequest.Scopes.RemoveAll(x => !scopes.Contains(x.Name));

                // store consent decision if
                //  checkbox was checked
                //  and storage is allowed
                //  and flow == implicit
                if (validatedRequest.Application.AllowRememberConsentDecision &&
                    validatedRequest.ResponseType == OAuthConstants.ResponseTypes.Token &&
                    rememberDuration == -1)
                {
                    var handle = StoredGrant.CreateConsentDecision(
                        ClaimsPrincipal.Current.GetSubject(),
                        validatedRequest.Client,
                        validatedRequest.Application,
                        validatedRequest.Scopes);

                    _handleManager.Add(handle);

                    Tracing.Information("Consent decision stored.");
                }

                // parse refresh token lifetime if
                // code flow is used
                // and refresh tokens are allowed
                if (validatedRequest.RequestingRefreshToken &&
                    rememberDuration != null &&
                    validatedRequest.Client.Flow == OAuthFlow.Code)
                {
                    if (rememberDuration == -1)
                    {
                        validatedRequest.RequestedRefreshTokenExpiration = DateTime.UtcNow.AddYears(50);
                    }
                    else
                    {
                        validatedRequest.RequestedRefreshTokenExpiration = DateTime.UtcNow.AddHours(rememberDuration.Value);
                    }

                    Tracing.Information("Selected refresh token lifetime in hours: " + rememberDuration);
                }

                var grantResult = PerformGrant(validatedRequest);
                if (grantResult != null)
                {
                    return(grantResult);
                }
            }

            return(new ClientErrorResult(
                       new Uri(request.redirect_uri),
                       OAuthConstants.Errors.InvalidRequest,
                       request.response_type,
                       request.state));
        }
        public void UnauthorizedScopeSingle()
        {
            var validator = new AuthorizeRequestValidator();
            var app = _testConfig.FindApplication("test");
            var request = new AuthorizeRequest
            {
                client_id = "implicitclient",
                response_type = "token",
                scope = "write",
                redirect_uri = "https://test2.local"
            };

            try
            {
                var result = validator.Validate(app, request);
            }
            catch (AuthorizeRequestClientException ex)
            {
                Assert.IsTrue(ex.Error == OAuthConstants.Errors.InvalidScope);
                return;
            }

            Assert.Fail("No exception thrown.");
        }
        public void UnauthorizedScopeMultiple()
        {
            var validator = new AuthorizeRequestValidator(_clientManager);
            var app = _testConfig.FindApplication("test");
            var request = new AuthorizeRequest
            {
                client_id = "codeclient",
                response_type = "code",
                scope = "read write",
                redirect_uri = "https://prod.local"
            };

            try
            {
                var result = validator.Validate(app, request);
            }
            catch (AuthorizeRequestClientException ex)
            {
                Assert.AreEqual(OAuthConstants.Errors.InvalidScope, ex.Error);
                return;
            }

            Assert.Fail("No exception thrown.");
        }
        public ActionResult HandleConsentResponse(string appName, string button, string[] scopes, AuthorizeRequest request, int? rememberDuration = null)
        {
            Tracing.Start("OAuth2 Authorize Endoint - Consent response");

            // make sure application is registered
            var application = _config.FindApplication(appName);
            if (application == null)
            {
                Tracing.Error("Application not found: " + appName);
                return HttpNotFound();
            }

            if (button == "no")
            {
                Tracing.Information("User denies access token request.");
                return new ClientErrorResult(new Uri(request.redirect_uri), OAuthConstants.Errors.AccessDenied, request.response_type, request.state);
            }

            if (button == "yes")
            {
                Tracing.Information("User allows access token request.");

                ValidatedRequest validatedRequest;
                try
                {
                    validatedRequest = new AuthorizeRequestValidator().Validate(application, request);
                }
                catch (AuthorizeRequestValidationException ex)
                {
                    Tracing.Error("Aborting OAuth2 authorization request");
                    return this.AuthorizeValidationError(ex);
                }

                if (scopes == null || scopes.Length == 0)
                {
                    ModelState.AddModelError("", "Please choose at least one permission.");
                    return View("Consent", validatedRequest);
                }

                // todo: parse scopes form post and substitue scopes
                validatedRequest.Scopes.RemoveAll(x => !scopes.Contains(x.Name));
                var grantResult = PerformGrant(validatedRequest);
                if (grantResult != null) return grantResult;
            }

            return new ClientErrorResult(
                new Uri(request.redirect_uri), 
                OAuthConstants.Errors.InvalidRequest, 
                request.response_type, 
                request.state);
        }
        public void NonSslRedirectUri()
        {
            var validator = new AuthorizeRequestValidator();
            var app = _testConfig.FindApplication("test");
            var request = new AuthorizeRequest
            {
                client_id = "codeclient",
                response_type = "code",
                scope = "read",
                redirect_uri = "http://prod.local"
            };

            try
            {
                var result = validator.Validate(app, request);
            }
            catch (AuthorizeRequestClientException ex)
            {
                Assert.IsTrue(ex.Error == OAuthConstants.Errors.InvalidRequest);
                return;
            }

            Assert.Fail("No exception thrown.");
        }