public async Task GetDevicesAndModulesInTargetDeviceScopeAsync([FromRoute] string actorDeviceId, [FromRoute] string actorModuleId, [FromBody] NestedScopeRequest request)
{
actorDeviceId = WebUtility.UrlDecode(Preconditions.CheckNonWhiteSpace(actorDeviceId, nameof(actorDeviceId)));
actorModuleId = WebUtility.UrlDecode(Preconditions.CheckNonWhiteSpace(actorModuleId, nameof(actorModuleId)));
Preconditions.CheckNonWhiteSpace(request.AuthChain, nameof(request.AuthChain));
if (actorModuleId != Constants.EdgeHubModuleId)
{
// Only child EdgeHubs are allowed to act OnBehalfOf of devices/modules.
var result = new EdgeHubScopeResultError(HttpStatusCode.Unauthorized, Events.UnauthorizedActor(actorDeviceId, actorModuleId));
await this.SendResponse(result.Status, JsonConvert.SerializeObject(result));
}
string authChain = request.AuthChain;
string[] ids = AuthChainHelpers.GetAuthChainIds(authChain);
if (ids.Length == 1)
{
// A child EdgeHub can use its module credentials to calls upstream
// OnBehalfOf its device identity, so the auth-chain would just have
// one element denoting the target device scope but no actor.
// However, the auth stack requires an actor to be specified for OnBehalfOf
// connections, so we manually add the actor to the auth-chain for this
// special case.
authChain = $"{ids[0]}/{Constants.EdgeHubModuleId};{ids[0]}";
}
IHttpRequestAuthenticator authenticator = await this.authenticatorGetter;
HttpAuthResult authResult = await authenticator.AuthenticateAsync(actorDeviceId, Option.Some(actorModuleId), Option.Some(authChain), this.HttpContext);
if (authResult.Authenticated)
{
EdgeHubScopeResult reqResult = await this.HandleDevicesAndModulesInTargetDeviceScopeAsync(actorDeviceId, actorModuleId, request);
await this.SendResponse(reqResult.Status, JsonConvert.SerializeObject(reqResult));
}
else
{
var result = new EdgeHubScopeResultError(HttpStatusCode.Unauthorized, authResult.ErrorMessage);
await this.SendResponse(result.Status, JsonConvert.SerializeObject(result));
}
}
public void GetAuthChainIds_Fail(string authChain)
{
Assert.Throws <ArgumentException>(() => AuthChainHelpers.GetAuthChainIds(authChain));
}
public void GetAuthChainIds_Success()
{
Assert.Equal(new[] { "device1/$edgeHub", "device1", "device2" }, AuthChainHelpers.GetAuthChainIds("device1/$edgeHub;device1;device2"));
Assert.Equal(new[] { "longdevicename" }, AuthChainHelpers.GetAuthChainIds("longdevicename"));
}