public async Task DeviceCode_Not_Yet_Authorized() { deviceCode.IsAuthorized = false; var client = await _clients.FindClientByIdAsync("device_flow"); var service = Factory.CreateDeviceCodeService(); var handle = await service.StoreDeviceAuthorizationAsync(Guid.NewGuid().ToString(), deviceCode); var validator = Factory.CreateDeviceCodeValidator(service); var request = new ValidatedTokenRequest(); request.SetClient(client); var context = new DeviceCodeValidationContext { DeviceCode = handle, Request = request }; await validator.ValidateAsync(context); context.Result.IsError.Should().BeTrue(); context.Result.Error.Should().Be(OidcConstants.TokenErrors.AuthorizationPending); }
public async Task Expired_DeviceCode() { deviceCode.CreationTime = DateTime.UtcNow.AddDays(-10); deviceCode.Lifetime = 300; var client = await _clients.FindClientByIdAsync("device_flow"); var service = Factory.CreateDeviceCodeService(); var handle = await service.StoreDeviceAuthorizationAsync(Guid.NewGuid().ToString(), deviceCode); var validator = Factory.CreateDeviceCodeValidator(service); var request = new ValidatedTokenRequest(); request.SetClient(client); var context = new DeviceCodeValidationContext { DeviceCode = handle, Request = request }; await validator.ValidateAsync(context); context.Result.IsError.Should().BeTrue(); context.Result.Error.Should().Be(OidcConstants.TokenErrors.ExpiredToken); }
public async Task ValidateAsync(ExtensionGrantValidationContext context) { _logger.LogDebug("Start token request validation"); if (context == null) { throw new ArgumentNullException(nameof(context)); } var raw = context.Request.Raw; _validatedRequest = new ValidatedTokenRequest { Raw = raw ?? throw new ArgumentNullException(nameof(raw)), Options = _options }; var customTokenRequestValidationContext = new CustomTokenRequestValidationContext() { Result = new TokenRequestValidationResult(_validatedRequest) }; await _arbitraryNoSubjectRequestValidator.ValidateAsync(customTokenRequestValidationContext); if (customTokenRequestValidationContext.Result.IsError) { context.Result = new GrantValidationResult(TokenRequestErrors.InvalidRequest, customTokenRequestValidationContext.Result.Error); return; } var clientValidationResult = await _clientSecretValidator.ValidateAsync(_validatedRequest.Raw); if (clientValidationResult == null) { throw new ArgumentNullException(nameof(clientValidationResult)); } _validatedRequest.SetClient(clientValidationResult.Client, clientValidationResult.Secret); ///////////////////////////////////////////// // check grant type ///////////////////////////////////////////// var grantType = _validatedRequest.Raw.Get(OidcConstants.TokenRequest.GrantType); if (grantType.IsMissing()) { LogError("Grant type is missing"); context.Result = new GrantValidationResult(TokenRequestErrors.UnsupportedGrantType); return; } if (grantType.Length > _options.InputLengthRestrictions.GrantType) { LogError("Grant type is too long"); context.Result = new GrantValidationResult(TokenRequestErrors.UnsupportedGrantType); return; } _validatedRequest.GrantType = grantType; context.Result = new GrantValidationResult(); }
public async Task ValidateAsync(ExtensionGrantValidationContext context) { _logger.LogDebug("Start token request validation"); if (context == null) { throw new ArgumentNullException(nameof(context)); } var raw = context.Request.Raw; _validatedRequest = new ValidatedTokenRequest { Raw = raw ?? throw new ArgumentNullException(nameof(raw)), Options = _options }; var customTokenRequestValidationContext = new CustomTokenRequestValidationContext() { Result = new TokenRequestValidationResult(_validatedRequest) }; await _arbitraryNoSubjectRequestValidator.ValidateAsync(customTokenRequestValidationContext); if (customTokenRequestValidationContext.Result.IsError) { context.Result = new GrantValidationResult(TokenRequestErrors.InvalidRequest, customTokenRequestValidationContext.Result.Error); return; } var clientResult = await _clientValidator.ValidateAsync(_httpContextAccessor.HttpContext); if (!clientResult.IsError) { _validatedRequest.SetClient(clientResult.Client); } ///////////////////////////////////////////// // check grant type ///////////////////////////////////////////// var grantType = _validatedRequest.Raw.Get(OidcConstants.TokenRequest.GrantType); _validatedRequest.GrantType = grantType; context.Result = new GrantValidationResult(); }
public async Task DeviceCode_Missing() { var client = await _clients.FindClientByIdAsync("device_flow"); var service = Factory.CreateDeviceCodeService(); var validator = Factory.CreateDeviceCodeValidator(service); var request = new ValidatedTokenRequest(); request.SetClient(client); var context = new DeviceCodeValidationContext { DeviceCode = null, Request = request }; await validator.ValidateAsync(context); context.Result.IsError.Should().BeTrue(); context.Result.Error.Should().Be(OidcConstants.TokenErrors.InvalidGrant); }
public async Task Valid_DeviceCode() { var client = await _clients.FindClientByIdAsync("device_flow"); var service = Factory.CreateDeviceCodeService(); var handle = await service.StoreDeviceAuthorizationAsync(Guid.NewGuid().ToString(), deviceCode); var validator = Factory.CreateDeviceCodeValidator(service); var request = new ValidatedTokenRequest(); request.SetClient(client); var context = new DeviceCodeValidationContext { DeviceCode = handle, Request = request }; await validator.ValidateAsync(context); context.Result.IsError.Should().BeFalse(); }
public async Task DeviceCode_From_Different_Client() { var badActor = await _clients.FindClientByIdAsync("codeclient"); var service = Factory.CreateDeviceCodeService(); var handle = await service.StoreDeviceAuthorizationAsync(Guid.NewGuid().ToString(), deviceCode); var validator = Factory.CreateDeviceCodeValidator(service); var request = new ValidatedTokenRequest(); request.SetClient(badActor); var context = new DeviceCodeValidationContext { DeviceCode = handle, Request = request }; await validator.ValidateAsync(context); context.Result.IsError.Should().BeTrue(); context.Result.Error.Should().Be(OidcConstants.TokenErrors.InvalidGrant); }
public async Task DeviceCode_Polling_Too_Fast() { var client = await _clients.FindClientByIdAsync("device_flow"); var service = Factory.CreateDeviceCodeService(); var handle = await service.StoreDeviceAuthorizationAsync(Guid.NewGuid().ToString(), deviceCode); var validator = Factory.CreateDeviceCodeValidator(service, throttlingService: new TestDeviceFlowThrottlingService(true)); var request = new ValidatedTokenRequest(); request.SetClient(client); var context = new DeviceCodeValidationContext { DeviceCode = handle, Request = request }; await validator.ValidateAsync(context); context.Result.IsError.Should().BeTrue(); context.Result.Error.Should().Be(OidcConstants.TokenErrors.SlowDown); }
public async Task User_Disabled() { var client = await _clients.FindClientByIdAsync("device_flow"); var service = Factory.CreateDeviceCodeService(); var handle = await service.StoreDeviceAuthorizationAsync(Guid.NewGuid().ToString(), deviceCode); var validator = Factory.CreateDeviceCodeValidator(service, new TestProfileService(false)); var request = new ValidatedTokenRequest(); request.SetClient(client); var context = new DeviceCodeValidationContext { DeviceCode = handle, Request = request }; await validator.ValidateAsync(context); context.Result.IsError.Should().BeTrue(); context.Result.Error.Should().Be(OidcConstants.TokenErrors.InvalidGrant); }
public async Task ValidateAsync(ExtensionGrantValidationContext context) { _logger.LogDebug("Start token request validation"); if (context == null) { throw new ArgumentNullException(nameof(context)); } var raw = context.Request.Raw; _validatedRequest = new ValidatedTokenRequest { Raw = raw ?? throw new ArgumentNullException(nameof(raw)), Options = _options }; var customTokenRequestValidationContext = new CustomTokenRequestValidationContext() { Result = new TokenRequestValidationResult(_validatedRequest) }; await _arbitraryOpenIdConnectIdentityTokenRequestValidator.ValidateAsync(customTokenRequestValidationContext); if (customTokenRequestValidationContext.Result.IsError) { context.Result = new GrantValidationResult(TokenRequestErrors.InvalidRequest, customTokenRequestValidationContext.Result.Error); return; } var clientValidationResult = await _clientSecretValidator.ValidateAsync(_validatedRequest.Raw); if (clientValidationResult == null) { throw new ArgumentNullException(nameof(clientValidationResult)); } _validatedRequest.SetClient(clientValidationResult.Client, clientValidationResult.Secret); ///////////////////////////////////////////// // check grant type ///////////////////////////////////////////// var grantType = _validatedRequest.Raw.Get(OidcConstants.TokenRequest.GrantType); if (grantType.IsMissing()) { LogError("Grant type is missing"); context.Result = new GrantValidationResult(TokenRequestErrors.UnsupportedGrantType); return; } if (grantType.Length > _options.InputLengthRestrictions.GrantType) { LogError("Grant type is too long"); context.Result = new GrantValidationResult(TokenRequestErrors.UnsupportedGrantType); return; } // optional stuff; var accessTokenLifetimeOverride = _validatedRequest.Raw.Get(Constants.AccessTokenLifetime); if (!string.IsNullOrWhiteSpace(accessTokenLifetimeOverride)) { var accessTokenLifetime = Int32.Parse(accessTokenLifetimeOverride); if (accessTokenLifetime > 0 && accessTokenLifetime < context.Request.AccessTokenLifetime) { context.Request.AccessTokenLifetime = accessTokenLifetime; } else { var errorDescription = $"{Constants.AccessTokenLifetime} out of range. Must be > 0 and less than configured AccessTokenLifetime."; LogError(errorDescription); context.Result = new GrantValidationResult(TokenRequestErrors.InvalidRequest, errorDescription); return; } } var providerValidator = _providerValidatorManager.FetchProviderValidator(raw[Constants.Authority]); var idToken = raw[Constants.IdToken]; var principal = await providerValidator.ValidateToken(idToken); var subjectId = principal.GetClaimValue(ClaimTypes.NameIdentifier); var newPrincipal = principal.AddUpdateClaim(ClaimTypes.NameIdentifier, $"myCompany.{subjectId}"); principal = newPrincipal; _validatedRequest.GrantType = grantType; var resource = await _resourceStore.GetAllResourcesAsync(); // get user's identity _principalAugmenter.AugmentPrincipal(principal); var userClaimsFinal = new List <Claim>() { new Claim(Constants.ArbitraryClaims, raw[Constants.ArbitraryClaims]) }; userClaimsFinal.AddRange(principal.Claims); userClaimsFinal.Add(new Claim(ProfileServiceManager.Constants.ClaimKey, Constants.ArbitraryOpenIdConnectIdTokenProfileService)); context.Result = new GrantValidationResult(principal.GetNamedIdentifier(), Constants.ArbitraryOIDCResourceOwner, userClaimsFinal); }
public async Task ValidateAsync(ExtensionGrantValidationContext context) { _logger.LogDebug("Start token request validation"); if (context == null) { throw new ArgumentNullException(nameof(context)); } var contextClient = (context.Request.Client as ClientExtra).ShallowCopy(); context.Request.Client = contextClient; var raw = context.Request.Raw; _validatedRequest = new ValidatedTokenRequest { Raw = raw ?? throw new ArgumentNullException(nameof(raw)), Options = _options }; var customTokenRequestValidationContext = new CustomTokenRequestValidationContext() { Result = new TokenRequestValidationResult(_validatedRequest) }; await _arbitraryIdentityRequestValidator.ValidateAsync(customTokenRequestValidationContext); if (customTokenRequestValidationContext.Result.IsError) { context.Result = new GrantValidationResult(TokenRequestErrors.InvalidRequest, customTokenRequestValidationContext.Result.Error); return; } // validate HTTP for clients if (HttpMethods.IsPost(_httpContextAccessor.HttpContext.Request.Method) && _httpContextAccessor.HttpContext.Request.HasFormContentType) { // validate client var clientResult = await _clientValidator.ValidateAsync(_httpContextAccessor.HttpContext); if (!clientResult.IsError) { _validatedRequest.SetClient(clientResult.Client); } } ///////////////////////////////////////////// // check grant type ///////////////////////////////////////////// var grantType = _validatedRequest.Raw.Get(OidcConstants.TokenRequest.GrantType); _validatedRequest.GrantType = grantType; var resource = await _resourceStore.GetAllResourcesAsync(); var subject = ""; if (string.IsNullOrWhiteSpace(subject)) { subject = context.Request.Raw.Get("subject"); } // get user's identity var claims = new List <Claim> { new Claim(ClaimTypes.NameIdentifier, subject), new Claim("sub", subject), new Claim(JwtClaimTypes.IdentityProvider, _arbitraryIdentityExtensionGrantOptions.IdentityProvider) }; var principal = new ClaimsPrincipal(new ClaimsIdentity(claims)); _principalAugmenter.AugmentPrincipal(principal); var userClaimsFinal = new List <Claim>(); // optional stuff; var accessTokenLifetimeOverride = _validatedRequest.Raw.Get(Constants.AccessTokenLifetime); if (!string.IsNullOrWhiteSpace(accessTokenLifetimeOverride)) { int accessTokenLifetime = 0; bool error = true; if (Int32.TryParse(accessTokenLifetimeOverride, out accessTokenLifetime)) { if (accessTokenLifetime > 0 && accessTokenLifetime <= context.Request.AccessTokenLifetime) { context.Request.AccessTokenLifetime = accessTokenLifetime; error = false; } } if (error) { var errorDescription = $"{Constants.AccessTokenLifetime} out of range. Must be > 0 and <= configured AccessTokenLifetime."; LogError(errorDescription); context.Result = new GrantValidationResult(TokenRequestErrors.InvalidRequest, errorDescription); return; } } // optional stuff; var idTokenLifetimeOverride = _validatedRequest.Raw.Get(Constants.IdTokenLifetime); if (!string.IsNullOrWhiteSpace(idTokenLifetimeOverride)) { int idTokenLifetime = 0; bool error = true; if (Int32.TryParse(idTokenLifetimeOverride, out idTokenLifetime)) { if (idTokenLifetime > 0 && idTokenLifetime <= context.Request.Client.IdentityTokenLifetime) { context.Request.Client.IdentityTokenLifetime = idTokenLifetime; error = false; } } if (error) { var errorDescription = $"{Constants.IdTokenLifetime} out of range. Must be > 0 and <= configured IdentityTokenLifetime."; LogError(errorDescription); context.Result = new GrantValidationResult(TokenRequestErrors.InvalidRequest, errorDescription); return; } } context.Result = new GrantValidationResult( principal.GetSubjectId(), ArbitraryIdentityExtensionGrant.Constants.ArbitraryIdentity, userClaimsFinal, _arbitraryIdentityExtensionGrantOptions.IdentityProvider); }
/// <summary> /// Validates the request. /// </summary> /// <param name="parameters">The parameters.</param> /// <param name="clientValidationResult">The client validation result.</param> /// <returns></returns> /// <exception cref="System.ArgumentNullException"> /// parameters /// or /// client /// </exception> public async Task <TokenRequestValidationResult> ValidateRequestAsync(NameValueCollection parameters, ClientSecretValidationResult clientValidationResult) { using var activity = Tracing.BasicActivitySource.StartActivity("TokenRequestValidator.ValidateRequest"); _logger.LogDebug("Start token request validation"); _validatedRequest = new ValidatedTokenRequest { IssuerName = await _issuerNameService.GetCurrentAsync(), Raw = parameters ?? throw new ArgumentNullException(nameof(parameters)), Options = _options }; if (clientValidationResult == null) { throw new ArgumentNullException(nameof(clientValidationResult)); } _validatedRequest.SetClient(clientValidationResult.Client, clientValidationResult.Secret, clientValidationResult.Confirmation); ///////////////////////////////////////////// // check client protocol type ///////////////////////////////////////////// if (_validatedRequest.Client.ProtocolType != IdentityServerConstants.ProtocolTypes.OpenIdConnect) { LogError("Invalid protocol type for client", new { clientId = _validatedRequest.Client.ClientId, expectedProtocolType = IdentityServerConstants.ProtocolTypes.OpenIdConnect, actualProtocolType = _validatedRequest.Client.ProtocolType }); return(Invalid(OidcConstants.TokenErrors.InvalidClient)); } ///////////////////////////////////////////// // check grant type ///////////////////////////////////////////// var grantType = parameters.Get(OidcConstants.TokenRequest.GrantType); if (grantType.IsMissing()) { LogError("Grant type is missing"); return(Invalid(OidcConstants.TokenErrors.UnsupportedGrantType)); } if (grantType.Length > _options.InputLengthRestrictions.GrantType) { LogError("Grant type is too long"); return(Invalid(OidcConstants.TokenErrors.UnsupportedGrantType)); } _validatedRequest.GrantType = grantType; ////////////////////////////////////////////////////////// // check for resource indicator and basic formatting ////////////////////////////////////////////////////////// var resourceIndicators = parameters.GetValues(OidcConstants.TokenRequest.Resource) ?? Enumerable.Empty <string>(); if (resourceIndicators?.Any(x => x.Length > _options.InputLengthRestrictions.ResourceIndicatorMaxLength) == true) { return(Invalid(OidcConstants.AuthorizeErrors.InvalidTarget, "Resource indicator maximum length exceeded")); } if (!resourceIndicators.AreValidResourceIndicatorFormat(_logger)) { return(Invalid(OidcConstants.AuthorizeErrors.InvalidTarget, "Invalid resource indicator format")); } if (resourceIndicators.Count() > 1) { return(Invalid(OidcConstants.AuthorizeErrors.InvalidTarget, "Multiple resource indicators not supported on token endpoint.")); } _validatedRequest.RequestedResourceIndicator = resourceIndicators.SingleOrDefault(); ////////////////////////////////////////////////////////// // run specific logic for grants ////////////////////////////////////////////////////////// switch (grantType) { case OidcConstants.GrantTypes.AuthorizationCode: return(await RunValidationAsync(ValidateAuthorizationCodeRequestAsync, parameters)); case OidcConstants.GrantTypes.ClientCredentials: return(await RunValidationAsync(ValidateClientCredentialsRequestAsync, parameters)); case OidcConstants.GrantTypes.Password: return(await RunValidationAsync(ValidateResourceOwnerCredentialRequestAsync, parameters)); case OidcConstants.GrantTypes.RefreshToken: return(await RunValidationAsync(ValidateRefreshTokenRequestAsync, parameters)); case OidcConstants.GrantTypes.DeviceCode: return(await RunValidationAsync(ValidateDeviceCodeRequestAsync, parameters)); case OidcConstants.GrantTypes.Ciba: return(await RunValidationAsync(ValidateCibaRequestRequestAsync, parameters)); default: return(await RunValidationAsync(ValidateExtensionGrantRequestAsync, parameters)); } }
public async Task ValidateAsync(ExtensionGrantValidationContext context) { _logger.LogDebug("Start token request validation"); if (context == null) { throw new ArgumentNullException(nameof(context)); } var raw = context.Request.Raw; _validatedRequest = new ValidatedTokenRequest { Raw = raw ?? throw new ArgumentNullException(nameof(raw)), Options = _options }; var customTokenRequestValidationContext = new CustomTokenRequestValidationContext() { Result = new TokenRequestValidationResult(_validatedRequest) }; await _arbitraryResourceOwnerRequestValidator.ValidateAsync(customTokenRequestValidationContext); if (customTokenRequestValidationContext.Result.IsError) { context.Result = new GrantValidationResult(TokenRequestErrors.InvalidRequest, customTokenRequestValidationContext.Result.Error); return; } var clientValidationResult = await _clientSecretValidator.ValidateAsync(_validatedRequest.Raw); if (clientValidationResult == null) { throw new ArgumentNullException(nameof(clientValidationResult)); } _validatedRequest.SetClient(clientValidationResult.Client, clientValidationResult.Secret); ///////////////////////////////////////////// // check grant type ///////////////////////////////////////////// var grantType = _validatedRequest.Raw.Get(OidcConstants.TokenRequest.GrantType); if (grantType.IsMissing()) { LogError("Grant type is missing"); context.Result = new GrantValidationResult(TokenRequestErrors.UnsupportedGrantType); return; } if (grantType.Length > _options.InputLengthRestrictions.GrantType) { LogError("Grant type is too long"); context.Result = new GrantValidationResult(TokenRequestErrors.UnsupportedGrantType); return; } _validatedRequest.GrantType = grantType; var resource = await _resourceStore.GetAllResourcesAsync(); var subject = ""; Claim originAuthTimeClaim = null; // if access_token exists, it wins. var accessToken = context.Request.Raw.Get("access_token"); if (!string.IsNullOrWhiteSpace(accessToken)) { var validateAccessToken = await _tokenValidator.ValidateAccessTokenAsync(accessToken); var queryClaims = from item in validateAccessToken.Claims where item.Type == JwtClaimTypes.Subject select item.Value; subject = queryClaims.FirstOrDefault(); originAuthTimeClaim = (from item in validateAccessToken.Claims where item.Type == $"origin_{JwtClaimTypes.AuthenticationTime}" select item).FirstOrDefault(); if (originAuthTimeClaim == null) { var authTimeClaim = (from item in validateAccessToken.Claims where item.Type == JwtClaimTypes.AuthenticationTime select item).FirstOrDefault(); originAuthTimeClaim = new Claim($"origin_{JwtClaimTypes.AuthenticationTime}", authTimeClaim.Value); } } if (string.IsNullOrWhiteSpace(subject)) { subject = context.Request.Raw.Get("subject"); } // get user's identity var claims = new List <Claim> { new Claim(ClaimTypes.NameIdentifier, subject), new Claim("sub", subject) }; var principal = new ClaimsPrincipal(new ClaimsIdentity(claims)); _principalAugmenter.AugmentPrincipal(principal); var userClaimsFinal = new List <Claim>() { }; // optional stuff; var accessTokenLifetimeOverride = _validatedRequest.Raw.Get(Constants.AccessTokenLifetime); if (!string.IsNullOrWhiteSpace(accessTokenLifetimeOverride)) { var accessTokenLifetime = Int32.Parse(accessTokenLifetimeOverride); if (accessTokenLifetime > 0 && accessTokenLifetime < context.Request.AccessTokenLifetime) { context.Request.AccessTokenLifetime = accessTokenLifetime; } else { var errorDescription = $"{Constants.AccessTokenLifetime} out of range. Must be > 0 and less than configured AccessTokenLifetime."; LogError(errorDescription); context.Result = new GrantValidationResult(TokenRequestErrors.InvalidRequest, errorDescription); return; } } // userClaimsFinal.Add(new Claim(ProfileServiceManager.Constants.ClaimKey, Constants.ArbitraryResourceOwnerProfileService)); if (originAuthTimeClaim != null) { userClaimsFinal.Add(originAuthTimeClaim); } context.Result = new GrantValidationResult(principal.GetSubjectId(), ArbitraryResourceOwnerExtensionGrant.Constants.ArbitraryResourceOwner, userClaimsFinal); }
/// <summary> /// Validates the request. /// </summary> /// <param name="parameters">The parameters.</param> /// <param name="clientValidationResult">The client validation result.</param> /// <returns></returns> /// <exception cref="System.ArgumentNullException"> /// parameters /// or /// client /// </exception> public async Task <TokenRequestValidationResult> ValidateRequestAsync(NameValueCollection parameters, ClientSecretValidationResult clientValidationResult) { _logger.LogDebug("Start token request validation"); _validatedRequest = new ValidatedTokenRequest { Raw = parameters ?? throw new ArgumentNullException(nameof(parameters)), Options = _options }; if (clientValidationResult == null) { throw new ArgumentNullException(nameof(clientValidationResult)); } _validatedRequest.SetClient(clientValidationResult.Client, clientValidationResult.Secret, clientValidationResult.Confirmation); ///////////////////////////////////////////// // check client protocol type ///////////////////////////////////////////// if (_validatedRequest.Client.ProtocolType != IdentityServerConstants.ProtocolTypes.OpenIdConnect) { LogError("Invalid protocol type for client", new { clientId = _validatedRequest.Client.ClientId, expectedProtocolType = IdentityServerConstants.ProtocolTypes.OpenIdConnect, actualProtocolType = _validatedRequest.Client.ProtocolType }); return(Invalid(OidcConstants.TokenErrors.InvalidClient)); } ///////////////////////////////////////////// // check grant type ///////////////////////////////////////////// var grantType = parameters.Get(OidcConstants.TokenRequest.GrantType); if (grantType.IsMissing()) { LogError("Grant type is missing"); return(Invalid(OidcConstants.TokenErrors.UnsupportedGrantType)); } if (grantType.Length > _options.InputLengthRestrictions.GrantType) { LogError("Grant type is too long"); return(Invalid(OidcConstants.TokenErrors.UnsupportedGrantType)); } _validatedRequest.GrantType = grantType; switch (grantType) { //case OidcConstants.GrantTypes.AuthorizationCode: // return await RunValidationAsync(ValidateAuthorizationCodeRequestAsync, parameters); case OidcConstants.GrantTypes.ClientCredentials: return(await RunValidationAsync(ValidateClientCredentialsRequestAsync, parameters)); case OidcConstants.GrantTypes.Password: return(await RunValidationAsync(ValidateResourceOwnerCredentialRequestAsync, parameters)); case OidcConstants.GrantTypes.RefreshToken: return(await RunValidationAsync(ValidateRefreshTokenRequestAsync, parameters)); case OidcConstants.GrantTypes.DeviceCode: return(await RunValidationAsync(ValidateDeviceCodeRequestAsync, parameters)); default: return(await RunValidationAsync(ValidateExtensionGrantRequestAsync, parameters)); } }
public async Task ValidateAsync(ExtensionGrantValidationContext context) { _logger.LogDebug("Start token request validation"); if (context == null) { throw new ArgumentNullException(nameof(context)); } var raw = context.Request.Raw; _validatedRequest = new ValidatedTokenRequest { Raw = raw ?? throw new ArgumentNullException(nameof(raw)), Options = _options }; var customTokenRequestValidationContext = new CustomTokenRequestValidationContext() { Result = new TokenRequestValidationResult(_validatedRequest) }; await _arbitraryResourceOwnerRequestValidator.ValidateAsync(customTokenRequestValidationContext); if (customTokenRequestValidationContext.Result.IsError) { context.Result = new GrantValidationResult(TokenRequestErrors.InvalidRequest, customTokenRequestValidationContext.Result.Error); return; } var clientResult = await _clientValidator.ValidateAsync(_httpContextAccessor.HttpContext); if (!clientResult.IsError) { _validatedRequest.SetClient(clientResult.Client); } ///////////////////////////////////////////// // get the grant type // NOTE: The identityserver4 pipeline before us validated to obvious stuff ///////////////////////////////////////////// var grantType = _validatedRequest.Raw.Get(OidcConstants.TokenRequest.GrantType); _validatedRequest.GrantType = grantType; var subject = ""; if (string.IsNullOrWhiteSpace(subject)) { subject = context.Request.Raw.Get("subject"); } // get user's identity var claims = new List <Claim> { new Claim(ClaimTypes.NameIdentifier, subject), new Claim("sub", subject) }; var principal = new ClaimsPrincipal(new ClaimsIdentity(claims)); _principalAugmenter.AugmentPrincipal(principal); // optional stuff; var accessTokenLifetimeOverride = _validatedRequest.Raw.Get(Constants.AccessTokenLifetime); if (!string.IsNullOrWhiteSpace(accessTokenLifetimeOverride)) { int accessTokenLifetime = 0; bool error = true; if (Int32.TryParse(accessTokenLifetimeOverride, out accessTokenLifetime)) { if (accessTokenLifetime > 0 && accessTokenLifetime <= context.Request.AccessTokenLifetime) { context.Request.AccessTokenLifetime = accessTokenLifetime; error = false; } } if (error) { var errorDescription = $"{Constants.AccessTokenLifetime} out of range. Must be > 0 and <= configured AccessTokenLifetime."; LogError(errorDescription); context.Result = new GrantValidationResult(TokenRequestErrors.InvalidRequest, errorDescription); return; } } context.Result = new GrantValidationResult(principal.GetSubjectId(), ArbitraryResourceOwnerExtensionGrant.Constants.ArbitraryResourceOwner); }