private async Task <bool> HandleChallengeAsync(AuthenticationResponseChallenge context)
{
// Extract the OpenID Connect request from the OWIN/Katana context.
// If it cannot be found or doesn't correspond to an authorization
// or a token request, throw an InvalidOperationException.
var request = Context.GetOpenIdConnectRequest();
if (request == null || (!request.IsAuthorizationRequest() && !request.IsTokenRequest()))
{
throw new InvalidOperationException("An authorization or token response cannot be returned from this endpoint.");
}
// Note: if a response was already generated, throw an exception.
var response = Context.GetOpenIdConnectResponse();
if (response != null)
{
throw new InvalidOperationException("A response has already been sent.");
}
// Create a new ticket containing an empty identity and
// the authentication properties extracted from the challenge.
var ticket = new AuthenticationTicket(new ClaimsIdentity(), context.Properties);
// Prepare a new OpenID Connect response.
response = new OpenIdConnectResponse
{
Error = ticket.GetProperty(OpenIdConnectConstants.Properties.Error),
ErrorDescription = ticket.GetProperty(OpenIdConnectConstants.Properties.ErrorDescription),
ErrorUri = ticket.GetProperty(OpenIdConnectConstants.Properties.ErrorUri)
};
// Remove the error/error_description/error_uri properties from the ticket.
ticket.RemoveProperty(OpenIdConnectConstants.Properties.Error)
.RemoveProperty(OpenIdConnectConstants.Properties.ErrorDescription)
.RemoveProperty(OpenIdConnectConstants.Properties.ErrorUri);
if (string.IsNullOrEmpty(response.Error))
{
response.Error = request.IsAuthorizationRequest() ?
OpenIdConnectConstants.Errors.AccessDenied :
OpenIdConnectConstants.Errors.InvalidGrant;
}
if (string.IsNullOrEmpty(response.ErrorDescription))
{
response.ErrorDescription = request.IsAuthorizationRequest() ?
"The authorization was denied by the resource owner." :
"The token request was rejected by the authorization server.";
}
Logger.LogTrace("A challenge operation was triggered: {Properties}.", context.Properties.Dictionary);
if (request.IsAuthorizationRequest())
{
return(await SendAuthorizationResponseAsync(response, ticket));
}
return(await SendTokenResponseAsync(response, ticket));
}
private async Task <string> SerializeAuthorizationCodeAsync(
ClaimsIdentity identity, AuthenticationProperties properties,
OpenIdConnectRequest request, OpenIdConnectResponse response)
{
// Note: claims in authorization codes are never filtered as they are supposed to be opaque:
// SerializeAccessTokenAsync and SerializeIdentityTokenAsync are responsible of ensuring
// that subsequent access and identity tokens are correctly filtered.
// Create a new ticket containing the updated properties.
var ticket = new AuthenticationTicket(identity, properties);
ticket.Properties.IssuedUtc = Options.SystemClock.UtcNow;
ticket.Properties.ExpiresUtc = ticket.Properties.IssuedUtc +
(ticket.GetAuthorizationCodeLifetime() ?? Options.AuthorizationCodeLifetime);
ticket.SetUsage(OpenIdConnectConstants.Usages.AuthorizationCode);
// Associate a random identifier with the authorization code.
ticket.SetTicketId(Guid.NewGuid().ToString());
// Store the code_challenge, code_challenge_method and nonce parameters for later comparison.
ticket.SetProperty(OpenIdConnectConstants.Properties.CodeChallenge, request.CodeChallenge)
.SetProperty(OpenIdConnectConstants.Properties.CodeChallengeMethod, request.CodeChallengeMethod)
.SetProperty(OpenIdConnectConstants.Properties.Nonce, request.Nonce);
// Store the original redirect_uri sent by the client application for later comparison.
ticket.SetProperty(OpenIdConnectConstants.Properties.RedirectUri,
request.GetProperty <string>(OpenIdConnectConstants.Properties.OriginalRedirectUri));
// Remove the unwanted properties from the authentication ticket.
ticket.RemoveProperty(OpenIdConnectConstants.Properties.AuthorizationCodeLifetime)
.RemoveProperty(OpenIdConnectConstants.Properties.ClientId);
var notification = new SerializeAuthorizationCodeContext(Context, Options, request, response, ticket)
{
DataFormat = Options.AuthorizationCodeFormat
};
await Options.Provider.SerializeAuthorizationCode(notification);
if (notification.HandledResponse || !string.IsNullOrEmpty(notification.AuthorizationCode))
{
return(notification.AuthorizationCode);
}
else if (notification.Skipped)
{
return(null);
}
if (notification.DataFormat == null)
{
return(null);
}
return(notification.DataFormat.Protect(ticket));
}
private async Task <string> SerializeRefreshTokenAsync(
ClaimsPrincipal principal, AuthenticationProperties properties,
OpenIdConnectRequest request, OpenIdConnectResponse response)
{
// Note: claims in refresh tokens are never filtered as they are supposed to be opaque:
// SerializeAccessTokenAsync and SerializeIdentityTokenAsync are responsible of ensuring
// that subsequent access and identity tokens are correctly filtered.
// Create a new ticket containing the updated properties.
var ticket = new AuthenticationTicket(principal, properties, Scheme.Name);
ticket.Properties.IssuedUtc = Options.SystemClock.UtcNow;
// Only set the expiration date if a lifetime was specified in either the ticket or the options.
var lifetime = ticket.GetRefreshTokenLifetime() ?? Options.RefreshTokenLifetime;
if (lifetime.HasValue)
{
ticket.Properties.ExpiresUtc = ticket.Properties.IssuedUtc + lifetime.Value;
}
// Associate a random identifier with the refresh token.
ticket.SetTokenId(Guid.NewGuid().ToString());
// Remove the unwanted properties from the authentication ticket.
ticket.RemoveProperty(OpenIdConnectConstants.Properties.AuthorizationCodeLifetime)
.RemoveProperty(OpenIdConnectConstants.Properties.CodeChallenge)
.RemoveProperty(OpenIdConnectConstants.Properties.CodeChallengeMethod)
.RemoveProperty(OpenIdConnectConstants.Properties.Nonce)
.RemoveProperty(OpenIdConnectConstants.Properties.OriginalRedirectUri)
.RemoveProperty(OpenIdConnectConstants.Properties.TokenUsage);
var notification = new SerializeRefreshTokenContext(Context, Scheme, Options, request, response, ticket)
{
DataFormat = Options.RefreshTokenFormat
};
await Provider.SerializeRefreshToken(notification);
if (notification.IsHandled || !string.IsNullOrEmpty(notification.RefreshToken))
{
return(notification.RefreshToken);
}
if (notification.DataFormat == null)
{
throw new InvalidOperationException("A data formatter must be provided.");
}
var result = notification.DataFormat.Protect(ticket);
Logger.LogTrace("A new refresh token was successfully generated using the " +
"specified data format: {Token} ; {Claims} ; {Properties}.",
result, ticket.Principal.Claims, ticket.Properties.Items);
return(result);
}
private async Task <string> SerializeAuthorizationCodeAsync(
ClaimsIdentity identity, AuthenticationProperties properties,
OpenIdConnectRequest request, OpenIdConnectResponse response)
{
// Note: claims in authorization codes are never filtered as they are supposed to be opaque:
// SerializeAccessTokenAsync and SerializeIdentityTokenAsync are responsible of ensuring
// that subsequent access and identity tokens are correctly filtered.
// Create a new ticket containing the updated properties.
var ticket = new AuthenticationTicket(identity, properties);
ticket.Properties.IssuedUtc = Options.SystemClock.UtcNow;
ticket.Properties.ExpiresUtc = ticket.Properties.IssuedUtc;
ticket.Properties.ExpiresUtc += ticket.GetAuthorizationCodeLifetime() ?? Options.AuthorizationCodeLifetime;
// Associate a random identifier with the authorization code.
ticket.SetTokenId(Guid.NewGuid().ToString());
// Store the code_challenge, code_challenge_method and nonce parameters for later comparison.
ticket.SetProperty(OpenIdConnectConstants.Properties.CodeChallenge, request.CodeChallenge)
.SetProperty(OpenIdConnectConstants.Properties.CodeChallengeMethod, request.CodeChallengeMethod)
.SetProperty(OpenIdConnectConstants.Properties.Nonce, request.Nonce);
// Store the original redirect_uri sent by the client application for later comparison.
ticket.SetProperty(OpenIdConnectConstants.Properties.OriginalRedirectUri,
request.GetProperty <string>(OpenIdConnectConstants.Properties.OriginalRedirectUri));
// Remove the unwanted properties from the authentication ticket.
ticket.RemoveProperty(OpenIdConnectConstants.Properties.AuthorizationCodeLifetime)
.RemoveProperty(OpenIdConnectConstants.Properties.TokenUsage);
var notification = new SerializeAuthorizationCodeContext(Context, Options, request, response, ticket)
{
DataFormat = Options.AuthorizationCodeFormat
};
await Options.Provider.SerializeAuthorizationCode(notification);
if (notification.IsHandled || !string.IsNullOrEmpty(notification.AuthorizationCode))
{
return(notification.AuthorizationCode);
}
if (notification.DataFormat == null)
{
throw new InvalidOperationException("A data formatter must be provided.");
}
var result = notification.DataFormat.Protect(ticket);
Logger.LogTrace("A new authorization code was successfully generated using " +
"the specified data format: {Code} ; {Claims} ; {Properties}.",
result, ticket.Identity.Claims, ticket.Properties.Dictionary);
return(result);
}
private async Task <string> SerializeRefreshTokenAsync(
ClaimsPrincipal principal, AuthenticationProperties properties,
OpenIdConnectRequest request, OpenIdConnectResponse response)
{
// Note: claims in refresh tokens are never filtered as they are supposed to be opaque:
// SerializeAccessTokenAsync and SerializeIdentityTokenAsync are responsible of ensuring
// that subsequent access and identity tokens are correctly filtered.
// Create a new ticket containing the updated properties.
var ticket = new AuthenticationTicket(principal, properties, Options.AuthenticationScheme);
ticket.Properties.IssuedUtc = Options.SystemClock.UtcNow;
ticket.Properties.ExpiresUtc = ticket.Properties.IssuedUtc +
(ticket.GetRefreshTokenLifetime() ?? Options.RefreshTokenLifetime);
ticket.SetUsage(OpenIdConnectConstants.Usages.RefreshToken);
// Associate a random identifier with the refresh token.
ticket.SetTicketId(Guid.NewGuid().ToString());
// Remove the unwanted properties from the authentication ticket.
ticket.RemoveProperty(OpenIdConnectConstants.Properties.AuthorizationCodeLifetime)
.RemoveProperty(OpenIdConnectConstants.Properties.ClientId)
.RemoveProperty(OpenIdConnectConstants.Properties.CodeChallenge)
.RemoveProperty(OpenIdConnectConstants.Properties.CodeChallengeMethod)
.RemoveProperty(OpenIdConnectConstants.Properties.Nonce)
.RemoveProperty(OpenIdConnectConstants.Properties.RedirectUri);
var notification = new SerializeRefreshTokenContext(Context, Options, request, response, ticket)
{
DataFormat = Options.RefreshTokenFormat
};
await Options.Provider.SerializeRefreshToken(notification);
if (notification.HandledResponse || !string.IsNullOrEmpty(notification.RefreshToken))
{
return(notification.RefreshToken);
}
else if (notification.Skipped)
{
return(null);
}
if (!ReferenceEquals(ticket, notification.Ticket))
{
throw new InvalidOperationException("The authentication ticket cannot be replaced.");
}
return(notification.DataFormat?.Protect(ticket));
}
public void RemoveProperty_RemovesProperty()
{
// Arrange
var ticket = new AuthenticationTicket(
new ClaimsIdentity(),
new AuthenticationProperties());
ticket.AddProperty("property", "value");
// Act
ticket.RemoveProperty("property");
// Assert
Assert.Null(ticket.GetProperty("property"));
}
private async Task <string> CreateTokenAsync(
[NotNull] string type, [NotNull] AuthenticationTicket ticket,
[NotNull] OpenIddictOptions options, [NotNull] HttpContext context,
[NotNull] OpenIdConnectRequest request,
[NotNull] ISecureDataFormat <AuthenticationTicket> format)
{
Debug.Assert(!(options.DisableTokenRevocation && options.UseReferenceTokens),
"Token revocation cannot be disabled when using reference tokens.");
Debug.Assert(type == OpenIdConnectConstants.TokenUsages.AccessToken ||
type == OpenIdConnectConstants.TokenUsages.AuthorizationCode ||
type == OpenIdConnectConstants.TokenUsages.RefreshToken,
"Only authorization codes, access and refresh tokens should be created using this method.");
// When sliding expiration is disabled, the expiration date of generated refresh tokens is fixed
// and must exactly match the expiration date of the refresh token used in the token request.
if (request.IsTokenRequest() && request.IsRefreshTokenGrantType() &&
!options.UseSlidingExpiration && type == OpenIdConnectConstants.TokenUsages.RefreshToken)
{
var properties = request.GetProperty <AuthenticationTicket>(
OpenIddictConstants.Properties.AuthenticationTicket)?.Properties;
Debug.Assert(properties != null, "The authentication properties shouldn't be null.");
ticket.Properties.ExpiresUtc = properties.ExpiresUtc;
}
if (options.DisableTokenRevocation)
{
return(null);
}
var descriptor = new OpenIddictTokenDescriptor
{
AuthorizationId = ticket.GetProperty(OpenIddictConstants.Properties.AuthorizationId),
CreationDate = ticket.Properties.IssuedUtc,
ExpirationDate = ticket.Properties.ExpiresUtc,
Principal = ticket.Principal,
Status = OpenIddictConstants.Statuses.Valid,
Subject = ticket.Principal.GetClaim(OpenIdConnectConstants.Claims.Subject),
Type = type
};
foreach (var property in ticket.Properties.Items)
{
descriptor.Properties.Add(property);
}
string result = null;
// When reference tokens are enabled or when the token is an authorization code or a
// refresh token, remove the unnecessary properties from the authentication ticket.
if (options.UseReferenceTokens ||
(type == OpenIdConnectConstants.TokenUsages.AuthorizationCode ||
type == OpenIdConnectConstants.TokenUsages.RefreshToken))
{
ticket.Properties.IssuedUtc = ticket.Properties.ExpiresUtc = null;
ticket.RemoveProperty(OpenIddictConstants.Properties.AuthorizationId)
.RemoveProperty(OpenIdConnectConstants.Properties.TokenId);
}
// If reference tokens are enabled, create a new entry for
// authorization codes, refresh tokens and access tokens.
if (options.UseReferenceTokens)
{
// Note: the data format is automatically replaced at startup time to ensure
// that encrypted tokens stored in the database cannot be considered as
// valid tokens if the developer decides to disable reference tokens support.
descriptor.Ciphertext = format.Protect(ticket);
// Generate a new crypto-secure random identifier that will be
// substituted to the ciphertext returned by the data format.
var bytes = new byte[256 / 8];
options.RandomNumberGenerator.GetBytes(bytes);
result = Base64UrlEncoder.Encode(bytes);
// Compute the digest of the generated identifier and use
// it as the hashed identifier of the reference token.
// Doing that prevents token identifiers stolen from
// the database from being used as valid reference tokens.
using (var algorithm = SHA256.Create())
{
descriptor.Hash = Convert.ToBase64String(algorithm.ComputeHash(bytes));
}
}
// Otherwise, only create a token metadata entry for authorization codes and refresh tokens.
else if (type != OpenIdConnectConstants.TokenUsages.AuthorizationCode &&
type != OpenIdConnectConstants.TokenUsages.RefreshToken)
{
return(null);
}
// If the client application is known, associate it with the token.
if (!string.IsNullOrEmpty(request.ClientId))
{
var application = await Applications.FindByClientIdAsync(request.ClientId, context.RequestAborted);
if (application == null)
{
throw new InvalidOperationException("The client application cannot be retrieved from the database.");
}
descriptor.ApplicationId = await Applications.GetIdAsync(application, context.RequestAborted);
}
// If a null value was returned by CreateAsync(), return immediately.
var token = await Tokens.CreateAsync(descriptor, context.RequestAborted);
if (token == null)
{
return(null);
}
// Throw an exception if the token identifier can't be resolved.
var identifier = await Tokens.GetIdAsync(token, context.RequestAborted);
if (string.IsNullOrEmpty(identifier))
{
throw new InvalidOperationException("The unique key associated with a refresh token cannot be null or empty.");
}
// Restore the token identifier using the unique
// identifier attached with the database entry.
ticket.SetTokenId(identifier);
// Dynamically set the creation and expiration dates.
ticket.Properties.IssuedUtc = descriptor.CreationDate;
ticket.Properties.ExpiresUtc = descriptor.ExpirationDate;
// Restore the authorization identifier using the identifier attached with the database entry.
ticket.SetProperty(OpenIddictConstants.Properties.AuthorizationId, descriptor.AuthorizationId);
if (!string.IsNullOrEmpty(result))
{
Logger.LogTrace("A new reference token was successfully generated and persisted " +
"in the database: {Token} ; {Claims} ; {Properties}.",
result, ticket.Principal.Claims, ticket.Properties.Items);
}
return(result);
}
private async Task <string> SerializeAccessTokenAsync(
ClaimsPrincipal principal, AuthenticationProperties properties,
OpenIdConnectRequest request, OpenIdConnectResponse response)
{
// Create a new principal containing only the filtered claims.
// Actors identities are also filtered (delegation scenarios).
principal = principal.Clone(claim =>
{
// Never exclude the subject claim.
if (string.Equals(claim.Type, OpenIdConnectConstants.Claims.Subject, StringComparison.OrdinalIgnoreCase))
{
return(true);
}
// Claims whose destination is not explicitly referenced or doesn't
// contain "access_token" are not included in the access token.
if (!claim.HasDestination(OpenIdConnectConstants.Destinations.AccessToken))
{
Logger.LogDebug("'{Claim}' was excluded from the access token claims.", claim.Type);
return(false);
}
return(true);
});
// Remove the destinations from the claim properties.
foreach (var claim in principal.Claims)
{
claim.Properties.Remove(OpenIdConnectConstants.Properties.Destinations);
}
var identity = (ClaimsIdentity)principal.Identity;
// Create a new ticket containing the updated properties and the filtered principal.
var ticket = new AuthenticationTicket(principal, properties, Options.AuthenticationScheme);
ticket.Properties.IssuedUtc = Options.SystemClock.UtcNow;
ticket.Properties.ExpiresUtc = ticket.Properties.IssuedUtc +
(ticket.GetAccessTokenLifetime() ?? Options.AccessTokenLifetime);
ticket.SetUsage(OpenIdConnectConstants.Usages.AccessToken);
ticket.SetAudiences(ticket.GetResources());
// Associate a random identifier with the access token.
ticket.SetTicketId(Guid.NewGuid().ToString());
// Remove the unwanted properties from the authentication ticket.
ticket.RemoveProperty(OpenIdConnectConstants.Properties.AccessTokenLifetime)
.RemoveProperty(OpenIdConnectConstants.Properties.AuthorizationCodeLifetime)
.RemoveProperty(OpenIdConnectConstants.Properties.ClientId)
.RemoveProperty(OpenIdConnectConstants.Properties.CodeChallenge)
.RemoveProperty(OpenIdConnectConstants.Properties.CodeChallengeMethod)
.RemoveProperty(OpenIdConnectConstants.Properties.IdentityTokenLifetime)
.RemoveProperty(OpenIdConnectConstants.Properties.Nonce)
.RemoveProperty(OpenIdConnectConstants.Properties.RedirectUri)
.RemoveProperty(OpenIdConnectConstants.Properties.RefreshTokenLifetime);
var notification = new SerializeAccessTokenContext(Context, Options, request, response, ticket)
{
DataFormat = Options.AccessTokenFormat,
Issuer = Context.GetIssuer(Options),
SecurityTokenHandler = Options.AccessTokenHandler,
SigningCredentials = Options.SigningCredentials.FirstOrDefault(key => key.Key is SymmetricSecurityKey) ??
Options.SigningCredentials.FirstOrDefault()
};
await Options.Provider.SerializeAccessToken(notification);
if (notification.HandledResponse || !string.IsNullOrEmpty(notification.AccessToken))
{
return(notification.AccessToken);
}
else if (notification.Skipped)
{
return(null);
}
if (!ReferenceEquals(ticket, notification.Ticket))
{
throw new InvalidOperationException("The authentication ticket cannot be replaced.");
}
if (notification.SecurityTokenHandler == null)
{
return(notification.DataFormat?.Protect(ticket));
}
// At this stage, throw an exception if no signing credentials were provided.
if (notification.SigningCredentials == null)
{
throw new InvalidOperationException("A signing key must be provided.");
}
// Extract the main identity from the principal.
identity = (ClaimsIdentity)ticket.Principal.Identity;
// Store the "unique_id" property as a claim.
identity.AddClaim(OpenIdConnectConstants.Claims.JwtId, ticket.GetTicketId());
// Store the "usage" property as a claim.
identity.AddClaim(OpenIdConnectConstants.Claims.Usage, ticket.GetUsage());
// Store the "confidentiality_level" property as a claim.
var confidentiality = ticket.GetProperty(OpenIdConnectConstants.Properties.ConfidentialityLevel);
if (!string.IsNullOrEmpty(confidentiality))
{
identity.AddClaim(OpenIdConnectConstants.Claims.ConfidentialityLevel, confidentiality);
}
// Create a new claim per scope item, that will result
// in a "scope" array being added in the access token.
foreach (var scope in notification.Scopes)
{
identity.AddClaim(OpenIdConnectConstants.Claims.Scope, scope);
}
// Store the audiences as claims.
foreach (var audience in notification.Audiences)
{
identity.AddClaim(OpenIdConnectConstants.Claims.Audience, audience);
}
// Extract the presenters from the authentication ticket.
var presenters = notification.Presenters.ToArray();
switch (presenters.Length)
{
case 0: break;
case 1:
identity.AddClaim(OpenIdConnectConstants.Claims.AuthorizedParty, presenters[0]);
break;
default:
Logger.LogWarning("Multiple presenters have been associated with the access token " +
"but the JWT format only accepts single values.");
// Only add the first authorized party.
identity.AddClaim(OpenIdConnectConstants.Claims.AuthorizedParty, presenters[0]);
break;
}
var token = notification.SecurityTokenHandler.CreateToken(new SecurityTokenDescriptor
{
Subject = identity,
Issuer = notification.Issuer,
SigningCredentials = notification.SigningCredentials,
IssuedAt = notification.Ticket.Properties.IssuedUtc?.UtcDateTime,
NotBefore = notification.Ticket.Properties.IssuedUtc?.UtcDateTime,
Expires = notification.Ticket.Properties.ExpiresUtc?.UtcDateTime
});
return(notification.SecurityTokenHandler.WriteToken(token));
}
private async Task <string> SerializeIdentityTokenAsync(
ClaimsPrincipal principal, AuthenticationProperties properties,
OpenIdConnectRequest request, OpenIdConnectResponse response)
{
// Replace the principal by a new one containing only the filtered claims.
// Actors identities are also filtered (delegation scenarios).
principal = principal.Clone(claim =>
{
// Never exclude the subject claim.
if (string.Equals(claim.Type, OpenIdConnectConstants.Claims.Subject, StringComparison.OrdinalIgnoreCase))
{
return(true);
}
// Claims whose destination is not explicitly referenced or doesn't
// contain "id_token" are not included in the identity token.
if (!claim.HasDestination(OpenIdConnectConstants.Destinations.IdentityToken))
{
Logger.LogDebug("'{Claim}' was excluded from the identity token claims.", claim.Type);
return(false);
}
return(true);
});
// Remove the destinations from the claim properties.
foreach (var claim in principal.Claims)
{
claim.Properties.Remove(OpenIdConnectConstants.Properties.Destinations);
}
var identity = (ClaimsIdentity)principal.Identity;
// Create a new ticket containing the updated properties and the filtered principal.
var ticket = new AuthenticationTicket(principal, properties, Options.AuthenticationScheme);
ticket.Properties.IssuedUtc = Options.SystemClock.UtcNow;
ticket.Properties.ExpiresUtc = ticket.Properties.IssuedUtc +
(ticket.GetIdentityTokenLifetime() ?? Options.IdentityTokenLifetime);
ticket.SetUsage(OpenIdConnectConstants.Usages.IdentityToken);
// Associate a random identifier with the identity token.
ticket.SetTicketId(Guid.NewGuid().ToString());
// Remove the unwanted properties from the authentication ticket.
ticket.RemoveProperty(OpenIdConnectConstants.Properties.AccessTokenLifetime)
.RemoveProperty(OpenIdConnectConstants.Properties.AuthorizationCodeLifetime)
.RemoveProperty(OpenIdConnectConstants.Properties.ClientId)
.RemoveProperty(OpenIdConnectConstants.Properties.CodeChallenge)
.RemoveProperty(OpenIdConnectConstants.Properties.CodeChallengeMethod)
.RemoveProperty(OpenIdConnectConstants.Properties.IdentityTokenLifetime)
.RemoveProperty(OpenIdConnectConstants.Properties.RedirectUri)
.RemoveProperty(OpenIdConnectConstants.Properties.RefreshTokenLifetime);
ticket.SetAudiences(ticket.GetPresenters());
var notification = new SerializeIdentityTokenContext(Context, Options, request, response, ticket)
{
Issuer = Context.GetIssuer(Options),
SecurityTokenHandler = Options.IdentityTokenHandler,
SigningCredentials = Options.SigningCredentials.FirstOrDefault(key => key.Key is AsymmetricSecurityKey)
};
await Options.Provider.SerializeIdentityToken(notification);
if (notification.HandledResponse || !string.IsNullOrEmpty(notification.IdentityToken))
{
return(notification.IdentityToken);
}
else if (notification.Skipped)
{
return(null);
}
if (!ReferenceEquals(ticket, notification.Ticket))
{
throw new InvalidOperationException("The authentication ticket cannot be replaced.");
}
if (notification.SecurityTokenHandler == null)
{
return(null);
}
// Extract the main identity from the principal.
identity = (ClaimsIdentity)ticket.Principal.Identity;
if (string.IsNullOrEmpty(identity.GetClaim(OpenIdConnectConstants.Claims.Subject)))
{
throw new InvalidOperationException("The authentication ticket was rejected because " +
"it doesn't contain the mandatory subject claim.");
}
// Note: identity tokens must be signed but an exception is made by the OpenID Connect specification
// when they are returned from the token endpoint: in this case, signing is not mandatory, as the TLS
// server validation can be used as a way to ensure an identity token was issued by a trusted party.
// See http://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation for more information.
if (notification.SigningCredentials == null && request.IsAuthorizationRequest())
{
throw new InvalidOperationException("A signing key must be provided.");
}
// Store the "unique_id" property as a claim.
identity.AddClaim(OpenIdConnectConstants.Claims.JwtId, ticket.GetTicketId());
// Store the "usage" property as a claim.
identity.AddClaim(OpenIdConnectConstants.Claims.Usage, ticket.GetUsage());
// Store the "confidentiality_level" property as a claim.
var confidentiality = ticket.GetProperty(OpenIdConnectConstants.Properties.ConfidentialityLevel);
if (!string.IsNullOrEmpty(confidentiality))
{
identity.AddClaim(OpenIdConnectConstants.Claims.ConfidentialityLevel, confidentiality);
}
// Store the audiences as claims.
foreach (var audience in notification.Audiences)
{
identity.AddClaim(OpenIdConnectConstants.Claims.Audience, audience);
}
// If a nonce was present in the authorization request, it MUST
// be included in the id_token generated by the token endpoint.
// See http://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation
var nonce = request.Nonce;
if (request.IsAuthorizationCodeGrantType())
{
// Restore the nonce stored in the authentication
// ticket extracted from the authorization code.
nonce = ticket.GetProperty(OpenIdConnectConstants.Properties.Nonce);
}
if (!string.IsNullOrEmpty(nonce))
{
identity.AddClaim(OpenIdConnectConstants.Claims.Nonce, nonce);
}
if (notification.SigningCredentials != null && (!string.IsNullOrEmpty(response.Code) ||
!string.IsNullOrEmpty(response.AccessToken)))
{
using (var algorithm = OpenIdConnectServerHelpers.GetHashAlgorithm(notification.SigningCredentials.Algorithm))
{
// Create an authorization code hash if necessary.
if (!string.IsNullOrEmpty(response.Code))
{
var hash = algorithm.ComputeHash(Encoding.ASCII.GetBytes(response.Code));
// Note: only the left-most half of the hash of the octets is used.
// See http://openid.net/specs/openid-connect-core-1_0.html#HybridIDToken
identity.AddClaim(OpenIdConnectConstants.Claims.CodeHash, Base64UrlEncoder.Encode(hash, 0, hash.Length / 2));
}
// Create an access token hash if necessary.
if (!string.IsNullOrEmpty(response.AccessToken))
{
var hash = algorithm.ComputeHash(Encoding.ASCII.GetBytes(response.AccessToken));
// Note: only the left-most half of the hash of the octets is used.
// See http://openid.net/specs/openid-connect-core-1_0.html#CodeIDToken
identity.AddClaim(OpenIdConnectConstants.Claims.AccessTokenHash, Base64UrlEncoder.Encode(hash, 0, hash.Length / 2));
}
}
}
// Extract the presenters from the authentication ticket.
var presenters = notification.Presenters.ToArray();
switch (presenters.Length)
{
case 0: break;
case 1:
identity.AddClaim(OpenIdConnectConstants.Claims.AuthorizedParty, presenters[0]);
break;
default:
Logger.LogWarning("Multiple presenters have been associated with the identity token " +
"but the JWT format only accepts single values.");
// Only add the first authorized party.
identity.AddClaim(OpenIdConnectConstants.Claims.AuthorizedParty, presenters[0]);
break;
}
var token = notification.SecurityTokenHandler.CreateToken(new SecurityTokenDescriptor
{
Subject = identity,
Issuer = notification.Issuer,
SigningCredentials = notification.SigningCredentials,
IssuedAt = notification.Ticket.Properties.IssuedUtc?.UtcDateTime,
NotBefore = notification.Ticket.Properties.IssuedUtc?.UtcDateTime,
Expires = notification.Ticket.Properties.ExpiresUtc?.UtcDateTime
});
return(notification.SecurityTokenHandler.WriteToken(token));
}
protected override async Task <bool> HandleUnauthorizedAsync(ChallengeContext context)
{
// Extract the OpenID Connect request from the ASP.NET context.
// If it cannot be found or doesn't correspond to an authorization
// or a token request, throw an InvalidOperationException.
var request = Context.GetOpenIdConnectRequest();
if (request == null || (!request.IsAuthorizationRequest() && !request.IsTokenRequest()))
{
throw new InvalidOperationException("An OpenID Connect response cannot be returned from this endpoint.");
}
// Note: if an OpenID Connect response was already generated, throw an exception.
var response = Context.GetOpenIdConnectResponse();
if (response != null)
{
throw new InvalidOperationException("An OpenID Connect response has already been sent.");
}
// Create a new ticket containing an empty identity and
// the authentication properties extracted from the challenge.
var ticket = new AuthenticationTicket(
new ClaimsPrincipal(new ClaimsIdentity()),
new AuthenticationProperties(context.Properties),
context.AuthenticationScheme);
// Prepare a new OpenID Connect response.
response = new OpenIdConnectResponse
{
Error = ticket.GetProperty(OpenIdConnectConstants.Properties.Error),
ErrorDescription = ticket.GetProperty(OpenIdConnectConstants.Properties.ErrorDescription),
ErrorUri = ticket.GetProperty(OpenIdConnectConstants.Properties.ErrorUri)
};
// Remove the error/error_description/error_uri properties from the ticket.
ticket.RemoveProperty(OpenIdConnectConstants.Properties.Error)
.RemoveProperty(OpenIdConnectConstants.Properties.ErrorDescription)
.RemoveProperty(OpenIdConnectConstants.Properties.ErrorUri);
// If the request is an authorization request, attach the
// redirect_uri and the state to the OpenID Connect response.
if (request.IsAuthorizationRequest())
{
response.RedirectUri = request.GetProperty <string>(OpenIdConnectConstants.Properties.RedirectUri);
response.State = request.State;
}
if (string.IsNullOrEmpty(response.Error))
{
response.Error = request.IsAuthorizationRequest() ?
OpenIdConnectConstants.Errors.AccessDenied :
OpenIdConnectConstants.Errors.InvalidGrant;
}
if (string.IsNullOrEmpty(response.ErrorDescription))
{
response.ErrorDescription = request.IsAuthorizationRequest() ?
"The authorization grant has been denied by the resource owner." :
"The token request was rejected by the authorization server.";
}
if (request.IsAuthorizationRequest())
{
return(await SendAuthorizationResponseAsync(response, ticket));
}
return(await SendTokenResponseAsync(response, ticket));
}
private async Task <string> SerializeAccessTokenAsync(
ClaimsIdentity identity, AuthenticationProperties properties,
OpenIdConnectRequest request, OpenIdConnectResponse response)
{
// Create a new identity containing only the filtered claims.
// Actors identities are also filtered (delegation scenarios).
identity = identity.Clone(claim =>
{
// Never exclude the subject claim.
if (string.Equals(claim.Type, OpenIdConnectConstants.Claims.Subject, StringComparison.OrdinalIgnoreCase))
{
return(true);
}
// Claims whose destination is not explicitly referenced or doesn't
// contain "access_token" are not included in the access token.
if (!claim.HasDestination(OpenIdConnectConstants.Destinations.AccessToken))
{
Logger.LogDebug("'{Claim}' was excluded from the access token claims.", claim.Type);
return(false);
}
return(true);
});
// Remove the destinations from the claim properties.
foreach (var claim in identity.Claims)
{
claim.Properties.Remove(OpenIdConnectConstants.Properties.Destinations);
}
// Create a new ticket containing the updated properties and the filtered identity.
var ticket = new AuthenticationTicket(identity, properties);
ticket.Properties.IssuedUtc = Options.SystemClock.UtcNow;
ticket.Properties.ExpiresUtc = ticket.Properties.IssuedUtc;
ticket.Properties.ExpiresUtc += ticket.GetAccessTokenLifetime() ?? Options.AccessTokenLifetime;
// Associate a random identifier with the access token.
ticket.SetTokenId(Guid.NewGuid().ToString());
ticket.SetAudiences(ticket.GetResources());
// Remove the unwanted properties from the authentication ticket.
ticket.RemoveProperty(OpenIdConnectConstants.Properties.AccessTokenLifetime)
.RemoveProperty(OpenIdConnectConstants.Properties.AuthorizationCodeLifetime)
.RemoveProperty(OpenIdConnectConstants.Properties.CodeChallenge)
.RemoveProperty(OpenIdConnectConstants.Properties.CodeChallengeMethod)
.RemoveProperty(OpenIdConnectConstants.Properties.IdentityTokenLifetime)
.RemoveProperty(OpenIdConnectConstants.Properties.Nonce)
.RemoveProperty(OpenIdConnectConstants.Properties.OriginalRedirectUri)
.RemoveProperty(OpenIdConnectConstants.Properties.RefreshTokenLifetime)
.RemoveProperty(OpenIdConnectConstants.Properties.TokenUsage);
var notification = new SerializeAccessTokenContext(Context, Options, request, response, ticket)
{
DataFormat = Options.AccessTokenFormat,
Issuer = Context.GetIssuer(Options),
SecurityTokenHandler = Options.AccessTokenHandler,
SigningCredentials = Options.SigningCredentials.FirstOrDefault(key => key.SigningKey is SymmetricSecurityKey) ??
Options.SigningCredentials.FirstOrDefault()
};
await Options.Provider.SerializeAccessToken(notification);
if (notification.HandledResponse || !string.IsNullOrEmpty(notification.AccessToken))
{
return(notification.AccessToken);
}
else if (notification.Skipped)
{
return(null);
}
if (notification.SecurityTokenHandler == null)
{
if (notification.DataFormat == null)
{
throw new InvalidOperationException("A security token handler or data formatter must be provided.");
}
var value = notification.DataFormat.Protect(ticket);
Logger.LogTrace("A new access token was successfully generated using the " +
"specified data format: {Token} ; {Claims} ; {Properties}.",
value, ticket.Identity.Claims, ticket.Properties.Dictionary);
return(value);
}
// At this stage, throw an exception if no signing credentials were provided.
if (notification.SigningCredentials == null)
{
throw new InvalidOperationException("A signing key must be provided.");
}
// Store the "usage" property as a claim.
ticket.Identity.AddClaim(OpenIdConnectConstants.Claims.TokenUsage, OpenIdConnectConstants.TokenUsages.AccessToken);
// Store the "unique_id" property as a claim.
ticket.Identity.AddClaim(OpenIdConnectConstants.Claims.JwtId, ticket.GetTokenId());
// Store the "confidentiality_level" property as a claim.
var confidentiality = ticket.GetProperty(OpenIdConnectConstants.Properties.ConfidentialityLevel);
if (!string.IsNullOrEmpty(confidentiality))
{
identity.AddClaim(OpenIdConnectConstants.Claims.ConfidentialityLevel, confidentiality);
}
// Create a new claim per scope item, that will result
// in a "scope" array being added in the access token.
foreach (var scope in notification.Scopes)
{
ticket.Identity.AddClaim(OpenIdConnectConstants.Claims.Scope, scope);
}
// Store the audiences as claims.
foreach (var audience in notification.Audiences)
{
ticket.Identity.AddClaim(OpenIdConnectConstants.Claims.Audience, audience);
}
// Extract the presenters from the authentication ticket.
var presenters = notification.Presenters.ToArray();
switch (presenters.Length)
{
case 0: break;
case 1:
ticket.Identity.AddClaim(OpenIdConnectConstants.Claims.AuthorizedParty, presenters[0]);
break;
default:
Logger.LogWarning("Multiple presenters have been associated with the access token " +
"but the JWT format only accepts single values.");
// Only add the first authorized party.
ticket.Identity.AddClaim(OpenIdConnectConstants.Claims.AuthorizedParty, presenters[0]);
break;
}
if (ticket.Properties.IssuedUtc != null)
{
ticket.Identity.AddClaim(new Claim(
OpenIdConnectConstants.Claims.IssuedAt,
EpochTime.GetIntDate(ticket.Properties.IssuedUtc.Value.UtcDateTime).ToString(),
ClaimValueTypes.Integer64));
}
var token = notification.SecurityTokenHandler.CreateToken(new SecurityTokenDescriptor
{
Subject = ticket.Identity,
TokenIssuerName = notification.Issuer,
SigningCredentials = notification.SigningCredentials,
Lifetime = new Lifetime(
notification.Ticket.Properties.IssuedUtc?.UtcDateTime,
notification.Ticket.Properties.ExpiresUtc?.UtcDateTime)
});
// When the access token is a JWT token, directly use RawData instead of calling
// JwtSecurityTokenHandler.WriteToken(token) to avoid signing the token twice.
var result = token is JwtSecurityToken jwtSecurityToken ?
jwtSecurityToken.RawData :
notification.SecurityTokenHandler.WriteToken(token);
Logger.LogTrace("A new access token was successfully generated using the specified " +
"security token handler: {Token} ; {Claims} ; {Properties}.",
result, ticket.Identity.Claims, ticket.Properties.Dictionary);
return(result);
}
private async Task <string> CreateTokenAsync(
[NotNull] string type, [NotNull] AuthenticationTicket ticket,
[NotNull] KeystoneServerOptions options,
[NotNull] OpenIdConnectRequest request,
[NotNull] ISecureDataFormat <AuthenticationTicket> format)
{
Debug.Assert(!(options.DisableTokenStorage && options.UseReferenceTokens),
"Token storage cannot be disabled when using reference tokens.");
Debug.Assert(type == OpenIdConnectConstants.TokenUsages.AccessToken ||
type == OpenIdConnectConstants.TokenUsages.AuthorizationCode ||
type == OpenIdConnectConstants.TokenUsages.RefreshToken,
"Only authorization codes, access and refresh tokens should be created using this method.");
// When sliding expiration is disabled, the expiration date of generated refresh tokens is fixed
// and must exactly match the expiration date of the refresh token used in the token request.
if (request.IsTokenRequest() && request.IsRefreshTokenGrantType() &&
!options.UseSlidingExpiration && type == OpenIdConnectConstants.TokenUsages.RefreshToken)
{
var properties = request.GetProperty <AuthenticationTicket>(
KeystoneConstants.Properties.AuthenticationTicket)?.Properties;
Debug.Assert(properties != null, "The authentication properties shouldn't be null.");
ticket.Properties.ExpiresUtc = properties.ExpiresUtc;
}
if (options.DisableTokenStorage)
{
return(null);
}
var descriptor = new KeystoneTokenDescriptor
{
AuthorizationId = ticket.GetInternalAuthorizationId(),
CreationDate = ticket.Properties.IssuedUtc,
ExpirationDate = ticket.Properties.ExpiresUtc,
Principal = ticket.Principal,
Status = KeystoneConstants.Statuses.Valid,
Subject = ticket.Principal.GetClaim(KeystoneConstants.Claims.Subject),
Type = type
};
foreach (var property in ticket.Properties.Items)
{
descriptor.Properties.Add(property);
}
// When reference tokens are enabled or when the token is an authorization code or a
// refresh token, remove the unnecessary properties from the authentication ticket.
if (options.UseReferenceTokens ||
(type == OpenIdConnectConstants.TokenUsages.AuthorizationCode ||
type == OpenIdConnectConstants.TokenUsages.RefreshToken))
{
ticket.Properties.IssuedUtc = ticket.Properties.ExpiresUtc = null;
ticket.RemoveProperty(KeystoneConstants.Properties.InternalAuthorizationId)
.RemoveProperty(KeystoneConstants.Properties.InternalTokenId);
}
// If reference tokens are enabled, create a new entry for
// authorization codes, refresh tokens and access tokens.
if (options.UseReferenceTokens)
{
// Note: the data format is automatically replaced at startup time to ensure
// that encrypted tokens stored in the database cannot be considered as
// valid tokens if the developer decides to disable reference tokens support.
descriptor.Payload = format.Protect(ticket);
// Generate a new crypto-secure random identifier that will be
// substituted to the ciphertext returned by the data format.
var bytes = new byte[256 / 8];
options.RandomNumberGenerator.GetBytes(bytes);
// Note: the default token manager automatically obfuscates the
// reference identifier so it can be safely stored in the databse.
descriptor.ReferenceId = Base64UrlEncoder.Encode(bytes);
}
// Otherwise, only create a token metadata entry for authorization codes and refresh tokens.
else if (type != OpenIdConnectConstants.TokenUsages.AuthorizationCode &&
type != OpenIdConnectConstants.TokenUsages.RefreshToken)
{
return(null);
}
// If the client application is known, associate it with the token.
if (!string.IsNullOrEmpty(request.ClientId))
{
var application = await _applicationManager.FindByClientIdAsync(request.ClientId);
if (application == null)
{
throw new InvalidOperationException("The application entry cannot be found in the database.");
}
descriptor.ApplicationId = await _applicationManager.GetIdAsync(application);
}
// If a null value was returned by CreateAsync(), return immediately.
// Note: the request cancellation token is deliberately not used here to ensure the caller
// cannot prevent this operation from being executed by resetting the TCP connection.
var token = await _tokenManager.CreateAsync(descriptor);
if (token == null)
{
return(null);
}
// Throw an exception if the token identifier can't be resolved.
var identifier = await _tokenManager.GetIdAsync(token);
if (string.IsNullOrEmpty(identifier))
{
throw new InvalidOperationException("The unique key associated with a refresh token cannot be null or empty.");
}
// Dynamically set the creation and expiration dates.
ticket.Properties.IssuedUtc = descriptor.CreationDate;
ticket.Properties.ExpiresUtc = descriptor.ExpirationDate;
// Restore the token/authorization identifiers using the identifiers attached with the database entry.
ticket.SetInternalAuthorizationId(descriptor.AuthorizationId)
.SetInternalTokenId(identifier);
if (options.UseReferenceTokens)
{
_logger.LogTrace("A new reference token was successfully generated and persisted " +
"in the database: {Token} ; {Claims} ; {Properties}.",
descriptor.ReferenceId, ticket.Principal.Claims, ticket.Properties.Items);
return(descriptor.ReferenceId);
}
return(null);
}