public static void SetOIDCTokens(OIDCTokenResponse tokenresponse) { HttpContext.Current.Items[VERIFIED_REQUEST] = false;//reset to recheck var accesscookie = GetAccessCookie(); accesscookie.Value = tokenresponse.AccessToken; accesscookie.Expires = DateTime.Now.AddDays(1); HttpContext.Current.Response.Cookies.Add(accesscookie); }
public IActionResult Claims() { var addList = new List <string> { "tokenInfo" }; var claims = User.Claims.GroupBy(x => x.Type).Select(x => x.First()); var AccessInfo = claims; var access_info = ""; AccessInfo = claims.Where(x => addList.Contains(x.Type)); foreach (var claimsToken in AccessInfo) { access_info = claimsToken.Value; } OIDCTokenResponse Atoken = Newtonsoft.Json.JsonConvert.DeserializeObject <OIDCTokenResponse>(access_info); ViewData["Message"] = Atoken; return(View()); }
// This method gets called by the runtime. Use this method to add services to the container. public void ConfigureServices(IServiceCollection services) { services.AddCors(Options => Options.AddPolicy("AllowAll", p => p.AllowAnyOrigin().AllowAnyMethod().AllowAnyHeader())); //consul getOIDCConfig = services.FetchConsul(Configuration["Consul:Host"], Configuration["Consul:Key"]); //localization services.AddLocalization(opts => { opts.ResourcesPath = "Resources"; }); services.AddTransient <AppAcessService>(); services.AddMvc() .AddViewLocalization( LanguageViewLocationExpanderFormat.Suffix, opts => { opts.ResourcesPath = "Resources"; }) .AddDataAnnotationsLocalization(); services.AddSession(); // ... previous configuration not shown services.Configure <RequestLocalizationOptions>( opts => { var supportedCultures = new List <CultureInfo> { new CultureInfo("en"), new CultureInfo("fr"), new CultureInfo("el"), }; opts.DefaultRequestCulture = new RequestCulture("en"); // Formatting numbers, dates, etc. opts.SupportedCultures = supportedCultures; // UI strings that we have localized. opts.SupportedUICultures = supportedCultures; }); //localization end services.Configure <ForwardedHeadersOptions>(options => { options.ForwardedHeaders = ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto; }); services.Configure <CookiePolicyOptions>(options => { // This lambda determines whether user consent for non-essential cookies is needed for a given request. options.CheckConsentNeeded = context => true; options.MinimumSameSitePolicy = SameSiteMode.None; }); // Add authentication services services.AddAuthentication(options => { options.DefaultAuthenticateScheme = CookieAuthenticationDefaults.AuthenticationScheme; options.DefaultSignInScheme = CookieAuthenticationDefaults.AuthenticationScheme; options.DefaultChallengeScheme = CookieAuthenticationDefaults.AuthenticationScheme; }) .AddCookie() .AddOpenIdConnect("oidc", options => { // Set the authority to your oidc domain options.Authority = $"https://" + getOIDCConfig.OIDC.Domain; // Configure the oidc Client ID and Client Secret options.ClientId = getOIDCConfig.OIDC.ClientId; options.ClientSecret = getOIDCConfig.OIDC.ClientSecret; // Set response type to code //options.ResponseType = "code id_token"; options.ResponseType = "code"; // Configure the scope options.Scope.Clear(); options.Scope.Add("openid"); options.Scope.Add("profile"); options.Scope.Add("email"); options.GetClaimsFromUserInfoEndpoint = true; // Set the callback path, so oidc will call back to http://localhost:5000/signin-oidc // Also ensure that you have added the URL as an Allowed Callback URL in your oidc dashboard options.CallbackPath = new PathString(getOIDCConfig.OIDC.CallbackPath); // Configure the Claims Issuer to be oidc options.ClaimsIssuer = "oidc"; // Saves tokens to the AuthenticationProperties options.SaveTokens = true; options.Events = new OpenIdConnectEvents { OnRedirectToIdentityProvider = notification => { getOIDCConfig = ConsulExtensions.FetchConsul(Configuration["Consul:Host"], Configuration["Consul:Key"]); var ui_locales = notification.HttpContext.Request.Headers["ui_locales"]; var request = notification.Request; var redirectUri = getOIDCConfig.OIDC.Protocol + "://" + request.Host + request.PathBase + getOIDCConfig.OIDC.RedirectUri; // Add custom redirect_uri to avoid the app from guessing it based in the running web server and have issues with a reverse-proxy. notification.ProtocolMessage.RedirectUri = redirectUri; //Uncomment - when Passing ACR values if (notification.ProtocolMessage.RequestType == OpenIdConnectRequestType.Authentication) { //notification.ProtocolMessage.AcrValues = "icrypto"; notification.ProtocolMessage.Parameters.Add("ui_locales", ui_locales.ToString()); } return(Task.FromResult(0)); }, //Get User info using access_token and bind to UI OnTokenResponseReceived = async auth => { string role = ""; var userInfoClient = new UserInfoClient($"https://" + getOIDCConfig.OIDC.Domain + "/" + getOIDCConfig.OIDC.CustomPath + "/restv1/userinfo"); var userInfoResponse = await userInfoClient.GetAsync(auth.TokenEndpointResponse.AccessToken); foreach (var item in userInfoResponse.Claims) { if (item.Type == "roles") { role = item.Value; } } var exp = auth.TokenEndpointResponse.Parameters; var ProtocolMessage = auth.ProtocolMessage.Parameters; OIDCTokenResponse token = new OIDCTokenResponse { AccessToken = exp["access_token"], RefreshToken = exp["refresh_token"], IdToken = exp["id_token"], Type = exp["token_type"], ExpiresIn = exp["expires_in"] }; OIDCCallbackResponse callback = new OIDCCallbackResponse { Code = ProtocolMessage["code"], Scope = ProtocolMessage["scope"], //SessionId = ProtocolMessage["session_id"], //SessionState = ProtocolMessage["session_state"], }; string tokenInfo = JsonConvert.SerializeObject(token); string callbackInfo = JsonConvert.SerializeObject(callback); claims.Clear(); claims.AddRange(userInfoResponse.Claims); claims.Add(new Claim(ClaimTypes.Role, role)); claims.Add(new Claim("tokenInfo", tokenInfo)); claims.Add(new Claim("callbackInfo", callbackInfo)); claims.Add(new Claim("session_id", auth.ProtocolMessage.Parameters["session_id"])); if (!string.IsNullOrEmpty(auth.TokenEndpointResponse.RefreshToken)) { //claims.Add(new Claim("refresh_token", auth.TokenEndpointResponse.RefreshToken)); } id_token = auth.TokenEndpointResponse.IdToken; claims.Add(new Claim("introspect_token", Introspect(auth.TokenEndpointResponse.AccessToken))); return; }, //Add Other claims like access_token, id_token etc.. OnUserInformationReceived = auth => { ClaimsIdentity _claims = new ClaimsIdentity(); _claims.AddClaims(claims); auth.Principal.AddIdentity(_claims); return(Task.FromResult(0)); }, // handle the logout redirection OnRedirectToIdentityProviderForSignOut = (context) => { context.ProtocolMessage.IdTokenHint = id_token; var logoutUri = $"https://" + getOIDCConfig.OIDC.Domain + "/" + getOIDCConfig.OIDC.CustomPath + "/restv1/end_session?id_token_hint=" + context.ProtocolMessage.IdTokenHint; var postLogoutUri = context.Properties.RedirectUri; if (!string.IsNullOrEmpty(postLogoutUri)) { if (postLogoutUri.StartsWith("/")) { // transform to absolute var request = context.Request; postLogoutUri = getOIDCConfig.OIDC.Protocol + "://" + request.Host + request.PathBase + postLogoutUri; } logoutUri += $"&post_logout_redirect_uri={ Uri.EscapeDataString(postLogoutUri)}"; } context.Response.Redirect(logoutUri); context.HandleResponse(); return(Task.CompletedTask); } }; }); services.AddMvc() .SetCompatibilityVersion(CompatibilityVersion.Latest); }