//[Authorize]
public Dictionary <string, string> OAuth2BearerToken2(FormDataCollection formData)
{
// 戻り値
// ・正常
Dictionary <string, string> ret = new Dictionary <string, string>();
// ・異常
Dictionary <string, string> err = new Dictionary <string, string>();
// 変数
string grant_type = formData[OAuth2AndOIDCConst.grant_type];
string assertion = formData[OAuth2AndOIDCConst.assertion];
// クライアント認証
if (grant_type == OAuth2AndOIDCConst.JwtBearerTokenFlowGrantType)
{
Dictionary <string, string> dic = JsonConvert.DeserializeObject <Dictionary <string, string> >(
CustomEncode.ByteToString(CustomEncode.FromBase64UrlString(
assertion.Split('.')[1]), CustomEncode.us_ascii));
string pubKey = OAuth2Helper.GetInstance().GetJwtAssertionPublickey(dic[OAuth2AndOIDCConst.iss]);
pubKey = CustomEncode.ByteToString(CustomEncode.FromBase64String(pubKey), CustomEncode.us_ascii);
if (!string.IsNullOrEmpty(pubKey))
{
string iss = "";
string aud = "";
string scopes = "";
JObject jobj = null;
if (JwtAssertion.VerifyJwtBearerTokenFlowAssertion(assertion, out iss, out aud, out scopes, out jobj, pubKey))
{
// aud 検証
if (aud == ASPNETIdentityConfig.OAuth2AuthorizationServerEndpointsRootURI
+ ASPNETIdentityConfig.OAuth2BearerTokenEndpoint2)
{
// ここからは、JwtAssertionではなく、JwtTokenを作るので、属性設定に注意。
ClaimsIdentity identity = OAuth2Helper.AddClaim(
new ClaimsIdentity(OAuthDefaults.AuthenticationType), iss, "", scopes.Split(' '), "");
AuthenticationProperties prop = new AuthenticationProperties();
prop.IssuedUtc = DateTimeOffset.UtcNow;
prop.ExpiresUtc = DateTimeOffset.Now.Add(ASPNETIdentityConfig.OAuth2AccessTokenExpireTimeSpanFromMinutes);
// token_type
ret.Add(OAuth2AndOIDCConst.token_type, OAuth2AndOIDCConst.Bearer.ToLower());
// access_token
AccessTokenFormatJwt verifier = new AccessTokenFormatJwt();
string access_token = verifier.Protect(new AuthenticationTicket(identity, prop));
ret.Add(OAuth2AndOIDCConst.AccessToken, access_token);
// expires_in
jobj = (JObject)JsonConvert.DeserializeObject(
CustomEncode.ByteToString(CustomEncode.FromBase64UrlString(
access_token.Split('.')[1]), CustomEncode.us_ascii));
ret.Add("expires_in", (long.Parse((string)jobj[OAuth2AndOIDCConst.exp]) - long.Parse((string)jobj[OAuth2AndOIDCConst.iat])).ToString());
// オペレーション・トレース・ログ出力
string clientName = OAuth2Helper.GetInstance().GetClientName(iss);
Logging.MyOperationTrace(string.Format(
"{0}({1}) passed the 'jwt bearer token flow' by {2}({3}).",
iss, clientName, iss, clientName));
return(ret); // 成功
}
else
{
// クライアント認証エラー（Credential（aud）不正
err.Add("error", "invalid_client");
err.Add("error_description", "Invalid credential");
}
}
else
{
// クライアント認証エラー（Credential（署名）不正
err.Add("error", "invalid_client");
err.Add("error_description", "Invalid credential");
}
}
else
{
// クライアント認証エラー（Credential（iss or pubKey）不正
err.Add("error", "invalid_client");
err.Add("error_description", "Invalid credential");
}
}
else
{
// grant_type パラメタ・エラー
err.Add("error", "invalid_request");
err.Add("error_description", "invalid grant_type");
}
return(err); // 失敗
}
