/// <summary>
/// Хост. Основа. Часть "Auth". Расширение. Получить. Утверждения ролей из групп Windows.
/// </summary>
/// <param name="windowsGroups">Группы Windows.</param>
/// <returns>Утверждения ролей.</returns>
public static IEnumerable <Claim> HostBasePartAuthExtGetRoleClaimsFromWindowsGroups(
this IdentityReferenceCollection windowsGroups
)
{
return(windowsGroups
.Select(x => ConvertFromWindowGroupToRoleName(x.Value))
.Where(x => x != null)
.Select(x => new Claim(HostBasePartAuthSettings.CLAIM_Role, x)));
}
private async Task <IActionResult> ProcessWindowsLoginAsync(string returnUrl)
{
// see if windows auth has already been requested and succeeded
AuthenticateResult result = await this.HttpContext.AuthenticateAsync(AccountOptions.WindowsAuthenticationSchemeName);
if (result?.Principal is WindowsPrincipal wp)
{
// we will issue the external cookie and then redirect the
// user back to the external callback, in essence, treating windows
// auth the same as any other external authentication mechanism
AuthenticationProperties props = new AuthenticationProperties()
{
RedirectUri = Url.Action("Callback"),
Items =
{
{ "returnUrl", returnUrl },
{ "scheme", AccountOptions.WindowsAuthenticationSchemeName },
}
};
ClaimsIdentity id = new ClaimsIdentity(AccountOptions.WindowsAuthenticationSchemeName);
id.AddClaim(new Claim(JwtClaimTypes.Subject, wp.FindFirst(ClaimTypes.PrimarySid).Value));
id.AddClaim(new Claim(JwtClaimTypes.Name, wp.Identity.Name));
// add the groups as claims -- be careful if the number of groups is too large
if (AccountOptions.IncludeWindowsGroups)
{
WindowsIdentity wi = wp.Identity as WindowsIdentity;
IdentityReferenceCollection groups = wi.Groups.Translate(typeof(NTAccount));
IEnumerable <Claim> roles = groups.Select(x => new Claim(JwtClaimTypes.Role, x.Value));
id.AddClaims(roles);
}
await HttpContext.SignInAsync(
IdentityServer4.IdentityServerConstants.ExternalCookieAuthenticationScheme,
new ClaimsPrincipal(id),
props);
return(Redirect(props.RedirectUri));
}
else
{
// trigger windows auth
// since windows auth don't support the redirect uri,
// this URL is re-triggered when we call challenge
return(Challenge(AccountOptions.WindowsAuthenticationSchemeName));
}
}
