public async Task ReceiveAsync(AuthenticationTokenReceiveContext context)
{
var allowedOrigin = context.OwinContext.Get <string>("as:clientAllowedOrigin");
context.OwinContext.Response.Headers.Add("Access-Control-Allow-Origin", new[] { allowedOrigin });
string hashedTokenId = CryptoHelper.Hash(context.Token);
using (IAuthDataAccess repo = CC.IoC.Resolve <IAuthDataAccess>())
{
var refreshToken = await repo.FindRefreshTokenAsync(hashedTokenId);
if (refreshToken != null)
{
//Get protectedTicket from refreshToken class
context.DeserializeTicket(refreshToken.ProtectedTicket);
var result = await repo.RemoveRefreshTokenAsync(hashedTokenId);
}
}
}
public async Task CreateAsync(AuthenticationTokenCreateContext context)
{
var clientid = context.Ticket.Properties.Dictionary["as:client_id"];
if (string.IsNullOrEmpty(clientid))
{
return;
}
var refreshTokenId = Guid.NewGuid().ToString("n");
using (IAuthDataAccess repo = CC.IoC.Resolve <IAuthDataAccess>())
{
var refreshTokenLifeTime = context.OwinContext.Get <string>("as:clientRefreshTokenLifeTime");
var token = new AuthRefreshToken()
{
Id = CryptoHelper.Hash(refreshTokenId),
ClientId = clientid,
Subject = context.Ticket.Identity.Name,
IssuedUtc = DateTime.UtcNow,
ExpiresUtc = DateTime.UtcNow.AddMinutes(Convert.ToDouble(refreshTokenLifeTime))
};
context.Ticket.Properties.IssuedUtc = token.IssuedUtc;
context.Ticket.Properties.ExpiresUtc = token.ExpiresUtc;
token.ProtectedTicket = context.SerializeTicket();
var result = await repo.AddRefreshTokenAsync(token);
if (result)
{
context.SetToken(refreshTokenId);
}
}
}
public UserManager(IMapper mapper, IUserDataAccess userDataAccess, IAuthDataAccess authDataAccess)
{
_mapper = mapper;
_userDataAccess = userDataAccess;
_authDataAccess = authDataAccess;
}
public override Task ValidateClientAuthentication(OAuthValidateClientAuthenticationContext context)
{
//NOTE: part of refresh token implementation
string clientId = string.Empty;
string clientSecret = string.Empty;
AuthApiClient client = null;
if (!context.TryGetBasicCredentials(out clientId, out clientSecret))
{
context.TryGetFormCredentials(out clientId, out clientSecret);
}
if (context.ClientId == null)
{
//Remove the comments from the below line context.SetError, and invalidate context
//if you want to force sending clientId/secrets once obtain access tokens.
context.Validated();
//context.SetError("invalid_clientId", "ClientId should be sent.");
return(Task.FromResult <object>(null));
}
using (IAuthDataAccess repo = CC.IoC.Resolve <IAuthDataAccess>())
{
client = repo.FindApiClient(context.ClientId);
}
if (client == null)
{
context.SetError("invalid_clientId", $"Client {context.ClientId} is not registered in the system.");
return(Task.FromResult <object>(null));
}
if (client.ApplicationType == AuthApplicationTypes.NativeConfidential)
{
if (string.IsNullOrWhiteSpace(clientSecret))
{
context.SetError("invalid_clientId", "Client secret should be sent.");
return(Task.FromResult <object>(null));
}
else
{
if (client.Secret != CryptoHelper.Hash(clientSecret))
{
context.SetError("invalid_clientId", "Client secret is invalid.");
return(Task.FromResult <object>(null));
}
}
}
if (!client.Active)
{
context.SetError("invalid_clientId", "Client is inactive.");
return(Task.FromResult <object>(null));
}
context.OwinContext.Set <string>("as:client_id", clientId); //make client_id available for later security checks
context.OwinContext.Set <string>("as:clientAllowedOrigin", client.AllowedOrigin);
context.OwinContext.Set <string>("as:clientRefreshTokenLifeTime", client.RefreshTokenLifeTime.ToString());
context.Validated();
return(Task.FromResult <object>(null));
}
public RefreshTokensController()
{
_repo = CC.IoC.Resolve <IAuthDataAccess>();
}
public AuthBusinessAccess(IAuthDataAccess authDataAccess, HandlerContainer handlerContainer)
{
this.authDataAccess = authDataAccess;
this.handlerContainer = handlerContainer;
}
