示例#1
0
        /// <summary>
        /// This methos validates the Simple Web Token.
        /// </summary>
        /// <param name="token">A simple web token.</param>
        /// <returns>A Claims Collection which contains all the claims from the token.</returns>
        public ClaimsIdentityCollection ValidateToken(SecurityToken token)
        {
            SimpleWebToken realToken = token as SimpleWebToken;

            if (realToken == null)
            {
                throw new InvalidTokenReceivedException("The received token is of incorrect token type.Expected SimpleWebToken");
            }

            if (StringComparer.OrdinalIgnoreCase.Compare(realToken.AudienceUri.ToString(), RelyingPartyRealm) != 0)
            {
                throw new InvalidTokenReceivedException("The Audience Uri of the incoming token is not expected. Expected AudienceUri is " + RelyingPartyRealm);
            }

            if (StringComparer.OrdinalIgnoreCase.Compare(realToken.Issuer, tenantUri) != 0)
            {
                throw new InvalidTokenReceivedException("The Issuer of the token is not trusted. Trusted issuer is " + tenantUri);
            }

            if (!realToken.SignVerify(Convert.FromBase64String(symmetricSignatureKey)))
            {
                throw new InvalidTokenReceivedException("Signature verification of the incoming token failed.");
            }

            if (DateTime.Compare(realToken.ValidTo, DateTime.UtcNow) <= 0)
            {
                throw new ExpiredTokenReceivedException("The incoming token has expired. Get a new access token from the Authorization Server.");
            }

            ClaimsIdentityCollection identities = new ClaimsIdentityCollection();
            ClaimsIdentity           identity   = new ClaimsIdentity();

            foreach (var claim in realToken.Claims)
            {
                identity.Claims.Add(claim);
            }

            identities.Add(identity);

            return(identities);
        }
示例#2
0
        /// <summary>
        /// Reads a serialized token and converts it into a <see cref="SecurityToken"/>.
        /// </summary>
        /// <param name="rawToken">The token in serialized form.</param>
        /// <returns>The parsed form of the token.</returns>
        public SecurityToken ReadToken(string rawToken)
        {
            char   parameterSeparator = '&';
            Uri    audienceUri        = null;
            string issuer             = null;
            string signature          = null;
            string unsignedString     = null;
            string expires            = null;

            if (string.IsNullOrEmpty(rawToken))
            {
                throw new ArgumentNullException("rawToken");
            }

            //
            // Find the last parameter. The signature must be last per SWT specification.
            //
            int lastSeparator = rawToken.LastIndexOf(parameterSeparator);

            // Check whether the last parameter is an hmac.
            //
            if (lastSeparator > 0)
            {
                string lastParamStart = parameterSeparator + Digest256Label + "=";
                string lastParam      = rawToken.Substring(lastSeparator);

                // Strip the trailing hmac to obtain the original unsigned string for later hmac verification.
                // e.g. name1=value1&name2=value2&HMACSHA256=XXX123 -> name1=value1&name2=value2
                //
                if (lastParam.StartsWith(lastParamStart, StringComparison.Ordinal))
                {
                    unsignedString = rawToken.Substring(0, lastSeparator);
                }
            }
            else
            {
                throw new InvalidTokenReceivedException("The Simple Web Token must have a signature at the end. The incoming token did not have a signature at the end of the token.");
            }

            // Signature is a mandatory parameter, and it must be the last one.
            // If there's no trailing hmac, Return error.
            //
            if (unsignedString == null)
            {
                throw new InvalidTokenReceivedException("The Simple Web Token must have a signature at the end. The incoming token did not have a signature at the end of the token.");
            }

            // Create a collection of SWT claims
            //
            NameValueCollection rawClaims = ParseToken(rawToken);

            audienceUri = new Uri(rawClaims[AudienceLabel]);
            if (audienceUri != null)
            {
                rawClaims.Remove(AudienceLabel);
            }
            else
            {
                throw new InvalidTokenReceivedException("Then incoming token does not have an AudienceUri.");
            }

            expires = rawClaims[ExpiresOnLabel];
            if (expires != null)
            {
                rawClaims.Remove(ExpiresOnLabel);
            }
            else
            {
                throw new InvalidTokenReceivedException("Then incoming token does not have an expiry time.");
            }

            issuer = rawClaims[IssuerLabel];
            if (issuer != null)
            {
                rawClaims.Remove(IssuerLabel);
            }
            else
            {
                throw new InvalidTokenReceivedException("Then incoming token does not have an Issuer");
            }

            signature = rawClaims[Digest256Label];
            if (signature != null)
            {
                rawClaims.Remove(Digest256Label);
            }
            else
            {
                throw new InvalidTokenReceivedException("Then incoming token does not have a signature");
            }

            List <Claim> claims = DecodeClaims(issuer, rawClaims);

            SimpleWebToken swt = new SimpleWebToken(audienceUri, issuer, DecodeExpiry(expires), claims, signature, unsignedString);

            return(swt);
        }
        /// <summary>
        /// Reads a serialized token and converts it into a <see cref="SecurityToken"/>.
        /// </summary>
        /// <param name="rawToken">The token in serialized form.</param>
        /// <returns>The parsed form of the token.</returns>
        public SecurityToken ReadToken( string rawToken )
        {
            char parameterSeparator = '&';
            Uri audienceUri = null;
            string issuer = null;
            string signature = null;
            string unsignedString = null;
            string expires = null;

            if ( string.IsNullOrEmpty( rawToken ) )
            {
                throw new ArgumentNullException( "rawToken" );
            }

            //
            // Find the last parameter. The signature must be last per SWT specification.
            //
            int lastSeparator = rawToken.LastIndexOf( parameterSeparator );

            // Check whether the last parameter is an hmac.
            //
            if ( lastSeparator > 0 )
            {
                string lastParamStart = parameterSeparator + Digest256Label + "=";
                string lastParam = rawToken.Substring( lastSeparator );

                // Strip the trailing hmac to obtain the original unsigned string for later hmac verification.
                // e.g. name1=value1&name2=value2&HMACSHA256=XXX123 -> name1=value1&name2=value2
                //
                if ( lastParam.StartsWith( lastParamStart, StringComparison.Ordinal ) )
                {
                    unsignedString = rawToken.Substring( 0, lastSeparator );
                }
            }
            else
            {
                throw new InvalidTokenReceivedException( "The Simple Web Token must have a signature at the end. The incoming token did not have a signature at the end of the token." );
            }

            // Signature is a mandatory parameter, and it must be the last one.
            // If there's no trailing hmac, Return error.
            //
            if ( unsignedString == null )
            {
                throw new InvalidTokenReceivedException( "The Simple Web Token must have a signature at the end. The incoming token did not have a signature at the end of the token." );
            }

            // Create a collection of SWT claims
            //
            NameValueCollection rawClaims = ParseToken( rawToken );

            audienceUri = new Uri( rawClaims[AudienceLabel] );
            if ( audienceUri != null )
            {
                rawClaims.Remove( AudienceLabel );
            }
            else
            {
                throw new InvalidTokenReceivedException( "Then incoming token does not have an AudienceUri." );
            }

            expires = rawClaims[ExpiresOnLabel];
            if ( expires != null )
            {
                rawClaims.Remove( ExpiresOnLabel );
            }
            else
            {
                throw new InvalidTokenReceivedException( "Then incoming token does not have an expiry time." );
            }

            issuer = rawClaims[IssuerLabel];
            if ( issuer != null )
            {
                rawClaims.Remove( IssuerLabel );
            }
            else
            {
                throw new InvalidTokenReceivedException( "Then incoming token does not have an Issuer" );
            }

            signature = rawClaims[Digest256Label];
            if ( signature != null )
            {
                rawClaims.Remove( Digest256Label );
            }
            else
            {
                throw new InvalidTokenReceivedException( "Then incoming token does not have a signature" );
            }

            List<Claim> claims = DecodeClaims( issuer, rawClaims );

            SimpleWebToken swt = new SimpleWebToken( audienceUri, issuer, DecodeExpiry( expires ), claims, signature, unsignedString );
            return swt;
        }