Skip to content
This repository was archived by the owner on Dec 24, 2020. It is now read-only.

Commit 0125c36

Browse files
kevinchaletkevinchalet
committed
React to properties format changes in aspnet-contrib/AspNet.Security.OpenIdConnect.Server
1 parent bc84ae8 commit 0125c36

16 files changed

Lines changed: 106 additions & 57 deletions

File tree

‎src/AspNet.Security.OAuth.Introspection/Events/ValidateTokenContext.cs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ public class ValidateTokenContext : BaseControlContext {
1616
public ValidateTokenContext(
1717
[NotNull] HttpContext context,
1818
[NotNull] OAuthIntrospectionOptions options,
19-
[NotNull] AuthenticationTicket ticket)
19+
[NotNull] AuthenticationTicket ticket)
2020
: base(context) {
2121
Options = options;
2222
Ticket = ticket;

‎src/AspNet.Security.OAuth.Introspection/OAuthIntrospectionHandler.cs‎

Lines changed: 20 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,6 @@
77
using System;
88
using System.Collections.Generic;
99
using System.Diagnostics;
10-
using System.Linq;
1110
using System.Net.Http;
1211
using System.Net.Http.Headers;
1312
using System.Security.Claims;
@@ -18,6 +17,7 @@
1817
using Microsoft.Extensions.Caching.Distributed;
1918
using Microsoft.Extensions.Logging;
2019
using Microsoft.Net.Http.Headers;
20+
using Newtonsoft.Json;
2121
using Newtonsoft.Json.Linq;
2222

2323
namespace AspNet.Security.OAuth.Introspection {
@@ -220,12 +220,22 @@ protected virtual bool ValidateAudience(AuthenticationTicket ticket) {
220220
return false;
221221
}
222222

223-
// Ensure that the authentication ticket contains at least one of the registered audiences.
224-
if (audiences == null || !audiences.Split(' ').Intersect(Options.Audiences, StringComparer.Ordinal).Any()) {
223+
if (string.IsNullOrEmpty(audiences)) {
225224
return false;
226225
}
227226

228-
return true;
227+
// Ensure that the authentication ticket contains one of the registered audiences.
228+
foreach (var audience in JArray.Parse(audiences).Values<string>()) {
229+
if (string.IsNullOrEmpty(audience)) {
230+
continue;
231+
}
232+
233+
if (Options.Audiences.Contains(audience)) {
234+
return true;
235+
}
236+
}
237+
238+
return false;
229239
}
230240

231241
protected virtual async Task<AuthenticationTicket> CreateTicketAsync(string token, JObject payload) {
@@ -259,7 +269,6 @@ protected virtual async Task<AuthenticationTicket> CreateTicketAsync(string toke
259269
continue;
260270
}
261271

262-
263272
case OAuthIntrospectionConstants.Claims.ExpiresAt: {
264273
#if NETSTANDARD1_3
265274
// Convert the UNIX timestamp to a DateTimeOffset.
@@ -299,8 +308,9 @@ protected virtual async Task<AuthenticationTicket> CreateTicketAsync(string toke
299308
case OAuthIntrospectionConstants.Claims.Scope: {
300309
var scopes = (string) property.Value;
301310

302-
// Store the scopes list as-is in the authentication properties.
303-
properties.Items[OAuthIntrospectionConstants.Properties.Scopes] = scopes;
311+
// Store the scopes list in the authentication properties.
312+
properties.Items[OAuthIntrospectionConstants.Properties.Scopes] =
313+
new JArray(scopes.Split(' ')).ToString(Formatting.None);
304314

305315
foreach (var scope in scopes.Split(' ')) {
306316
identity.AddClaim(new Claim(property.Name, scope));
@@ -319,12 +329,12 @@ protected virtual async Task<AuthenticationTicket> CreateTicketAsync(string toke
319329
continue;
320330
}
321331

322-
var audiences = string.Join(" ", value.Select(item => item.Value<string>()));
323-
properties.Items[OAuthIntrospectionConstants.Properties.Audiences] = audiences;
332+
properties.Items[OAuthIntrospectionConstants.Properties.Audiences] = value.ToString(Formatting.None);
324333
}
325334

326335
else if (property.Value.Type == JTokenType.String) {
327-
properties.Items[OAuthIntrospectionConstants.Properties.Audiences] = (string) property.Value;
336+
properties.Items[OAuthIntrospectionConstants.Properties.Audiences] =
337+
new JArray((string) property.Value).ToString(Formatting.None);
328338
}
329339

330340
continue;

‎src/AspNet.Security.OAuth.Introspection/OAuthIntrospectionMiddleware.cs‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -57,11 +57,11 @@ public OAuthIntrospectionMiddleware(
5757

5858
if (Options.HttpClient == null) {
5959
Options.HttpClient = new HttpClient {
60-
Timeout = TimeSpan.FromSeconds(60),
60+
Timeout = TimeSpan.FromSeconds(15),
6161
MaxResponseContentBufferSize = 1024 * 1024 * 10
6262
};
6363

64-
Options.HttpClient.DefaultRequestHeaders.UserAgent.ParseAdd("ASP.NET OAuth2 introspection middleware");
64+
Options.HttpClient.DefaultRequestHeaders.UserAgent.ParseAdd("ASP.NET Core OAuth2 introspection middleware");
6565
}
6666
}
6767

‎src/AspNet.Security.OAuth.Introspection/OAuthIntrospectionOptions.cs‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -21,11 +21,11 @@ public OAuthIntrospectionOptions() {
2121
}
2222

2323
/// <summary>
24-
/// Gets or sets the intended audiences of this resource server.
24+
/// Gets the intended audiences of this resource server.
2525
/// Setting this property is recommended when the authorization
2626
/// server issues access tokens for multiple distinct resource servers.
2727
/// </summary>
28-
public IList<string> Audiences { get; } = new List<string>();
28+
public ISet<string> Audiences { get; } = new HashSet<string>();
2929

3030
/// <summary>
3131
/// Gets or sets the base address of the OAuth2/OpenID Connect server.
@@ -71,7 +71,7 @@ public OAuthIntrospectionOptions() {
7171
/// Gets or sets the HTTP client used to communicate
7272
/// with the remote OAuth2/OpenID Connect server.
7373
/// </summary>
74-
public HttpClient HttpClient { get; set; } = new HttpClient();
74+
public HttpClient HttpClient { get; set; }
7575

7676
/// <summary>
7777
/// Gets or sets the clock used to determine the current date/time.

‎src/AspNet.Security.OAuth.Validation/OAuthValidationHandler.cs‎

Lines changed: 21 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -5,13 +5,12 @@
55
*/
66

77
using System;
8-
using System.Diagnostics;
9-
using System.Linq;
108
using System.Security.Claims;
119
using System.Threading.Tasks;
1210
using Microsoft.AspNetCore.Authentication;
1311
using Microsoft.Extensions.Logging;
1412
using Microsoft.Net.Http.Headers;
13+
using Newtonsoft.Json.Linq;
1514

1615
namespace AspNet.Security.OAuth.Validation {
1716
public class OAuthValidationHandler : AuthenticationHandler<OAuthValidationOptions> {
@@ -129,12 +128,22 @@ protected virtual bool ValidateAudience(AuthenticationTicket ticket) {
129128
return false;
130129
}
131130

132-
// Ensure that the authentication ticket contains the registered audience.
133-
if (audiences == null || !audiences.Split(' ').Intersect(Options.Audiences, StringComparer.Ordinal).Any()) {
131+
if (string.IsNullOrEmpty(audiences)) {
134132
return false;
135133
}
136134

137-
return true;
135+
// Ensure that the authentication ticket contains one of the registered audiences.
136+
foreach (var audience in JArray.Parse(audiences).Values<string>()) {
137+
if (string.IsNullOrEmpty(audience)) {
138+
continue;
139+
}
140+
141+
if (Options.Audiences.Contains(audience)) {
142+
return true;
143+
}
144+
}
145+
146+
return false;
138147
}
139148

140149
protected virtual async Task<AuthenticationTicket> CreateTicketAsync(string token) {
@@ -150,14 +159,18 @@ protected virtual async Task<AuthenticationTicket> CreateTicketAsync(string toke
150159
});
151160
}
152161

153-
var identity = ticket.Principal.Identity as ClaimsIdentity;
154-
Debug.Assert(identity != null);
162+
// Resolve the primary identity associated with the principal.
163+
var identity = (ClaimsIdentity) ticket.Principal.Identity;
155164

156165
string scopes;
157166
// Copy the scopes extracted from the authentication ticket to the
158167
// ClaimsIdentity to make them easier to retrieve from application code.
159168
if (ticket.Properties.Items.TryGetValue(OAuthValidationConstants.Properties.Scopes, out scopes)) {
160-
foreach (var scope in scopes.Split(' ')) {
169+
foreach (var scope in JArray.Parse(scopes).Values<string>()) {
170+
if (string.IsNullOrEmpty(scope)) {
171+
continue;
172+
}
173+
161174
identity.AddClaim(new Claim(OAuthValidationConstants.Claims.Scope, scope));
162175
}
163176
}

‎src/AspNet.Security.OAuth.Validation/OAuthValidationOptions.cs‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,11 +19,11 @@ public OAuthValidationOptions() {
1919
}
2020

2121
/// <summary>
22-
/// Gets or sets the intended audiences of this resource server.
22+
/// Gets the intended audiences of this resource server.
2323
/// Setting this property is recommended when the authorization
2424
/// server issues access tokens for multiple distinct resource servers.
2525
/// </summary>
26-
public IList<string> Audiences { get; } = new List<string>();
26+
public ISet<string> Audiences { get; } = new HashSet<string>();
2727

2828
/// <summary>
2929
/// Gets or sets a boolean determining whether the access token should be stored in the

‎src/AspNet.Security.OAuth.Validation/project.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,7 @@
3333

3434
"dependencies": {
3535
"JetBrains.Annotations": { "type": "build", "version": "10.1.4" },
36+
"Newtonsoft.Json": "9.0.1",
3637
"Microsoft.AspNetCore.Authentication": "1.0.0"
3738
},
3839

‎src/Owin.Security.OAuth.Introspection/Events/ValidateTokenContext.cs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ public class ValidateTokenContext : BaseNotification<OAuthIntrospectionOptions>
1717
public ValidateTokenContext(
1818
[NotNull] IOwinContext context,
1919
[NotNull] OAuthIntrospectionOptions options,
20-
[NotNull] AuthenticationTicket ticket)
20+
[NotNull] AuthenticationTicket ticket)
2121
: base(context, options) {
2222
Ticket = ticket;
2323
}

‎src/Owin.Security.OAuth.Introspection/OAuthIntrospectionHandler.cs‎

Lines changed: 21 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,6 @@
77
using System;
88
using System.Collections.Generic;
99
using System.Diagnostics;
10-
using System.Linq;
1110
using System.Net.Http;
1211
using System.Net.Http.Headers;
1312
using System.Security.Claims;
@@ -17,6 +16,7 @@
1716
using Microsoft.Extensions.Logging;
1817
using Microsoft.Owin.Security;
1918
using Microsoft.Owin.Security.Infrastructure;
19+
using Newtonsoft.Json;
2020
using Newtonsoft.Json.Linq;
2121

2222
namespace Owin.Security.OAuth.Introspection {
@@ -223,12 +223,22 @@ protected virtual bool ValidateAudience(AuthenticationTicket ticket) {
223223
return false;
224224
}
225225

226-
// Ensure that the authentication ticket contains at least one of the registered audiences.
227-
if (audiences == null || !audiences.Split(' ').Intersect(Options.Audiences, StringComparer.Ordinal).Any()) {
226+
if (string.IsNullOrEmpty(audiences)) {
228227
return false;
229228
}
230229

231-
return true;
230+
// Ensure that the authentication ticket contains one of the registered audiences.
231+
foreach (var audience in JArray.Parse(audiences).Values<string>()) {
232+
if (string.IsNullOrEmpty(audience)) {
233+
continue;
234+
}
235+
236+
if (Options.Audiences.Contains(audience)) {
237+
return true;
238+
}
239+
}
240+
241+
return false;
232242
}
233243

234244
protected virtual async Task<AuthenticationTicket> CreateTicketAsync(string token, JObject payload) {
@@ -254,7 +264,6 @@ protected virtual async Task<AuthenticationTicket> CreateTicketAsync(string toke
254264
continue;
255265
}
256266

257-
258267
case OAuthIntrospectionConstants.Claims.ExpiresAt: {
259268
properties.ExpiresUtc = new DateTimeOffset(1970, 1, 1, 0, 0, 0, 0, TimeSpan.Zero) +
260269
TimeSpan.FromSeconds((long) property.Value);
@@ -275,7 +284,7 @@ protected virtual async Task<AuthenticationTicket> CreateTicketAsync(string toke
275284

276285
continue;
277286
}
278-
287+
279288
// Add the token identifier as a property on the authentication ticket.
280289
case OAuthIntrospectionConstants.Claims.JwtId: {
281290
properties.Dictionary[OAuthIntrospectionConstants.Properties.TicketId] = (string) property;
@@ -289,8 +298,9 @@ protected virtual async Task<AuthenticationTicket> CreateTicketAsync(string toke
289298
case OAuthIntrospectionConstants.Claims.Scope: {
290299
var scopes = (string) property.Value;
291300

292-
// Store the scopes list as-is in the authentication properties.
293-
properties.Dictionary[OAuthIntrospectionConstants.Properties.Scopes] = scopes;
301+
// Store the scopes list in the authentication properties.
302+
properties.Dictionary[OAuthIntrospectionConstants.Properties.Scopes] =
303+
new JArray(scopes.Split(' ')).ToString(Formatting.None);
294304

295305
foreach (var scope in scopes.Split(' ')) {
296306
identity.AddClaim(new Claim(property.Name, scope));
@@ -309,12 +319,12 @@ protected virtual async Task<AuthenticationTicket> CreateTicketAsync(string toke
309319
continue;
310320
}
311321

312-
var audiences = string.Join(" ", value.Select(item => item.Value<string>()));
313-
properties.Dictionary[OAuthIntrospectionConstants.Properties.Audiences] = audiences;
322+
properties.Dictionary[OAuthIntrospectionConstants.Properties.Audiences] = value.ToString(Formatting.None);
314323
}
315324

316325
else if (property.Value.Type == JTokenType.String) {
317-
properties.Dictionary[OAuthIntrospectionConstants.Properties.Audiences] = (string) property.Value;
326+
properties.Dictionary[OAuthIntrospectionConstants.Properties.Audiences] =
327+
new JArray((string) property.Value).ToString(Formatting.None);
318328
}
319329

320330
continue;

‎src/Owin.Security.OAuth.Introspection/OAuthIntrospectionMiddleware.cs‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -71,11 +71,11 @@ public OAuthIntrospectionMiddleware(
7171

7272
if (options.HttpClient == null) {
7373
options.HttpClient = new HttpClient {
74-
Timeout = TimeSpan.FromSeconds(60),
74+
Timeout = TimeSpan.FromSeconds(15),
7575
MaxResponseContentBufferSize = 1024 * 1024 * 10
7676
};
7777

78-
options.HttpClient.DefaultRequestHeaders.UserAgent.ParseAdd("ASP.NET OAuth2 introspection middleware");
78+
options.HttpClient.DefaultRequestHeaders.UserAgent.ParseAdd("OWIN OAuth2 introspection middleware");
7979
}
8080
}
8181

0 commit comments

Comments
 (0)