External Authorization with OpenIdConnect - Roles from UserInfoEndpoint #9964

4 Answer(s)

• 

  0

  ismcagdas created 3 years ago

  Support Team

  Hi @henryand

  At the moment, it is not possible to achive this but we can share related class with you. Just, copy it to your project and use it TokenAuthController. We will add such functionality for the following versions.

  public class OpenIdConnectAuthProviderApi : ExternalAuthProviderApiBase
      {
          public const string Name = "OpenIdConnect";
  
          public async override Task<ExternalAuthUserInfo> GetUserInfo(string token)
          {
              var issuer = ProviderInfo.AdditionalParams["Authority"];
              if (string.IsNullOrEmpty(issuer))
              {
                  throw new ApplicationException("Authentication:OpenId:Issuer configuration is required.");
              }
  
              var configurationManager = new ConfigurationManager<OpenIdConnectConfiguration>(
                  issuer + "/.well-known/openid-configuration",
                  new OpenIdConnectConfigurationRetriever(),
                  new HttpDocumentRetriever());
  
              var validatedTokenResult = await ValidateToken(token, issuer, configurationManager);
  
              var fullNameClaim = validatedTokenResult.Principal.Claims.FirstOrDefault(c => c.Type == "name");
  
              if (fullNameClaim == null)
              {
                  throw new UserFriendlyException("name claim is missing !");
              }
  
              var emailClaim = validatedTokenResult.Principal.Claims.FirstOrDefault(c => c.Type == "unique_name");
  
              if (emailClaim == null)
              {
                  throw new UserFriendlyException("unique_name claim is missing !");
              }
  
              var fullNameParts = fullNameClaim.Value.Split(' ');
  
              return new ExternalAuthUserInfo
              {
                  Provider = Name,
                  ProviderKey = validatedTokenResult.Token.Subject,
                  Name = fullNameParts[0],
                  Surname = fullNameParts.Length > 1 ? fullNameParts[1] : fullNameParts[0],
                  EmailAddress = emailClaim.Value
              };
          }
  
          private async Task<ValidateTokenResult> ValidateToken(
              string token,
              string issuer,
              IConfigurationManager<OpenIdConnectConfiguration> configurationManager,
              CancellationToken ct = default(CancellationToken))
          {
              if (string.IsNullOrEmpty(token))
              {
                  throw new ArgumentNullException(nameof(token));
              }
  
              if (string.IsNullOrEmpty(issuer))
              {
                  throw new ArgumentNullException(nameof(issuer));
              }
  
              var discoveryDocument = await configurationManager.GetConfigurationAsync(ct);
              var signingKeys = discoveryDocument.SigningKeys;
  
              var validationParameters = new TokenValidationParameters
              {
                  ValidateIssuer = bool.Parse(ProviderInfo.AdditionalParams["ValidateIssuer"]),
                  ValidIssuer = issuer,
                  ValidateIssuerSigningKey = true,
                  IssuerSigningKeys = signingKeys,
                  ValidateLifetime = true,
                  ClockSkew = TimeSpan.FromMinutes(5),
                  ValidateAudience = false
              };
  
              var principal = new JwtSecurityTokenHandler().ValidateToken(token, validationParameters, out var rawValidatedToken);
              principal.AddMappedClaims(ProviderInfo.ClaimMappings);
  
              var audienceClaim = principal.Claims.FirstOrDefault(c => c.Type == "aud");
  
              if (audienceClaim == null)
              {
                  throw new UserFriendlyException("aud claim is missing !");
              }
  
              //Validate clientId
              if (ProviderInfo.ClientId != audienceClaim.Value)
              {
                  throw new ApplicationException("ClientId couldn't verified.");
              }
  
              return new ValidateTokenResult((JwtSecurityToken)rawValidatedToken, principal);
          }
  
          class ValidateTokenResult
          {
              public JwtSecurityToken Token { get; set; }
  
              public ClaimsPrincipal Principal { get; set; }
  
              public ValidateTokenResult(JwtSecurityToken token, ClaimsPrincipal principal)
              {
                  Token = token;
                  Principal = principal;
              }
          }
      }
  

  Save Cancel
• 

  0

  ismcagdas created 3 years ago

  Support Team

  I have created the issue, please follow https://github.com/aspnetzero/aspnet-zero-core/issues/3693. You can delete this class from your project when the related issue is completed.

  Save Cancel
• 

  0

  [email protected] created 3 years ago

  I am trying to get to get an additional value from the token and can't seem to understand how to get the additional values using the code above.

  I can do this in TokenAuthController but it seems like a hack.

          var handler = new JwtSecurityTokenHandler();
          var jwtSecurityToken = handler.ReadJwtToken(model.ProviderAccessCode);
          var oidValue = jwtSecurityToken.Claims.First(claim => claim.Type == "oid").Value;
  

  Save Cancel
• 

  0

  ismcagdas created 3 years ago

  Support Team

  Hi,

  Your approach is fine at the moment because the class I have shared above is in the license packages and can't be overwritten.

  Save Cancel