IdentityServer4 AccessTokenValidation #3969

evadmin created 6 years ago

So I was finally able to make this work with a hack. I'll share what I did in case anyone else runs into trouble.

When accessing protected routes, AuthorizationHelper.AuthorizeAsync() is called:

public async Task AuthorizeAsync(IEnumerable<IAbpAuthorizeAttribute> authorizeAttributes)
        {
            if (!_authConfiguration.IsEnabled)
            {
                return;
            }

            if (!AbpSession.UserId.HasValue)  //this was ALWAYS NULL for me
            {
                throw new AbpAuthorizationException(
                    LocalizationManager.GetString(AbpConsts.LocalizationSourceName, "CurrentUserDidNotLoginToTheApplication")
                    );
            }

            foreach (var authorizeAttribute in authorizeAttributes)
            {
                await PermissionChecker.AuthorizeAsync(authorizeAttribute.RequireAllPermissions, authorizeAttribute.Permissions);
            }
        }

Digging deeper, I found that userIdClaim in ClaimsAbpSession was ALWAYS NULL as well:

public class ClaimsAbpSession : AbpSessionBase, ISingletonDependency
    {
        public override long? UserId
        {
            get
            {
                if (OverridedValue != null)
                {
                    return OverridedValue.UserId;
                }
                
                //userIdClaim is always null because AbpClaimTypes.UserId == "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier";
                var userIdClaim = PrincipalAccessor.Principal?.Claims.FirstOrDefault(c => c.Type == AbpClaimTypes.UserId);
                if (string.IsNullOrEmpty(userIdClaim?.Value))
                {
                    return null;
                }

                long userId;
                if (!long.TryParse(userIdClaim.Value, out userId))
                {
                    return null;
                }

                return userId;
            }
        }

The accessToken returned by IdentityServer4 as a "sub" claim with the UserId value in it, so I simply added

AbpClaimTypes.UserId = "sub";

to Evsuite.Admin.Web.Host.AuthConfigurer.Configure();

Now ClaimsAbpSession.UserId is set to the correct AbpUsers.Id.

IdentityServer4 AccessTokenValidation #3969

2 Answer(s)