Skip to content

Commit 49c7a40

Browse files
paule96paule96
committed
refactor via skype and live share.
1 parent 18dc41a commit 49c7a40

5 files changed

Lines changed: 47 additions & 32 deletions

File tree

‎README.md‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -106,9 +106,10 @@ For example:
106106
107107
## Authors
108108

109-
* **Kirsten Kluge** - *Initial work* - [kirkone](https://github.com/kirkone)
110-
* **paule96** - *Refactoring* - [paule96](https://github.com/paule96)
111-
* **Christoph Sonntag** - *Made things even more uber* - [Compufreak345](https://github.com/Compufreak345)
109+
- **Kirsten Kluge** - _Initial work_ - [kirkone](https://github.com/kirkone)
110+
- **paule96** - _Refactoring_ - [paule96](https://github.com/paule96)
111+
- **Christoph Sonntag** - _Made things even more uber_ - [Compufreak345](https://github.com/Compufreak345)
112+
- **myusrn** - _Dropped some knowledge about making IsInRoles work_ - [myusrn](https://github.com/myusrn)
112113

113114
See also the list of [contributors](https://github.com/kirkone/KK.AspNetCore.EasyAuthAuthentication/graphs/contributors) who participated in this project.
114115

@@ -118,4 +119,4 @@ This project is licensed under the MIT License - see the [LICENSE.md](LICENSE.md
118119

119120
## Acknowledgments
120121

121-
* Inspired by this [StackOverflow post](https://stackoverflow.com/a/42402163/6526640) and this [GitHub](https://github.com/lpunderscore/azureappservice-authentication-middleware) repo
122+
- Inspired by this [StackOverflow post](https://stackoverflow.com/a/42402163/6526640) and this [GitHub](https://github.com/lpunderscore/azureappservice-authentication-middleware) repo

‎src/KK.AspNetCore.EasyAuthAuthentication/AuthenticationTicketBuilder.cs‎

Lines changed: 23 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -13,21 +13,21 @@ public static class AuthenticationTicketBuilder
1313
/// Build a `AuthenticationTicket` from the given payload, the principal name and the provider name
1414
/// </summary>
1515
/// <param name="claimsPayload">A array of JObjects that have a `type` and a `val` property</param>
16-
/// <param name="principalName">The principal name of the user.</param>
17-
/// /// <param name="providerName">The provider name of the current auth provider.</param>
16+
/// <param name="providerName">The provider name of the current auth provider.</param>
1817
/// <returns>A `AuthenticationTicket`</returns>
19-
public static AuthenticationTicket Build(IEnumerable<JObject> claimsPayload, string principalName, string providerName)
18+
public static AuthenticationTicket Build(IEnumerable<JObject> claimsPayload, string providerName)
2019
{
21-
var identity = new ClaimsIdentity(createClaims(claimsPayload), AuthenticationTypesNames.Federation); // setting ClaimsIdentity.AuthenticationType to value that azuread non-easyauth setups use
22-
addScpClaim(identity);
23-
identity.AddClaim(new Claim("provider_name", providerName));
20+
var identity = new ClaimsIdentity(
21+
createClaims(claimsPayload),
22+
// setting ClaimsIdentity.AuthenticationType to value that Azure AD non-EasyAuth setups use
23+
AuthenticationTypesNames.Federation
24+
);
25+
26+
addScopeClaim(identity);
27+
addProviderNameClaim(identity, providerName);
2428
var genericPrincipal = new ClaimsPrincipal(identity);
25-
return new AuthenticationTicket(genericPrincipal, EasyAuthAuthenticationDefaults.AuthenticationScheme);
26-
}
2729

28-
private static IEnumerable<JObject> getTheClaimsNodeFromPayload(JObject payload)
29-
{
30-
return payload["user_claims"].Children<JObject>();
30+
return new AuthenticationTicket(genericPrincipal, EasyAuthAuthenticationDefaults.AuthenticationScheme);
3131
}
3232

3333
private static IEnumerable<Claim> createClaims(IEnumerable<JObject> claimsAsJson)
@@ -56,11 +56,21 @@ private static IEnumerable<Claim> createClaims(IEnumerable<JObject> claimsAsJson
5656
}
5757
}
5858

59-
private static void addScpClaim(ClaimsIdentity identity)
59+
private static void addScopeClaim(ClaimsIdentity identity)
6060
{
6161
if (!identity.Claims.Any(claim => claim.Type == "scp"))
6262
{
63-
identity.AddClaim(new Claim("scp", "user_impersonation")); // not sure why easyauth is dropping this
63+
// We are not sure if we should add this in to match what non-EasyAuth authenticated result would look like
64+
// with EasyAuth + Express based application configurations the scope claim will always be `user_impersonation`
65+
identity.AddClaim(new Claim("scp", "user_impersonation"));
66+
}
67+
}
68+
69+
private static void addProviderNameClaim(ClaimsIdentity identity, string providerName)
70+
{
71+
if (!identity.Claims.Any(claim => claim.Type == "provider_name"))
72+
{
73+
identity.AddClaim(new Claim("provider_name", providerName));
6474
}
6575
}
6676
}

‎src/KK.AspNetCore.EasyAuthAuthentication/EasyAuthAuthenticationHandler.cs‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,6 @@ protected override async Task<AuthenticateResult> HandleAuthenticateAsync()
6969
{
7070
if (isContextUserNotAuthenticated(this.Context.User))
7171
{
72-
// TODO: If this the only auth middleware we maybe must return a `AuthenticateResult.Fail()`
7372
this.Logger.LogInformation("The identity isn't set by easy auth.");
7473
}
7574
else

‎src/KK.AspNetCore.EasyAuthAuthentication/Services/EasyAuthWithAuthMeService.cs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -95,7 +95,7 @@ private AuthenticationTicket BuildIdentityFromEasyAuthMeJson(JObject payload)
9595

9696
this.Logger.LogInformation("building claims from payload...");
9797
var providerName = payload["provider_name"].Value<string>();
98-
return AuthenticationTicketBuilder.Build(payload["user_claims"].Children<JObject>(), name, providerName);
98+
return AuthenticationTicketBuilder.Build(payload["user_claims"].Children<JObject>(), providerName);
9999
}
100100

101101
private async Task<JArray> GetAuthMe(HttpClientHandler handler, HttpRequestMessage httpRequest)

‎src/KK.AspNetCore.EasyAuthAuthentication/Services/EasyAuthWithHeaderService.cs‎

Lines changed: 18 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -14,16 +14,16 @@ namespace KK.AspNetCore.EasyAuthAuthentication.Services
1414
{
1515
public class EasyAuthWithHeaderService
1616
{
17-
public const string PrincipalNameHeader = "X-MS-CLIENT-PRINCIPAL-NAME";
17+
private const string PrincipalNameHeader = "X-MS-CLIENT-PRINCIPAL-NAME";
1818
/// <summary>
1919
/// JWT
2020
/// </summary>
21-
public const string PrincipalObjectHeader = "X-MS-CLIENT-PRINCIPAL";
22-
public const string PrincipalIdpHeaderName = "X-MS-CLIENT-PRINCIPAL-IDP";
23-
public ILogger Logger { get; }
24-
public IHeaderDictionary Headers { get; }
21+
private const string PrincipalObjectHeader = "X-MS-CLIENT-PRINCIPAL";
22+
private const string PrincipalIdpHeaderName = "X-MS-CLIENT-PRINCIPAL-IDP";
23+
private ILogger Logger { get; }
24+
private IHeaderDictionary Headers { get; }
2525

26-
public EasyAuthWithHeaderService(
26+
private EasyAuthWithHeaderService(
2727
ILogger logger,
2828
IHeaderDictionary headers
2929
)
@@ -37,30 +37,35 @@ IHeaderDictionary headers
3737
/// </summary>
3838
/// <param name="logger">a logger</param>
3939
/// <param name="context">Http context of the request</param>
40-
/// <returns>An `AuthenticationTicket`</returns>
40+
/// <returns>An <see cref="AuthenticationTicket" /></returns>
4141
public static AuthenticateResult AuthUser(ILogger logger, HttpContext context)
4242
{
4343
var service = new EasyAuthWithHeaderService(logger, context.Request.Headers);
4444
var ticket = service.BuildIdentityFromEasyAuthRequestHeaders();
45+
4546
logger.LogInformation("Set identity to user context object.");
4647
context.User = ticket.Principal;
4748
logger.LogInformation("identity build was a success, returning ticket");
49+
4850
return AuthenticateResult.Success(ticket);
4951
}
5052

5153
private AuthenticationTicket BuildIdentityFromEasyAuthRequestHeaders()
5254
{
5355
var name = this.Headers[PrincipalNameHeader][0];
54-
this.Logger.LogDebug($"payload was fetched from easyauth headers, name: {name}");
55-
56-
var identity = new GenericIdentity(name, AuthenticationTypesNames.Federation); // setting ClaimsIdentity.AuthenticationType to value that azureAd non-easyauth setups use
56+
this.Logger.LogDebug($"payload was fetched from EasyAuth headers, name: {name}");
5757

5858
this.Logger.LogInformation("building claims from payload...");
59+
var xMsClientPrincipal = JObject.Parse(
60+
Encoding.UTF8.GetString(
61+
Convert.FromBase64String(this.Headers[PrincipalObjectHeader][0])
62+
)
63+
);
5964

60-
var xMsClientPrincipal = JObject.Parse(Encoding.UTF8.GetString(Convert.FromBase64String(this.Headers[PrincipalObjectHeader][0])));
6165
var claims = xMsClientPrincipal["claims"].Children<JObject>();
62-
var providerName = this.Headers["X-MS-CLIENT-PRINCIPAL-IDP"][0];
63-
return AuthenticationTicketBuilder.Build(claims, name, providerName);
66+
var providerName = this.Headers[PrincipalIdpHeaderName][0];
67+
68+
return AuthenticationTicketBuilder.Build(claims, providerName);
6469
}
6570
}
6671
}

0 commit comments

Comments
 (0)