Skip to content

Commit

Permalink
Merge pull request #18 from ITfoxtec/Development
Browse files Browse the repository at this point in the history 
.NET 6.0 and .NET 5.0 only read ID token. .NET Standard 2.0 validates…
  • Loading branch information
@Revsgaard
Revsgaard authored Jan 3, 2022
2 parents d1a980c + edefb51 commit 4c59689
Show file tree
Hide file tree
Showing 2 changed files with 44 additions and 28 deletions.
6 changes: 3 additions & 3 deletions src/ITfoxtec.Identity.BlazorWA.Oidc/ITfoxtec.Identity.BlazorWA.Oidc.csproj
View file
Original file line number Diff line number Diff line change
Expand Up @@ -22,9 +22,9 @@ The component automatically handle token / session update with use of the refres
<PackageTags>Blazor WebAssembly OpenID Connect (OIDC) Proof Key for Code Exchange (PKCE) id token access token refresh token</PackageTags>
<GeneratePackageOnBuild>true</GeneratePackageOnBuild>
<Copyright>© 2020 ITfoxtec</Copyright>
<AssemblyVersion>1.6.2.0</AssemblyVersion>
<FileVersion>1.6.2.0</FileVersion>
<Version>1.6.2</Version>
<AssemblyVersion>1.6.3.0</AssemblyVersion>
<FileVersion>1.6.3.0</FileVersion>
<Version>1.6.3</Version>
</PropertyGroup>

<ItemGroup>
Expand Down
66 changes: 41 additions & 25 deletions src/ITfoxtec.Identity.BlazorWA.Oidc/OpenidConnectPkce.cs
View file
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,9 @@
using System.Security;
using System.Security.Claims;
using System.Threading.Tasks;
#if !NET50 && !NET60
using ITfoxtec.Identity.Models;
#endif

namespace ITfoxtec.Identity.BlazorWebAssembly.OpenidConnect
{
Expand Down Expand Up @@ -161,13 +164,19 @@ public async Task LoginCallBackAsync(string responseUrl)
if (tokenResponse.AccessToken.IsNullOrEmpty()) throw new ArgumentNullException(nameof(tokenResponse.AccessToken), tokenResponse.GetTypeName());
if (tokenResponse.ExpiresIn <= 0) throw new ArgumentNullException(nameof(tokenResponse.ExpiresIn), tokenResponse.GetTypeName());

//var oidcDiscoveryKeySet = await GetOidcDiscoveryKeysAsync(openidClientPkceState.OidcDiscoveryUri);

//(var idTokenPrincipal, _) = JwtHandler.ValidateToken(tokenResponse.IdToken, oidcDiscovery.Issuer, oidcDiscoveryKeySet.Keys.ToMSJsonWebKeys(), openidClientPkceState.ClientId,
// nameClaimType: globalOpenidClientPkceSettings.NameClaimType, roleClaimType: globalOpenidClientPkceSettings.RoleClaimType);
// Changed to only read ID token and not do validation

// .NET 5.0 error, System.Security.Cryptography.RSA.Create() - System.PlatformNotSupportedException: System.Security.Cryptography.Algorithms is not supported on this platform.
// https://github.com/dotnet/aspnetcore/issues/26123
// https://github.com/dotnet/runtime/issues/40074
// .NET 7
// https://github.com/dotnet/designs/blob/main/accepted/2021/blazor-wasm-crypto.md#net-7-plan
#if !NET50 && !NET60
var oidcDiscoveryKeySet = await GetOidcDiscoveryKeysAsync(openidClientPkceState.OidcDiscoveryUri);

(var idTokenPrincipal, _) = JwtHandler.ValidateToken(tokenResponse.IdToken, oidcDiscovery.Issuer, oidcDiscoveryKeySet.Keys.ToMSJsonWebKeys(), openidClientPkceState.ClientId,
nameClaimType: globalOpenidClientPkceSettings.NameClaimType, roleClaimType: globalOpenidClientPkceSettings.RoleClaimType);
#else
var idTokenPrincipal = JwtHandler.ReadTokenClaims(tokenResponse.IdToken);
#endif

var nonce = idTokenPrincipal.Claims.Where(c => c.Type == JwtClaimTypes.Nonce).Select(c => c.Value).FirstOrDefault();
if (!openidClientPkceState.Nonce.Equals(nonce, StringComparison.Ordinal))
Expand Down Expand Up @@ -228,13 +237,19 @@ public async Task<OidcUserSession> HandleRefreshTokenAsync(OidcUserSession userS
if (tokenResponse.AccessToken.IsNullOrEmpty()) throw new ArgumentNullException(nameof(tokenResponse.AccessToken), tokenResponse.GetTypeName());
if (tokenResponse.ExpiresIn <= 0) throw new ArgumentNullException(nameof(tokenResponse.ExpiresIn), tokenResponse.GetTypeName());

//var oidcDiscoveryKeySet = await GetOidcDiscoveryKeysAsync(oidcDiscoveryUri);

//(var idTokenPrincipal, _) = JwtHandler.ValidateToken(tokenResponse.IdToken, oidcDiscovery.Issuer, oidcDiscoveryKeySet.Keys, clientId,
// nameClaimType: globalOpenidClientPkceSettings.NameClaimType, roleClaimType: globalOpenidClientPkceSettings.RoleClaimType);
// Changed to only read ID token and not do validation

// .NET 5.0 error, System.Security.Cryptography.RSA.Create() - System.PlatformNotSupportedException: System.Security.Cryptography.Algorithms is not supported on this platform.
// https://github.com/dotnet/aspnetcore/issues/26123
// https://github.com/dotnet/runtime/issues/40074
// .NET 7
// https://github.com/dotnet/designs/blob/main/accepted/2021/blazor-wasm-crypto.md#net-7-plan
#if !NET50 && !NET60
var oidcDiscoveryKeySet = await GetOidcDiscoveryKeysAsync(oidcDiscoveryUri);

(var idTokenPrincipal, _) = JwtHandler.ValidateToken(tokenResponse.IdToken, oidcDiscovery.Issuer, oidcDiscoveryKeySet.Keys, clientId,
nameClaimType: globalOpenidClientPkceSettings.NameClaimType, roleClaimType: globalOpenidClientPkceSettings.RoleClaimType);
#else
var idTokenPrincipal = JwtHandler.ReadTokenClaims(tokenResponse.IdToken);
#endif

if (!subject.IsNullOrEmpty() && subject != idTokenPrincipal.Claims.Where(c => c.Type == globalOpenidClientPkceSettings.NameClaimType).Single().Value)
{
Expand Down Expand Up @@ -353,19 +368,20 @@ private async Task<OidcDiscovery> GetOidcDiscoveryAsync(string oidcDiscoveryUri)
}
}

// Changed to only read ID token and not do validation
//private async Task<JsonWebKeySet> GetOidcDiscoveryKeysAsync(string oidcDiscoveryUri)
//{
// try
// {
// var oidcDiscoveryHandler = serviceProvider.GetService<OidcDiscoveryHandler>();
// return await oidcDiscoveryHandler.GetOidcDiscoveryKeysAsync(oidcDiscoveryUri);
// }
// catch (Exception ex)
// {
// throw new Exception($"Failed to fetch OIDC Discovery Keys from discovery '{oidcDiscoveryUri}'.", ex);
// }
//}
#if !NET50 && !NET60
private async Task<JsonWebKeySet> GetOidcDiscoveryKeysAsync(string oidcDiscoveryUri)
{
try
{
var oidcDiscoveryHandler = serviceProvider.GetService<OidcDiscoveryHandler>();
return await oidcDiscoveryHandler.GetOidcDiscoveryKeysAsync(oidcDiscoveryUri);
}
catch (Exception ex)
{
throw new Exception($"Failed to fetch OIDC Discovery Keys from discovery '{oidcDiscoveryUri}'.", ex);
}
}
#endif

private async Task<string> SaveStateAsync(OpenidConnectPkceSettings openidConnectPkceSettings, string callBackUri, string redirectUri, string codeVerifier = null, string nonce = null)
{
Expand Down

0 comments on commit 4c59689

Please sign in to comment.