L'identité du Serveur 4 Code d'Autorisation de Flux exemple

Voici une mise en œuvre d'un Code d'Autorisation de Débit avec l'Identité du Serveur 4 et d'un MVC client pour en consommer.

IdentityServer4 pouvez utiliser un client.cs fichier pour enregistrer nos MVC client, il est ClientId, ClientSecret, autorisés les types de subventions (Code d'Autorisation dans ce cas), et la RedirectUri de notre client:

public class Clients
{
    public static IEnumerable<Client> Get()
    {
        var secret = new Secret { Value = "mysecret".Sha512() };

        return new List<Client> {
            new Client {
                ClientId = "authorizationCodeClient2",
                ClientName = "Authorization Code Client",
                ClientSecrets = new List<Secret> { secret },
                Enabled = true,
                AllowedGrantTypes = new List<string> { "authorization_code" }, //DELTA //IdentityServer3 wanted Flow = Flows.AuthorizationCode,
                RequireConsent = true,
                AllowRememberConsent = false,
                RedirectUris =
                  new List<string> {
                       "http://localhost:5436/account/oAuth2"
                  },
                PostLogoutRedirectUris =
                  new List<string> {"http://localhost:5436"},
                AllowedScopes = new List<string> {
                    "api"
                },
                AccessTokenType = AccessTokenType.Jwt
            }
        };
    }
}

Cette classe est référencé dans la ConfigurationServices méthode de Démarrage.cs dans le IdentityServer4 projet:

    public void ConfigureServices(IServiceCollection services)
    {
        ////Grab key for signing JWT signature
        ////In prod, we'd get this from the certificate store or similar
        var certPath = Path.Combine(PlatformServices.Default.Application.ApplicationBasePath, "SscSign.pfx");
        var cert = new X509Certificate2(certPath);

        //configure identity server with in-memory stores, keys, clients and scopes
        services.AddDeveloperIdentityServer(options =>
            {
                options.IssuerUri = "SomeSecureCompany";
            })
            .AddInMemoryScopes(Scopes.Get())
            .AddInMemoryClients(Clients.Get())
            .AddInMemoryUsers(Users.Get())
            .SetSigningCredential(cert);

        services.AddMvc();
    }

Pour référence, voici les Utilisateurs et les Étendues de classes référencées ci-dessus:

public static class Users
{
    public static List<InMemoryUser> Get()
    {
        return new List<InMemoryUser> {
            new InMemoryUser {
                Subject = "1",
                Username = "user",
                Password = "pass123",
                Claims = new List<Claim> {
                    new Claim(ClaimTypes.GivenName, "GivenName"),
                    new Claim(ClaimTypes.Surname, "surname"), //DELTA //.FamilyName in IdentityServer3
                    new Claim(ClaimTypes.Email, "[email protected]"),
                    new Claim(ClaimTypes.Role, "Badmin")
                }
            }
        };
    }
}

public class Scopes
{
    //scopes define the resources in your system
    public static IEnumerable<Scope> Get()
    {
        return new List<Scope> {
            new Scope
            {
                Name = "api",
                DisplayName = "api scope",
                Type = ScopeType.Resource,
                Emphasize = false,
            }
        };
    }
}

La MVC de l'application nécessite deux méthodes de contrôleur. La première méthode commencera le Fournisseur de Service (SP-Initiés) de flux de travail. Il crée un État de la valeur, l'enregistre dans le cookie d'authentification basée sur les middleware, puis redirige le navigateur vers le IdentityProvider (IdP) - notre IdentityServer4 projet dans ce cas.

public ActionResult SignIn()
{
    var state = Guid.NewGuid().ToString("N");

    //Store state using cookie-based authentication middleware
    this.SaveState(state);

    //Redirect to IdP to get an Authorization Code
    var url = idPServerAuthUri +
        "?client_id=" + clientId +
        "&response_type=" + response_type +
        "&redirect_uri=" + redirectUri +
        "&scope=" + scope +
        "&state=" + state;

    return this.Redirect(url); //performs a GET
}

Pour référence, voici les constantes et SaveState méthode utilisée ci-dessus:

//Client and workflow values
private const string clientBaseUri = @"http://localhost:5436";
private const string validIssuer = "SomeSecureCompany";
private const string response_type = "code";
private const string grantType = "authorization_code";

//IdentityServer4
private const string idPServerBaseUri = @"http://localhost:5000";
private const string idPServerAuthUri = idPServerBaseUri + @"/connect/authorize";
private const string idPServerTokenUriFragment = @"connect/token";
private const string idPServerEndSessionUri = idPServerBaseUri + @"/connect/endsession";

//These are also registered in the IdP (or Clients.cs of test IdP)
private const string redirectUri = clientBaseUri + @"/account/oAuth2";
private const string clientId = "authorizationCodeClient2";
private const string clientSecret = "mysecret";
private const string audience = "SomeSecureCompany/resources";
private const string scope = "api";


//Store values using cookie-based authentication middleware
private void SaveState(string state)
{
    var tempId = new ClaimsIdentity("TempCookie");
    tempId.AddClaim(new Claim("state", state));

    this.Request.GetOwinContext().Authentication.SignIn(tempId);
}

La deuxième MVC action méthode est appelée par IdenityServer4 après que l'utilisateur saisit ses informations d'identification et vérifie tout d'autorisation de boîtes. La méthode d'action:

• Saisit le Code d'Autorisation et de l'État de la chaîne de requête
• Valide De L'État
• Postes retour à IdentityServer4 pour échanger le Code d'Autorisation pour un Jeton d'Accès

Voici la méthode:

[HttpGet]
public async Task<ActionResult> oAuth2()
{
var authorizationCode = this.Request.QueryString["code"];
var state = this.Request.QueryString["state"];
//Defend against CSRF attacks http://www.twobotechnologies.com/blog/2014/02/importance-of-state-in-oauth2.html
await ValidateStateAsync(state);
//Exchange Authorization Code for an Access Token by POSTing to the IdP's token endpoint
string json = null;
using (var client = new HttpClient())
{
client.BaseAddress = new Uri(idPServerBaseUri);
var content = new FormUrlEncodedContent(new[]
{
new KeyValuePair<string, string>("grant_type", grantType)
,new KeyValuePair<string, string>("code", authorizationCode)
,new KeyValuePair<string, string>("redirect_uri", redirectUri)
,new KeyValuePair<string, string>("client_id", clientId)              //consider sending via basic authentication header
,new KeyValuePair<string, string>("client_secret", clientSecret)
});
var httpResponseMessage = client.PostAsync(idPServerTokenUriFragment, content).Result;
json = httpResponseMessage.Content.ReadAsStringAsync().Result;
}
//Extract the Access Token
dynamic results = JsonConvert.DeserializeObject<dynamic>(json);
string accessToken = results.access_token;
//Validate token crypto
var claims = ValidateToken(accessToken);
//What is done here depends on your use-case. 
//If the accessToken is for calling a WebAPI, the next few lines wouldn't be needed. 
//Build claims identity principle
var id = new ClaimsIdentity(claims, "Cookie");              //"Cookie" matches middleware named in Startup.cs
//Sign into the middleware so we can navigate around secured parts of this site (e.g. [Authorized] attribute)
this.Request.GetOwinContext().Authentication.SignIn(id);
return this.Redirect("/Home"); 
}

De vérifier que l'État a reçu est ce que vous attendiez aide à se défendre contre les attaques de type CSRF: http://www.twobotechnologies.com/blog/2014/02/importance-of-state-in-oauth2.html

Ce ValidateStateAsync méthode permet de comparer les reçus de l'Etat à ce qui a été enregistré désactiver le cookie de middleware:

private async Task<AuthenticateResult> ValidateStateAsync(string state)
{
//Retrieve state value from TempCookie
var authenticateResult = await this.Request
.GetOwinContext()
.Authentication
.AuthenticateAsync("TempCookie");
if (authenticateResult == null)
throw new InvalidOperationException("No temp cookie");
if (state != authenticateResult.Identity.FindFirst("state").Value)
throw new InvalidOperationException("invalid state");
return authenticateResult;
}

Ce ValidateToken méthode utilise le Système Microsoft.IdentityModel et du Système.IdentityModel.Jetons.Jwt bibliothèques de vérifier que JWT est bien signé.

private IEnumerable<Claim> ValidateToken(string token)
{
//Grab certificate for verifying JWT signature
//IdentityServer4 also has a default certificate you can might reference.
//In prod, we'd get this from the certificate store or similar
var certPath = Path.Combine(Server.MapPath("~/bin"), "SscSign.pfx");
var cert = new X509Certificate2(certPath);
var x509SecurityKey = new X509SecurityKey(cert);
var parameters = new TokenValidationParameters
{
RequireSignedTokens = true,
ValidAudience = audience,
ValidIssuer = validIssuer,
IssuerSigningKey = x509SecurityKey,
RequireExpirationTime = true,
ClockSkew = TimeSpan.FromMinutes(5)
};
//Validate the token and retrieve ClaimsPrinciple
var handler = new JwtSecurityTokenHandler();
SecurityToken jwt;
var id = handler.ValidateToken(token, parameters, out jwt);
//Discard temp cookie and cookie-based middleware authentication objects (we just needed it for storing State)
this.Request.GetOwinContext().Authentication.SignOut("TempCookie");
return id.Claims;
}

Une solution contenant ces fichiers source se trouve sur GitHub à https://github.com/bayardw/IdentityServer4.Authorization.Code