diff --git a/src/Microsoft.AspNet.Security.OpenIdConnect/OpenidConnectAuthenticationHandler.cs b/src/Microsoft.AspNet.Security.OpenIdConnect/OpenidConnectAuthenticationHandler.cs
index 96156f653..94fe21147 100644
--- a/src/Microsoft.AspNet.Security.OpenIdConnect/OpenidConnectAuthenticationHandler.cs
+++ b/src/Microsoft.AspNet.Security.OpenIdConnect/OpenidConnectAuthenticationHandler.cs
@@ -91,6 +91,7 @@ protected override async Task ApplyResponseGrantAsync()
{
ProtocolMessage = openIdConnectMessage
};
+
await Options.Notifications.RedirectToIdentityProvider(notification);
if (!notification.HandledResponse)
@@ -98,8 +99,9 @@ protected override async Task ApplyResponseGrantAsync()
string redirectUri = notification.ProtocolMessage.CreateLogoutRequestUrl();
if (!Uri.IsWellFormedUriString(redirectUri, UriKind.Absolute))
{
- _logger.WriteWarning("The logout redirect URI is malformed: " + redirectUri);
+ _logger.WriteWarning("The logout redirect URI is malformed: {0}", (redirectUri ?? "null"));
}
+
Response.Redirect(redirectUri);
}
}
@@ -116,7 +118,13 @@ protected override void ApplyResponseChallenge()
///
protected override async Task ApplyResponseChallengeAsync()
{
- if ((Response.StatusCode != 401) || (ChallengeContext == null))
+ if (Response.StatusCode != 401)
+ {
+ return;
+ }
+
+ // Active middleware should redirect on 401 even if there wasn't an explicit challenge.
+ if (ChallengeContext == null && Options.AuthenticationMode == AuthenticationMode.Passive)
{
return;
}
@@ -124,7 +132,16 @@ protected override async Task ApplyResponseChallengeAsync()
// order for redirect_uri
// 1. challenge.Properties.RedirectUri
// 2. CurrentUri
- AuthenticationProperties properties = new AuthenticationProperties(ChallengeContext.Properties);
+ AuthenticationProperties properties;
+ if (ChallengeContext == null)
+ {
+ properties = new AuthenticationProperties();
+ }
+ else
+ {
+ properties = new AuthenticationProperties(ChallengeContext.Properties);
+ }
+
if (string.IsNullOrEmpty(properties.RedirectUri))
{
properties.RedirectUri = CurrentUri;
@@ -154,7 +171,6 @@ protected override async Task ApplyResponseChallengeAsync()
State = OpenIdConnectAuthenticationDefaults.AuthenticationPropertiesKey + "=" + Uri.EscapeDataString(Options.StateDataFormat.Protect(properties))
};
- // TODO - brentschmaltz, if INonceCache is set should we even consider if ProtocolValidator is set?
if (Options.ProtocolValidator.RequireNonce)
{
openIdConnectMessage.Nonce = Options.ProtocolValidator.GenerateNonce();
@@ -179,7 +195,7 @@ protected override async Task ApplyResponseChallengeAsync()
string redirectUri = notification.ProtocolMessage.CreateAuthenticationRequestUrl();
if (!Uri.IsWellFormedUriString(redirectUri, UriKind.Absolute))
{
- _logger.WriteWarning("The authenticate redirect URI is malformed: " + redirectUri);
+ _logger.WriteWarning("Uri.IsWellFormedUriString(redirectUri, UriKind.Absolute) returned 'false', redirectUri is: {0}", (redirectUri ?? "null"));
}
Response.Redirect(redirectUri);
@@ -327,7 +343,7 @@ protected override async Task AuthenticateCoreAsync()
throw new InvalidOperationException("No SecurityTokenValidator found for token: " + openIdConnectMessage.IdToken);
}
- ticket = new AuthenticationTicket(principal, properties, Options.AuthenticationType);
+ ticket = new AuthenticationTicket(principal.Identity as ClaimsIdentity, properties);
if (!string.IsNullOrWhiteSpace(openIdConnectMessage.SessionState))
{
ticket.Properties.Dictionary[OpenIdConnectSessionProperties.SessionState] = openIdConnectMessage.SessionState;
diff --git a/src/Microsoft.AspNet.Security.OpenIdConnect/Resources.resx b/src/Microsoft.AspNet.Security.OpenIdConnect/Resources.resx
new file mode 100644
index 000000000..7abad90eb
--- /dev/null
+++ b/src/Microsoft.AspNet.Security.OpenIdConnect/Resources.resx
@@ -0,0 +1,132 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ text/microsoft-resx
+
+
+ 2.0
+
+
+ System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
+
+
+ System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
+
+
+ BackchannelTimeout cannot be less or equal to TimeSpan.Zero.
+
+
+ "OpenIdConnectMessage.Error was not null, indicating an error. Error: '{0}'. Error_Description (may be empty): '{1}'. Error_Uri (may be empty): '{2}'."
+
+
+ OIDC_20001: The query string for Logout is not a well formed URI. The runtime cannot redirect. Redirect uri: '{0}'.
+
+
+ An ICertificateValidator cannot be specified at the same time as an HttpMessageHandler unless it is a WebRequestHandler.
+
+
\ No newline at end of file
diff --git a/src/Microsoft.AspNet.Security/Infrastructure/AuthenticationHandler.cs b/src/Microsoft.AspNet.Security/Infrastructure/AuthenticationHandler.cs
index d7a0db8fc..fc847f4fa 100644
--- a/src/Microsoft.AspNet.Security/Infrastructure/AuthenticationHandler.cs
+++ b/src/Microsoft.AspNet.Security/Infrastructure/AuthenticationHandler.cs
@@ -77,9 +77,12 @@ protected async Task BaseInitializeAsync(AuthenticationOptions options, HttpCont
if (BaseOptions.AuthenticationMode == AuthenticationMode.Active)
{
AuthenticationTicket ticket = await AuthenticateAsync();
- if (ticket != null && ticket.Identity != null)
+ if (ticket != null)
{
- SecurityHelper.AddUserIdentity(Context, ticket.Identity);
+ if ( ticket.Identity != null)
+ SecurityHelper.AddUserIdentity(Context, ticket.Identity);
+ else if (ticket.Principal != null)
+ SecurityHelper.AddUserIdentity(Context, ticket.Principal.Identity);
}
}
}