From e5518e6fc25874920e203dfcd923868ad5de6cbb Mon Sep 17 00:00:00 2001 From: BrentSchmaltz Date: Tue, 27 Jan 2015 08:15:28 -0800 Subject: [PATCH 1/3] ChallengeContext will be null with [Authorize] attribute OpenIdConnect set Ticket.Principal, get identity from there. --- .../OpenidConnectAuthenticationHandler.cs | 24 +++++++++++++++---- .../Infrastructure/AuthenticationHandler.cs | 7 ++++-- 2 files changed, 25 insertions(+), 6 deletions(-) diff --git a/src/Microsoft.AspNet.Security.OpenIdConnect/OpenidConnectAuthenticationHandler.cs b/src/Microsoft.AspNet.Security.OpenIdConnect/OpenidConnectAuthenticationHandler.cs index 96156f653..b237b6be9 100644 --- a/src/Microsoft.AspNet.Security.OpenIdConnect/OpenidConnectAuthenticationHandler.cs +++ b/src/Microsoft.AspNet.Security.OpenIdConnect/OpenidConnectAuthenticationHandler.cs @@ -91,6 +91,7 @@ protected override async Task ApplyResponseGrantAsync() { ProtocolMessage = openIdConnectMessage }; + await Options.Notifications.RedirectToIdentityProvider(notification); if (!notification.HandledResponse) @@ -100,6 +101,7 @@ protected override async Task ApplyResponseGrantAsync() { _logger.WriteWarning("The logout redirect URI is malformed: " + redirectUri); } + Response.Redirect(redirectUri); } } @@ -116,7 +118,13 @@ protected override void ApplyResponseChallenge() /// protected override async Task ApplyResponseChallengeAsync() { - if ((Response.StatusCode != 401) || (ChallengeContext == null)) + if (Response.StatusCode != 401) + { + return; + } + + // Active middleware should redirect on 401 even if there wasn't an explicit challenge. + if (ChallengeContext == null && Options.AuthenticationMode == AuthenticationMode.Passive) { return; } @@ -124,7 +132,16 @@ protected override async Task ApplyResponseChallengeAsync() // order for redirect_uri // 1. challenge.Properties.RedirectUri // 2. CurrentUri - AuthenticationProperties properties = new AuthenticationProperties(ChallengeContext.Properties); + AuthenticationProperties properties; + if (ChallengeContext == null) + { + properties = new AuthenticationProperties(); + } + else + { + properties = new AuthenticationProperties(ChallengeContext.Properties); + } + if (string.IsNullOrEmpty(properties.RedirectUri)) { properties.RedirectUri = CurrentUri; @@ -154,7 +171,6 @@ protected override async Task ApplyResponseChallengeAsync() State = OpenIdConnectAuthenticationDefaults.AuthenticationPropertiesKey + "=" + Uri.EscapeDataString(Options.StateDataFormat.Protect(properties)) }; - // TODO - brentschmaltz, if INonceCache is set should we even consider if ProtocolValidator is set? if (Options.ProtocolValidator.RequireNonce) { openIdConnectMessage.Nonce = Options.ProtocolValidator.GenerateNonce(); @@ -179,7 +195,7 @@ protected override async Task ApplyResponseChallengeAsync() string redirectUri = notification.ProtocolMessage.CreateAuthenticationRequestUrl(); if (!Uri.IsWellFormedUriString(redirectUri, UriKind.Absolute)) { - _logger.WriteWarning("The authenticate redirect URI is malformed: " + redirectUri); + _logger.WriteWarning("Uri.IsWellFormedUriString(redirectUri, UriKind.Absolute) returned 'false', redirectUri is: " + (redirectUri ?? "null")); } Response.Redirect(redirectUri); diff --git a/src/Microsoft.AspNet.Security/Infrastructure/AuthenticationHandler.cs b/src/Microsoft.AspNet.Security/Infrastructure/AuthenticationHandler.cs index d7a0db8fc..fc847f4fa 100644 --- a/src/Microsoft.AspNet.Security/Infrastructure/AuthenticationHandler.cs +++ b/src/Microsoft.AspNet.Security/Infrastructure/AuthenticationHandler.cs @@ -77,9 +77,12 @@ protected async Task BaseInitializeAsync(AuthenticationOptions options, HttpCont if (BaseOptions.AuthenticationMode == AuthenticationMode.Active) { AuthenticationTicket ticket = await AuthenticateAsync(); - if (ticket != null && ticket.Identity != null) + if (ticket != null) { - SecurityHelper.AddUserIdentity(Context, ticket.Identity); + if ( ticket.Identity != null) + SecurityHelper.AddUserIdentity(Context, ticket.Identity); + else if (ticket.Principal != null) + SecurityHelper.AddUserIdentity(Context, ticket.Principal.Identity); } } } From e04358f7f92f709cfb235ab48967d38e4c6b4535 Mon Sep 17 00:00:00 2001 From: BrentSchmaltz Date: Tue, 27 Jan 2015 09:58:47 -0800 Subject: [PATCH 2/3] Missing resource file. --- .../Resources.resx | 132 ++++++++++++++++++ 1 file changed, 132 insertions(+) create mode 100644 src/Microsoft.AspNet.Security.OpenIdConnect/Resources.resx diff --git a/src/Microsoft.AspNet.Security.OpenIdConnect/Resources.resx b/src/Microsoft.AspNet.Security.OpenIdConnect/Resources.resx new file mode 100644 index 000000000..7abad90eb --- /dev/null +++ b/src/Microsoft.AspNet.Security.OpenIdConnect/Resources.resx @@ -0,0 +1,132 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + text/microsoft-resx + + + 2.0 + + + System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 + + + System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 + + + BackchannelTimeout cannot be less or equal to TimeSpan.Zero. + + + "OpenIdConnectMessage.Error was not null, indicating an error. Error: '{0}'. Error_Description (may be empty): '{1}'. Error_Uri (may be empty): '{2}'." + + + OIDC_20001: The query string for Logout is not a well formed URI. The runtime cannot redirect. Redirect uri: '{0}'. + + + An ICertificateValidator cannot be specified at the same time as an HttpMessageHandler unless it is a WebRequestHandler. + + \ No newline at end of file From 3483842ab76d4198fc230c7a1905b0ada9b4bf89 Mon Sep 17 00:00:00 2001 From: BrentSchmaltz Date: Wed, 28 Jan 2015 10:27:55 -0800 Subject: [PATCH 3/3] Rollback of setting Principal on AuthenticationTicket. adjust formating of messages. --- .../OpenidConnectAuthenticationHandler.cs | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/Microsoft.AspNet.Security.OpenIdConnect/OpenidConnectAuthenticationHandler.cs b/src/Microsoft.AspNet.Security.OpenIdConnect/OpenidConnectAuthenticationHandler.cs index b237b6be9..94fe21147 100644 --- a/src/Microsoft.AspNet.Security.OpenIdConnect/OpenidConnectAuthenticationHandler.cs +++ b/src/Microsoft.AspNet.Security.OpenIdConnect/OpenidConnectAuthenticationHandler.cs @@ -99,7 +99,7 @@ protected override async Task ApplyResponseGrantAsync() string redirectUri = notification.ProtocolMessage.CreateLogoutRequestUrl(); if (!Uri.IsWellFormedUriString(redirectUri, UriKind.Absolute)) { - _logger.WriteWarning("The logout redirect URI is malformed: " + redirectUri); + _logger.WriteWarning("The logout redirect URI is malformed: {0}", (redirectUri ?? "null")); } Response.Redirect(redirectUri); @@ -195,7 +195,7 @@ protected override async Task ApplyResponseChallengeAsync() string redirectUri = notification.ProtocolMessage.CreateAuthenticationRequestUrl(); if (!Uri.IsWellFormedUriString(redirectUri, UriKind.Absolute)) { - _logger.WriteWarning("Uri.IsWellFormedUriString(redirectUri, UriKind.Absolute) returned 'false', redirectUri is: " + (redirectUri ?? "null")); + _logger.WriteWarning("Uri.IsWellFormedUriString(redirectUri, UriKind.Absolute) returned 'false', redirectUri is: {0}", (redirectUri ?? "null")); } Response.Redirect(redirectUri); @@ -343,7 +343,7 @@ protected override async Task AuthenticateCoreAsync() throw new InvalidOperationException("No SecurityTokenValidator found for token: " + openIdConnectMessage.IdToken); } - ticket = new AuthenticationTicket(principal, properties, Options.AuthenticationType); + ticket = new AuthenticationTicket(principal.Identity as ClaimsIdentity, properties); if (!string.IsNullOrWhiteSpace(openIdConnectMessage.SessionState)) { ticket.Properties.Dictionary[OpenIdConnectSessionProperties.SessionState] = openIdConnectMessage.SessionState;