From 74569d85b6249100c6ff9bd6203e869014b3bb31 Mon Sep 17 00:00:00 2001 From: kdeng00 Date: Fri, 16 Dec 2022 13:48:15 -0500 Subject: [PATCH 1/3] Deprecating asymmetric keys Starting work to deprecate using public and private keys to sign tokens --- Controllers/Managers/TokenManager.cs | 19 +++++++++---------- Controllers/v1/BaseController.cs | 4 +++- 2 files changed, 12 insertions(+), 11 deletions(-) diff --git a/Controllers/Managers/TokenManager.cs b/Controllers/Managers/TokenManager.cs index 56d89da..20cf02f 100644 --- a/Controllers/Managers/TokenManager.cs +++ b/Controllers/Managers/TokenManager.cs @@ -29,10 +29,10 @@ namespace Icarus.Controllers.Managers #region Fields private string _clientId; private string _clientSecret; - private string _privateKeyPath; - private string _privateKey; - private string _publicKeyPath; - private string _publicKey; + private string _privateKeyPath = string.Empty; + private string _privateKey = string.Empty; + private string _publicKeyPath = string.Empty; + private string _publicKey = string.Empty; private string _audience; private string _grantType; private string _url; @@ -88,6 +88,7 @@ namespace Icarus.Controllers.Managers } + [Obsolete("Asymmetric key signing for tokens have been deprecated")] public LoginResult LogIn(User user) { var tokenResult = new TokenTierOne(); @@ -152,6 +153,7 @@ namespace Icarus.Controllers.Managers }; } + [Obsolete("Asymmetric key signing for tokens have been deprecated")] public bool IsTokenValid(string scope, string accessToken) { var result = false; @@ -172,6 +174,7 @@ namespace Icarus.Controllers.Managers return result; } + [Obsolete("Asymmetric key signing for tokens have been deprecated")] public Token DecodeToken(string accessToken) { var rsaParams = GetRSAPublic(_publicKey); @@ -264,6 +267,7 @@ namespace Icarus.Controllers.Managers return claim; } + [Obsolete("Asymmetric key signing for tokens have been deprecated")] private string CreateToken(List claims, string privateKey) { var token = string.Empty; @@ -323,6 +327,7 @@ namespace Icarus.Controllers.Managers return token; } + [Obsolete("Asymmetric key signing for tokens have been deprecated")] private RSAParameters GetRSAPublic(string publicKey) { using (var tr = new System.IO.StringReader(publicKey)) @@ -362,12 +367,6 @@ namespace Icarus.Controllers.Managers _audience = _config["Auth0:ApiIdentifier"]; _grantType = "client_credentials"; _url = $"https://{_config["Auth0:Domain"]}"; - _privateKeyPath = _config["RSAKeys:PrivateKeyPath"]; - _publicKeyPath = _config["RSAKeys:PublicKeyPath"]; - _privateKey = System.IO.File.ReadAllText(_privateKeyPath); - _publicKey = System.IO.File.ReadAllText(_publicKeyPath); - - PrintCredentials(); } #region Testing Methods diff --git a/Controllers/v1/BaseController.cs b/Controllers/v1/BaseController.cs index 9cec68a..4e3d40a 100644 --- a/Controllers/v1/BaseController.cs +++ b/Controllers/v1/BaseController.cs @@ -18,6 +18,7 @@ namespace Icarus.Controllers.V1 #region Methods [ApiExplorerSettings(IgnoreApi = true)] + [Obsolete("Asymmetric key signing for tokens have been deprecated")] protected string ParseBearerTokenFromHeader() { var token = string.Empty; @@ -39,6 +40,7 @@ namespace Icarus.Controllers.V1 } [ApiExplorerSettings(IgnoreApi = true)] + [Obsolete("Asymmetric key signing for tokens have been deprecated")] protected bool IsTokenValid(string scope) { var token = ParseBearerTokenFromHeader(); @@ -48,4 +50,4 @@ namespace Icarus.Controllers.V1 } #endregion } -} \ No newline at end of file +} From 712a0a9a4aceea51f8819abb2c90936381088e6d Mon Sep 17 00:00:00 2001 From: kdeng00 Date: Fri, 16 Dec 2022 13:54:18 -0500 Subject: [PATCH 2/3] Updated config file --- appsettings.Development.json | 4 ---- appsettings.json | 4 ---- 2 files changed, 8 deletions(-) diff --git a/appsettings.Development.json b/appsettings.Development.json index c8ed0de..f3c53f4 100644 --- a/appsettings.Development.json +++ b/appsettings.Development.json @@ -12,10 +12,6 @@ "ClientId": "", "ClientSecret": "" }, - "RSAKeys": { - "PrivateKeyPath": "", - "PublicKeyPath": "" - }, "JWT": { "Issuer": "", "Audience": "", diff --git a/appsettings.json b/appsettings.json index 71f2123..fd85caf 100644 --- a/appsettings.json +++ b/appsettings.json @@ -12,10 +12,6 @@ "ClientId": "", "ClientSecret": "" }, - "RSAKeys": { - "PrivateKeyPath": "", - "PublicKeyPath": "" - }, "JWT": { "Issuer": "", "Audience": "", From 522be59973649ed8537080ba25d0f69709f37b81 Mon Sep 17 00:00:00 2001 From: kdeng00 Date: Fri, 16 Dec 2022 13:56:56 -0500 Subject: [PATCH 3/3] Removing deprecated call Removing method call that has been deprecated from one of the Controller classes --- Controllers/v1/ArtistController.cs | 5 ----- 1 file changed, 5 deletions(-) diff --git a/Controllers/v1/ArtistController.cs b/Controllers/v1/ArtistController.cs index 219e6c5..413228a 100644 --- a/Controllers/v1/ArtistController.cs +++ b/Controllers/v1/ArtistController.cs @@ -53,11 +53,6 @@ namespace Icarus.Controllers.V1 [HttpGet("{id}")] public IActionResult GetArtist(int id) { - if (!IsTokenValid("read:artists")) - { - return StatusCode(401, "Not allowed"); - } - Artist artist = new Artist { ArtistID = id