kdeng00
409 lines
13 KiB
C#
409 lines
13 KiB
C#
using System;
|
|
using System.Collections.Generic;
|
|
using System.Linq;
|
|
using System.Security.Claims;
|
|
using System.Security.Cryptography;
|
|
using System.Threading.Tasks;
|
|
using System.IdentityModel.Tokens.Jwt;
|
|
using System.Text;
|
|
|
|
using JWT;
|
|
using JWT.Serializers;
|
|
using Microsoft.Extensions.Configuration;
|
|
using Microsoft.IdentityModel.Tokens;
|
|
using Newtonsoft.Json;
|
|
using Org.BouncyCastle.Crypto;
|
|
using Org.BouncyCastle.Crypto.Parameters;
|
|
using Org.BouncyCastle.OpenSsl;
|
|
using Org.BouncyCastle.Security;
|
|
using RestSharp;
|
|
|
|
using Icarus.Models;
|
|
|
|
namespace Icarus.Controllers.Managers;
|
|
|
|
#region Classes
|
|
public class TokenManager : BaseManager
|
|
{
|
|
#region Fields
|
|
private string _clientId;
|
|
private string _clientSecret;
|
|
private string _privateKeyPath = string.Empty;
|
|
private string _privateKey = string.Empty;
|
|
private string _publicKeyPath = string.Empty;
|
|
private string _publicKey = string.Empty;
|
|
private string _audience;
|
|
private string _grantType;
|
|
private string _url;
|
|
#endregion
|
|
|
|
|
|
#region Properties
|
|
#endregion
|
|
|
|
|
|
#region Constructors
|
|
public TokenManager(IConfiguration config)
|
|
{
|
|
_config = config;
|
|
InitializeValues();
|
|
}
|
|
#endregion
|
|
|
|
|
|
#region Methods
|
|
public LoginResult RetrieveLoginResult(User user)
|
|
{
|
|
_logger.Info("Preparing Auth0 API request");
|
|
|
|
var client = new RestClient(_url);
|
|
var request = new RestRequest("oauth/token", Method.POST);
|
|
var tokenRequest = RetrieveTokenRequest();
|
|
|
|
_logger.Info("Serializing token object into JSON");
|
|
var tokenObject = JsonConvert.SerializeObject(tokenRequest);
|
|
|
|
request.AddParameter("application/json; charset=utf-8",
|
|
tokenObject, ParameterType.RequestBody);
|
|
|
|
request.RequestFormat = DataFormat.Json;
|
|
|
|
_logger.Info("Sending request");
|
|
IRestResponse response = client.Execute(request);
|
|
_logger.Info("Response received");
|
|
|
|
|
|
_logger.Info("Deserializing response");
|
|
var tokenResult = JsonConvert
|
|
.DeserializeObject<TokenTierOne>(response.Content);
|
|
_logger.Info("Response deserialized");
|
|
|
|
return new LoginResult
|
|
{
|
|
UserID = user.UserID, Username = user.Username, Token = tokenResult.AccessToken,
|
|
TokenType = tokenResult.TokenType, Expiration = tokenResult.Expiration,
|
|
Message = "Successfully retrieved token"
|
|
};
|
|
}
|
|
|
|
|
|
[Obsolete("Asymmetric key signing for tokens have been deprecated")]
|
|
public LoginResult LogIn(User user)
|
|
{
|
|
var tokenResult = new TokenTierOne();
|
|
tokenResult.TokenType = "Jwt";
|
|
|
|
var privateKey = ReadKeyContent(_privateKeyPath).Result;
|
|
var publicKey = ReadKeyContent(_publicKeyPath).Result;
|
|
|
|
var payload = Payload();
|
|
|
|
var token = CreateToken(payload, privateKey);
|
|
tokenResult.AccessToken = token;
|
|
|
|
var expClaim = payload.FirstOrDefault(cl =>
|
|
{
|
|
return cl.Type.Equals("exp");
|
|
});
|
|
|
|
tokenResult.Expiration = System.Convert.ToInt32(expClaim.Value);
|
|
|
|
return new LoginResult
|
|
{
|
|
UserID = user.UserID, Username = user.Username, Token = tokenResult.AccessToken,
|
|
TokenType = tokenResult.TokenType, Expiration = tokenResult.Expiration,
|
|
Message = "Successfully retrieved token"
|
|
};
|
|
}
|
|
|
|
public LoginResult LoginSymmetric(User user)
|
|
{
|
|
var tokenResult = new TokenTierOne();
|
|
tokenResult.TokenType = "Jwt";
|
|
|
|
var payload = Payload();
|
|
payload.Add(new System.Security.Claims.Claim("user_id", user.UserID.ToString(), ClaimValueTypes.Integer));
|
|
|
|
var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(_config["JWT:Secret"]));
|
|
var signIn = new SigningCredentials(key, SecurityAlgorithms.HmacSha256);
|
|
var token = new JwtSecurityToken(
|
|
_config["JWT:Issuer"],
|
|
_config["JWT:Audience"],
|
|
payload,
|
|
expires: DateTime.UtcNow.AddMinutes(30),
|
|
signingCredentials: signIn);
|
|
|
|
tokenResult.AccessToken = new JwtSecurityTokenHandler().WriteToken(token);
|
|
|
|
var expClaim = payload.FirstOrDefault(cl =>
|
|
{
|
|
return cl.Type.Equals("exp");
|
|
});
|
|
|
|
var expiredDate = DateTime.Parse(expClaim.Value);
|
|
var exp = Math.Floor((expiredDate - DateTime.UnixEpoch).TotalSeconds);
|
|
tokenResult.Expiration = Convert.ToInt32(exp);
|
|
|
|
return new LoginResult
|
|
{
|
|
UserID = user.UserID, Username = user.Username, Token = tokenResult.AccessToken,
|
|
TokenType = tokenResult.TokenType, Expiration = tokenResult.Expiration,
|
|
Message = "Successfully retrieved token"
|
|
};
|
|
}
|
|
|
|
[Obsolete("Asymmetric key signing for tokens have been deprecated")]
|
|
public bool IsTokenValid(string scope, string accessToken)
|
|
{
|
|
var result = false;
|
|
var token = DecodeToken(accessToken);
|
|
|
|
if (token == null || token.Erroneous())
|
|
{
|
|
return result;
|
|
}
|
|
|
|
result = (!token.TokenExpired() && token.ContainsScope(scope)) ? true : false;
|
|
|
|
// What would make a token valid?
|
|
// 1. The expiration date must be before the current date
|
|
// 2. The desired scope must be part of the scopes within the access token
|
|
// 3. Must be able to be decoded
|
|
|
|
return result;
|
|
}
|
|
|
|
[Obsolete("Asymmetric key signing for tokens have been deprecated")]
|
|
public Token DecodeToken(string accessToken)
|
|
{
|
|
var rsaParams = GetRSAPublic(_publicKey);
|
|
Token tok = null;
|
|
|
|
try
|
|
{
|
|
using (var rsa = new RSACryptoServiceProvider())
|
|
{
|
|
rsa.ImportParameters(rsaParams);
|
|
|
|
IJsonSerializer serializer = new JsonNetSerializer();
|
|
IDateTimeProvider provider = new UtcDateTimeProvider();
|
|
IJwtValidator validator = new JwtValidator(serializer, provider);
|
|
IBase64UrlEncoder urlEncoder = new JwtBase64UrlEncoder();
|
|
var algorithm = new JWT.Algorithms.RS256Algorithm(rsa);
|
|
IJwtDecoder decoder = new JwtDecoder(serializer, validator, urlEncoder, algorithm);
|
|
|
|
var json = decoder.Decode(accessToken);
|
|
tok = JsonConvert.DeserializeObject<Token>(json);
|
|
}
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
_logger.Error("An error occurred: {0}", ex.Message);
|
|
}
|
|
|
|
|
|
return tok;
|
|
}
|
|
|
|
|
|
private string AllScopes()
|
|
{
|
|
var allScopes = new List<String>()
|
|
{
|
|
"download:songs",
|
|
"read:song_details",
|
|
"upload:songs",
|
|
"delete:songs",
|
|
"read:albums",
|
|
"read:artists",
|
|
"update:songs",
|
|
"stream:songs",
|
|
"read:genre",
|
|
"read:year",
|
|
"download:cover_art"
|
|
};
|
|
|
|
var scopes = string.Empty;
|
|
|
|
for (var i = 0; i < allScopes.Count; i++)
|
|
{
|
|
if (i == allScopes.Count - 1)
|
|
{
|
|
scopes += allScopes[i];
|
|
}
|
|
else
|
|
{
|
|
scopes += allScopes[i] + " ";
|
|
}
|
|
}
|
|
|
|
return scopes;
|
|
}
|
|
|
|
private List<Claim> Payload()
|
|
{
|
|
var expLimit = 30;
|
|
var currentDate = DateTime.Now;
|
|
var expiredDate = currentDate.AddMinutes(expLimit);
|
|
var issued = Math.Floor((currentDate - DateTime.UnixEpoch).TotalSeconds);
|
|
var expires = Math.Floor((expiredDate - DateTime.UnixEpoch).TotalSeconds);
|
|
var issuer = "https://soaricarus.auth0.com";
|
|
issuer = "http://localhost:5002";
|
|
var audience = "https://icarus/api";
|
|
audience = "http://localhost:5002";
|
|
var subject = _config["JWT:Subject"];
|
|
|
|
var claim = new List<System.Security.Claims.Claim>()
|
|
{
|
|
new System.Security.Claims.Claim("scope", AllScopes(), "string"),
|
|
new System.Security.Claims.Claim(JwtRegisteredClaimNames.Exp, expiredDate.ToString()),
|
|
new System.Security.Claims.Claim(JwtRegisteredClaimNames.Aud, audience),
|
|
new System.Security.Claims.Claim(JwtRegisteredClaimNames.Iss, issuer),
|
|
new Claim(JwtRegisteredClaimNames.Sub, subject),
|
|
new System.Security.Claims.Claim(JwtRegisteredClaimNames.Iat, currentDate.ToString())
|
|
};
|
|
|
|
return claim;
|
|
}
|
|
|
|
[Obsolete("Asymmetric key signing for tokens have been deprecated")]
|
|
private string CreateToken(List<Claim> claims, string privateKey)
|
|
{
|
|
var token = string.Empty;
|
|
|
|
if (string.IsNullOrEmpty(privateKey))
|
|
{
|
|
privateKey = ReadKeyContent(_privateKeyPath).Result;
|
|
}
|
|
|
|
RSAParameters rsaParams;
|
|
using (var tr = new System.IO.StringReader(privateKey))
|
|
{
|
|
var pemReader = new PemReader(tr);
|
|
var keyPair = pemReader.ReadObject() as AsymmetricCipherKeyPair;
|
|
if (keyPair == null)
|
|
{
|
|
throw new Exception("Could not read RSA private key");
|
|
}
|
|
var privateRsaParams = keyPair.Private as RsaPrivateCrtKeyParameters;
|
|
rsaParams = DotNetUtilities.ToRSAParameters(privateRsaParams);
|
|
}
|
|
|
|
using (RSACryptoServiceProvider rsa = new RSACryptoServiceProvider())
|
|
{
|
|
var rsaParamsPublic = GetRSAPublic(ReadKeyContent(_publicKeyPath).Result);
|
|
var rsaPublic = new RSACryptoServiceProvider();
|
|
|
|
rsa.ImportParameters(rsaParams);
|
|
rsaPublic.ImportParameters(rsaParamsPublic);
|
|
|
|
Dictionary<string, object> payload = new Dictionary<string, object>();
|
|
|
|
foreach (var claim in claims)
|
|
{
|
|
var type = claim.Type;
|
|
var val = Int32.TryParse(claim.Value, out _);
|
|
|
|
if (val)
|
|
{
|
|
payload.Add(type, Convert.ToInt32(claim.Value));
|
|
}
|
|
else
|
|
{
|
|
payload.Add(type, claim.Value);
|
|
}
|
|
|
|
}
|
|
|
|
var algorithm = new JWT.Algorithms.RS256Algorithm(rsaPublic, rsa);
|
|
IJsonSerializer serializer = new JsonNetSerializer();
|
|
IBase64UrlEncoder urlEncoder = new JwtBase64UrlEncoder();
|
|
IJwtEncoder encoder = new JwtEncoder(algorithm, serializer, urlEncoder);
|
|
|
|
token = encoder.Encode(payload, privateKey);
|
|
}
|
|
|
|
return token;
|
|
}
|
|
|
|
[Obsolete("Asymmetric key signing for tokens have been deprecated")]
|
|
private RSAParameters GetRSAPublic(string publicKey)
|
|
{
|
|
using (var tr = new System.IO.StringReader(publicKey))
|
|
{
|
|
var pemReader = new PemReader(tr);
|
|
var publicKeyParams = pemReader.ReadObject() as RsaKeyParameters;
|
|
if (publicKeyParams == null)
|
|
{
|
|
throw new Exception("Could not read RSA public key");
|
|
}
|
|
return DotNetUtilities.ToRSAParameters(publicKeyParams);
|
|
}
|
|
}
|
|
|
|
private async Task<string> ReadKeyContent(string filepath)
|
|
{
|
|
return await System.IO.File.ReadAllTextAsync(filepath);
|
|
}
|
|
|
|
private TokenRequest RetrieveTokenRequest()
|
|
{
|
|
_logger.Info("Retrieving token object");
|
|
|
|
return new TokenRequest
|
|
{
|
|
ClientId = _clientId, ClientSecret = _clientSecret,
|
|
Audience = _audience, GrantType = _grantType
|
|
};
|
|
}
|
|
|
|
private void InitializeValues()
|
|
{
|
|
_logger.Info("Analyzing Auth0 information");
|
|
|
|
_clientId = _config["Auth0:ClientId"];
|
|
_clientSecret = _config["Auth0:ClientSecret"];
|
|
_audience = _config["Auth0:ApiIdentifier"];
|
|
_grantType = "client_credentials";
|
|
_url = $"https://{_config["Auth0:Domain"]}";
|
|
}
|
|
|
|
#region Testing Methods
|
|
// For testing purposes
|
|
private void PrintCredentials()
|
|
{
|
|
Console.WriteLine("Auth0 credentials:");
|
|
Console.WriteLine($"Client Id: {_clientId}");
|
|
Console.WriteLine($"Client Secret: {_clientSecret}");
|
|
Console.WriteLine($"Audience: {_audience}");
|
|
Console.WriteLine($"Url: {_url}");
|
|
}
|
|
#endregion
|
|
#endregion
|
|
|
|
|
|
#region Classes
|
|
private class TokenRequest
|
|
{
|
|
[JsonProperty("client_id")]
|
|
public string ClientId { get; set; }
|
|
[JsonProperty("client_secret")]
|
|
public string ClientSecret { get; set; }
|
|
[JsonProperty("audience")]
|
|
public string Audience { get; set; }
|
|
[JsonProperty("grant_type")]
|
|
public string GrantType { get; set; }
|
|
}
|
|
private class TokenTierOne
|
|
{
|
|
[JsonProperty("access_token")]
|
|
public string AccessToken { get; set; }
|
|
[JsonProperty("expires_in")]
|
|
public int Expiration { get; set; }
|
|
[JsonProperty("token_type")]
|
|
public string TokenType { get; set; }
|
|
}
|
|
#endregion
|
|
}
|
|
#endregion
|