Skip to content

Commit 2c1734e

Browse files
TratcherTratcher
committed
#7 IdentityModel dependency update for OpenIdConnect
1 parent 6ee9653 commit 2c1734e

11 files changed

+113
-77
lines changed

‎src/Microsoft.Owin.Security.OpenIdConnect/Microsoft.Owin.Security.OpenIdConnect.csproj

Lines changed: 22 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -39,18 +39,34 @@
3939
<CodeAnalysisRuleSet>..\..\build\CodeAnalysis.ruleset</CodeAnalysisRuleSet>
4040
</PropertyGroup>
4141
<ItemGroup>
42-
<Reference Include="Microsoft.IdentityModel.Protocol.Extensions, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL">
43-
<SpecificVersion>False</SpecificVersion>
44-
<HintPath>..\..\packages\Microsoft.IdentityModel.Protocol.Extensions.1.0.0\lib\net45\Microsoft.IdentityModel.Protocol.Extensions.dll</HintPath>
42+
<Reference Include="Microsoft.IdentityModel.Logging, Version=1.1.2.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL">
43+
<HintPath>..\..\packages\Microsoft.IdentityModel.Logging.1.1.2\lib\net451\Microsoft.IdentityModel.Logging.dll</HintPath>
44+
<Private>True</Private>
45+
</Reference>
46+
<Reference Include="Microsoft.IdentityModel.Protocols, Version=2.1.2.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL">
47+
<HintPath>..\..\packages\Microsoft.IdentityModel.Protocols.2.1.2\lib\net451\Microsoft.IdentityModel.Protocols.dll</HintPath>
48+
<Private>True</Private>
49+
</Reference>
50+
<Reference Include="Microsoft.IdentityModel.Protocols.OpenIdConnect, Version=2.1.2.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL">
51+
<HintPath>..\..\packages\Microsoft.IdentityModel.Protocols.OpenIdConnect.2.1.2\lib\net451\Microsoft.IdentityModel.Protocols.OpenIdConnect.dll</HintPath>
52+
<Private>True</Private>
53+
</Reference>
54+
<Reference Include="Microsoft.IdentityModel.Tokens, Version=5.1.2.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL">
55+
<HintPath>..\..\packages\Microsoft.IdentityModel.Tokens.5.1.2\lib\net451\Microsoft.IdentityModel.Tokens.dll</HintPath>
56+
<Private>True</Private>
57+
</Reference>
58+
<Reference Include="Newtonsoft.Json, Version=9.0.0.0, Culture=neutral, PublicKeyToken=30ad4fe6b2a6aeed, processorArchitecture=MSIL">
59+
<HintPath>..\..\packages\Newtonsoft.Json.9.0.1\lib\net45\Newtonsoft.Json.dll</HintPath>
60+
<Private>True</Private>
4561
</Reference>
4662
<Reference Include="Owin">
4763
<HintPath>..\..\packages\Owin.1.0\lib\net40\Owin.dll</HintPath>
4864
</Reference>
4965
<Reference Include="System" />
5066
<Reference Include="System.IdentityModel" />
51-
<Reference Include="System.IdentityModel.Tokens.Jwt, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL">
52-
<SpecificVersion>False</SpecificVersion>
53-
<HintPath>..\..\packages\System.IdentityModel.Tokens.Jwt.4.0.0\lib\net45\System.IdentityModel.Tokens.Jwt.dll</HintPath>
67+
<Reference Include="System.IdentityModel.Tokens.Jwt, Version=5.1.2.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL">
68+
<HintPath>..\..\packages\System.IdentityModel.Tokens.Jwt.5.1.2\lib\net451\System.IdentityModel.Tokens.Jwt.dll</HintPath>
69+
<Private>True</Private>
5470
</Reference>
5571
<Reference Include="System.Net.Http" />
5672
<Reference Include="System.Net.Http.WebRequest" />

‎src/Microsoft.Owin.Security.OpenIdConnect/Microsoft.Owin.Security.OpenIdConnect.nuspec

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,8 +21,11 @@
2121
<dependency id="Owin" version="1.0" />
2222
<dependency id="Microsoft.Owin" version="$version$" />
2323
<dependency id="Microsoft.Owin.Security" version="$version$" />
24-
<dependency id="System.IdentityModel.Tokens.Jwt" version="4.0.0$azureAdJwtSuffix$" />
25-
<dependency id="Microsoft.IdentityModel.Protocol.Extensions" version="1.0.0$azureAdExtSuffix$" />
24+
<dependency id="System.IdentityModel.Tokens.Jwt" version="5.1.2$azureAdJwtSuffix$" />
25+
<dependency id="Microsoft.IdentityModel.Logging" version="1.1.2$azureAdJwtSuffix$" />
26+
<dependency id="Microsoft.IdentityModel.Protocols" version="2.1.2$azureAdJwtSuffix$" />
27+
<dependency id="Microsoft.IdentityModel.Protocols.OpenIdConnect" version="2.1.2$azureAdJwtSuffix$" />
28+
<dependency id="Microsoft.IdentityModel.Tokens" version="5.1.2$azureAdJwtSuffix$" />
2629
</dependencies>
2730
</metadata>
2831
<files>

‎src/Microsoft.Owin.Security.OpenIdConnect/Notifications/AuthorizationCodeReceivedNotification.cs

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,8 @@
22
// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
33

44
using System.Diagnostics.CodeAnalysis;
5-
using System.IdentityModel.Tokens;
6-
using System.Security.Claims;
7-
using Microsoft.IdentityModel.Protocols;
5+
using System.IdentityModel.Tokens.Jwt;
6+
using Microsoft.IdentityModel.Protocols.OpenIdConnect;
87
using Microsoft.Owin.Security.OpenIdConnect;
98

109
namespace Microsoft.Owin.Security.Notifications

‎src/Microsoft.Owin.Security.OpenIdConnect/OpenIdConnectAuthenticationMiddleware.cs

Lines changed: 20 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,8 @@
44
using System;
55
using System.Diagnostics.CodeAnalysis;
66
using System.Net.Http;
7-
using Microsoft.IdentityModel.Extensions;
87
using Microsoft.IdentityModel.Protocols;
8+
using Microsoft.IdentityModel.Protocols.OpenIdConnect;
99
using Microsoft.Owin.Logging;
1010
using Microsoft.Owin.Security.DataHandler;
1111
using Microsoft.Owin.Security.DataProtection;
@@ -45,11 +45,6 @@ public OpenIdConnectAuthenticationMiddleware(OwinMiddleware next, IAppBuilder ap
4545
Options.AuthenticationType, "v1");
4646
Options.StateDataFormat = new PropertiesDataFormat(dataProtector);
4747
}
48-
49-
if (Options.SecurityTokenHandlers == null)
50-
{
51-
Options.SecurityTokenHandlers = SecurityTokenHandlerCollectionExtensions.GetDefaultHandlers();
52-
}
5348

5449
// if the user has not set the AuthorizeCallback, set it from the redirect_uri
5550
if (!Options.CallbackPath.HasValue)
@@ -78,9 +73,9 @@ public OpenIdConnectAuthenticationMiddleware(OwinMiddleware next, IAppBuilder ap
7873
{
7974
Options.ConfigurationManager = new StaticConfigurationManager<OpenIdConnectConfiguration>(Options.Configuration);
8075
}
81-
else
76+
else if (!(string.IsNullOrEmpty(Options.MetadataAddress) && string.IsNullOrEmpty(Options.Authority)))
8277
{
83-
if (string.IsNullOrWhiteSpace(Options.MetadataAddress) && !string.IsNullOrWhiteSpace(Options.Authority))
78+
if (string.IsNullOrEmpty(Options.MetadataAddress) && !string.IsNullOrEmpty(Options.Authority))
8479
{
8580
Options.MetadataAddress = Options.Authority;
8681
if (!Options.MetadataAddress.EndsWith("/", StringComparison.Ordinal))
@@ -91,12 +86,25 @@ public OpenIdConnectAuthenticationMiddleware(OwinMiddleware next, IAppBuilder ap
9186
Options.MetadataAddress += ".well-known/openid-configuration";
9287
}
9388

94-
HttpClient httpClient = new HttpClient(ResolveHttpMessageHandler(Options));
95-
httpClient.Timeout = Options.BackchannelTimeout;
96-
httpClient.MaxResponseContentBufferSize = 1024 * 1024 * 10; // 10 MB
97-
Options.ConfigurationManager = new ConfigurationManager<OpenIdConnectConfiguration>(Options.MetadataAddress, httpClient);
89+
if (Options.RequireHttpsMetadata && !Options.MetadataAddress.StartsWith("https://", StringComparison.OrdinalIgnoreCase))
90+
{
91+
throw new InvalidOperationException("The MetadataAddress or Authority must use HTTPS unless disabled for development by setting RequireHttpsMetadata=false.");
92+
}
93+
94+
var backchannel = new HttpClient(ResolveHttpMessageHandler(Options));
95+
backchannel.DefaultRequestHeaders.UserAgent.ParseAdd("Microsoft ASP.NET Core OpenIdConnect middleware");
96+
backchannel.Timeout = Options.BackchannelTimeout;
97+
backchannel.MaxResponseContentBufferSize = 1024 * 1024 * 10; // 10 MB
98+
99+
Options.ConfigurationManager = new ConfigurationManager<OpenIdConnectConfiguration>(Options.MetadataAddress, new OpenIdConnectConfigurationRetriever(),
100+
new HttpDocumentRetriever(backchannel) { RequireHttps = Options.RequireHttpsMetadata });
98101
}
99102
}
103+
104+
if (Options.ConfigurationManager == null)
105+
{
106+
throw new InvalidOperationException(string.Format("Provide Authority, MetadataAddress, Configuration, or ConfigurationManager to OpenIdConnectAuthenticationOptions"));
107+
}
100108
}
101109

102110
/// <summary>

‎src/Microsoft.Owin.Security.OpenIdConnect/OpenIdConnectAuthenticationNotifications.cs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33

44
using System;
55
using System.Threading.Tasks;
6-
using Microsoft.IdentityModel.Protocols;
6+
using Microsoft.IdentityModel.Protocols.OpenIdConnect;
77
using Microsoft.Owin.Security.Notifications;
88

99
namespace Microsoft.Owin.Security.OpenIdConnect

‎src/Microsoft.Owin.Security.OpenIdConnect/OpenIdConnectAuthenticationOptions.cs

Lines changed: 19 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,11 @@
33

44
using System;
55
using System.Diagnostics.CodeAnalysis;
6-
using System.IdentityModel.Tokens;
6+
using System.IdentityModel.Tokens.Jwt;
77
using System.Net.Http;
88
using Microsoft.IdentityModel.Protocols;
9+
using Microsoft.IdentityModel.Protocols.OpenIdConnect;
10+
using Microsoft.IdentityModel.Tokens;
911
using Microsoft.Owin.Infrastructure;
1012

1113
namespace Microsoft.Owin.Security.OpenIdConnect
@@ -16,7 +18,6 @@ namespace Microsoft.Owin.Security.OpenIdConnect
1618
public class OpenIdConnectAuthenticationOptions : AuthenticationOptions
1719
{
1820
private OpenIdConnectProtocolValidator _protocolValidator;
19-
private SecurityTokenHandlerCollection _securityTokenHandlers;
2021
private TokenValidationParameters _tokenValidationParameters;
2122
private TimeSpan _backchannelTimeout;
2223

@@ -54,11 +55,14 @@ public OpenIdConnectAuthenticationOptions(string authenticationType)
5455
Caption = OpenIdConnectAuthenticationDefaults.Caption;
5556
ProtocolValidator = new OpenIdConnectProtocolValidator()
5657
{
58+
RequireStateValidation = false,
5759
NonceLifetime = TimeSpan.FromMinutes(15)
5860
};
5961
RefreshOnIssuerKeyNotFound = true;
60-
ResponseType = OpenIdConnectResponseTypes.CodeIdToken;
61-
Scope = OpenIdConnectScopes.OpenIdProfile;
62+
ResponseType = OpenIdConnectResponseType.CodeIdToken;
63+
Scope = OpenIdConnectScope.OpenIdProfile;
64+
SecurityTokenValidator = new JwtSecurityTokenHandler();
65+
RequireHttpsMetadata = true;
6266
TokenValidationParameters = new TokenValidationParameters();
6367
UseTokenLifetime = true;
6468
CookieManager = new CookieManager();
@@ -126,30 +130,6 @@ public string Caption
126130
set { Description.Caption = value; }
127131
}
128132

129-
/// <summary>
130-
/// Gets or sets the <see cref="SecurityTokenHandlerCollection"/> of <see cref="SecurityTokenHandler"/>s used to read and validate <see cref="SecurityToken"/>s.
131-
/// </summary>
132-
/// <exception cref="ArgumentNullException">if 'value' is null.</exception>
133-
[System.Diagnostics.CodeAnalysis.SuppressMessage("Microsoft.Usage", "CA2227:CollectionPropertiesShouldBeReadOnly", Justification = "By Design")]
134-
[System.Diagnostics.CodeAnalysis.SuppressMessage("Microsoft.Usage", "CA2208:InstantiateArgumentExceptionsCorrectly", Justification = "By Design")]
135-
public SecurityTokenHandlerCollection SecurityTokenHandlers
136-
{
137-
get
138-
{
139-
return _securityTokenHandlers;
140-
}
141-
142-
set
143-
{
144-
if (value == null)
145-
{
146-
throw new ArgumentNullException("SecurityTokenHandlers");
147-
}
148-
149-
_securityTokenHandlers = value;
150-
}
151-
}
152-
153133
/// <summary>
154134
/// Gets or sets the 'client_id'.
155135
/// </summary>
@@ -166,6 +146,12 @@ public SecurityTokenHandlerCollection SecurityTokenHandlers
166146
/// </summary>
167147
public OpenIdConnectConfiguration Configuration { get; set; }
168148

149+
/// <summary>
150+
/// Gets or sets if HTTPS is required for the metadata address or authority.
151+
/// The default is true. This should be disabled only in development environments.
152+
/// </summary>
153+
public bool RequireHttpsMetadata { get; set; }
154+
169155
/// <summary>
170156
/// Gets or sets the discovery endpoint for obtaining metadata
171157
/// </summary>
@@ -253,6 +239,11 @@ public string SignInAsAuthenticationType
253239
/// </summary>
254240
public ISecureDataFormat<AuthenticationProperties> StateDataFormat { get; set; }
255241

242+
/// <summary>
243+
/// Gets or sets the <see cref="ISecurityTokenValidator"/> used to validate identity tokens.
244+
/// </summary>
245+
public ISecurityTokenValidator SecurityTokenValidator { get; set; }
246+
256247
/// <summary>
257248
/// Gets or sets the TokenValidationParameters
258249
/// </summary>

‎src/Microsoft.Owin.Security.OpenIdConnect/OpenidConnectAuthenticationHandler.cs

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -4,16 +4,16 @@
44
using System;
55
using System.Collections.Generic;
66
using System.Globalization;
7-
using System.IdentityModel.Tokens;
7+
using System.IdentityModel.Tokens.Jwt;
88
using System.IO;
99
using System.Linq;
1010
using System.Runtime.ExceptionServices;
1111
using System.Security.Claims;
1212
using System.Security.Cryptography;
1313
using System.Text;
1414
using System.Threading.Tasks;
15-
using Microsoft.IdentityModel.Extensions;
16-
using Microsoft.IdentityModel.Protocols;
15+
using Microsoft.IdentityModel.Protocols.OpenIdConnect;
16+
using Microsoft.IdentityModel.Tokens;
1717
using Microsoft.Owin.Logging;
1818
using Microsoft.Owin.Security.Infrastructure;
1919
using Microsoft.Owin.Security.Notifications;
@@ -70,7 +70,7 @@ protected override async Task ApplyResponseGrantAsync()
7070
OpenIdConnectMessage openIdConnectMessage = new OpenIdConnectMessage()
7171
{
7272
IssuerAddress = _configuration.EndSessionEndpoint ?? string.Empty,
73-
RequestType = OpenIdConnectRequestType.LogoutRequest,
73+
RequestType = OpenIdConnectRequestType.Logout,
7474
};
7575

7676
// Set End_Session_Endpoint in order:
@@ -143,9 +143,9 @@ protected override async Task ApplyResponseChallengeAsync()
143143
ClientId = Options.ClientId,
144144
IssuerAddress = _configuration.AuthorizationEndpoint ?? string.Empty,
145145
RedirectUri = Options.RedirectUri,
146-
RequestType = OpenIdConnectRequestType.AuthenticationRequest,
146+
RequestType = OpenIdConnectRequestType.Authentication,
147147
Resource = Options.Resource,
148-
ResponseMode = OpenIdConnectResponseModes.FormPost,
148+
ResponseMode = OpenIdConnectResponseMode.FormPost,
149149
ResponseType = Options.ResponseType,
150150
Scope = Options.Scope,
151151
State = OpenIdConnectAuthenticationDefaults.AuthenticationPropertiesKey + "=" + Uri.EscapeDataString(Options.StateDataFormat.Protect(properties)),
@@ -286,10 +286,10 @@ protected override async Task<AuthenticationTicket> AuthenticateCoreAsync()
286286
TokenValidationParameters tvp = Options.TokenValidationParameters.Clone();
287287
IEnumerable<string> issuers = new[] { _configuration.Issuer };
288288
tvp.ValidIssuers = (tvp.ValidIssuers == null ? issuers : tvp.ValidIssuers.Concat(issuers));
289-
tvp.IssuerSigningTokens = (tvp.IssuerSigningTokens == null ? _configuration.SigningTokens : tvp.IssuerSigningTokens.Concat(_configuration.SigningTokens));
289+
tvp.IssuerSigningKeys = (tvp.IssuerSigningKeys == null ? _configuration.SigningKeys : tvp.IssuerSigningKeys.Concat<SecurityKey>(_configuration.SigningKeys));
290290

291291
SecurityToken validatedToken;
292-
ClaimsPrincipal principal = Options.SecurityTokenHandlers.ValidateToken(openIdConnectMessage.IdToken, tvp, out validatedToken);
292+
ClaimsPrincipal principal = Options.SecurityTokenValidator.ValidateToken(openIdConnectMessage.IdToken, tvp, out validatedToken);
293293
ClaimsIdentity claimsIdentity = principal.Identity as ClaimsIdentity;
294294

295295
// claims principal could have changed claim values, use bits received on wire for validation.
@@ -352,13 +352,13 @@ protected override async Task<AuthenticationTicket> AuthenticateCoreAsync()
352352
// Flow possible changes
353353
ticket = securityTokenValidatedNotification.AuthenticationTicket;
354354

355-
var protocolValidationContext = new OpenIdConnectProtocolValidationContext
355+
Options.ProtocolValidator.ValidateAuthenticationResponse(new OpenIdConnectProtocolValidationContext()
356356
{
357-
AuthorizationCode = openIdConnectMessage.Code,
358-
Nonce = nonce,
359-
};
360-
361-
Options.ProtocolValidator.Validate(jwt, protocolValidationContext);
357+
ClientId = Options.ClientId,
358+
ProtocolMessage = openIdConnectMessage,
359+
ValidatedIdToken = jwt,
360+
Nonce = nonce
361+
});
362362

363363
if (openIdConnectMessage.Code != null)
364364
{

‎src/Microsoft.Owin.Security.OpenIdConnect/packages.config

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,10 @@
11
<?xml version="1.0" encoding="utf-8"?>
22
<packages>
3-
<package id="Microsoft.IdentityModel.Protocol.Extensions" version="1.0.0" targetFramework="net45" />
3+
<package id="Microsoft.IdentityModel.Logging" version="1.1.2" targetFramework="net451" />
4+
<package id="Microsoft.IdentityModel.Protocols" version="2.1.2" targetFramework="net451" />
5+
<package id="Microsoft.IdentityModel.Protocols.OpenIdConnect" version="2.1.2" targetFramework="net451" />
6+
<package id="Microsoft.IdentityModel.Tokens" version="5.1.2" targetFramework="net451" />
7+
<package id="Newtonsoft.Json" version="9.0.1" targetFramework="net451" />
48
<package id="Owin" version="1.0" targetFramework="net45" />
5-
<package id="System.IdentityModel.Tokens.Jwt" version="4.0.0" targetFramework="net45" />
9+
<package id="System.IdentityModel.Tokens.Jwt" version="5.1.2" targetFramework="net451" />
610
</packages>

0 commit comments

Comments
 (0)