Skip to content

Commit 20f5266

Browse files
brentschmaltzHP712
brentschmaltz
and
HP712
authored
Call TVP.CreateClaimsIdentity to support users that have overloaded. (#2716)
* Call TVP.CreateClaimsIdentity to support users that have overloaded. * picked up SAML changes and TokenValidationResult * updated JwtSecurityTokenHandler, reverted tests and removed method. * touched up tests --------- Co-authored-by: id4s <[email protected]>
1 parent ef6018d commit 20f5266

File tree

8 files changed

+49
-96
lines changed

8 files changed

+49
-96
lines changed

‎src/Microsoft.IdentityModel.JsonWebTokens/JsonWebTokenHandler.cs‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -212,7 +212,7 @@ private ClaimsIdentity CreateClaimsIdentityWithMapping(JsonWebToken jwtToken, To
212212
{
213213
_ = validationParameters ?? throw LogHelper.LogArgumentNullException(nameof(validationParameters));
214214

215-
ClaimsIdentity identity = ClaimsIdentityFactory.Create(jwtToken, validationParameters, issuer);
215+
ClaimsIdentity identity = validationParameters.CreateClaimsIdentity(jwtToken, issuer);
216216
foreach (Claim jwtClaim in jwtToken.Claims)
217217
{
218218
bool wasMapped = _inboundClaimTypeMap.TryGetValue(jwtClaim.Type, out string claimType);
@@ -281,7 +281,7 @@ private ClaimsIdentity CreateClaimsIdentityPrivate(JsonWebToken jwtToken, TokenV
281281
{
282282
_ = validationParameters ?? throw LogHelper.LogArgumentNullException(nameof(validationParameters));
283283

284-
ClaimsIdentity identity = ClaimsIdentityFactory.Create(jwtToken, validationParameters, issuer);
284+
ClaimsIdentity identity = validationParameters.CreateClaimsIdentity(jwtToken, issuer);
285285
foreach (Claim jwtClaim in jwtToken.Claims)
286286
{
287287
string claimType = jwtClaim.Type;

‎src/Microsoft.IdentityModel.Tokens.Saml/Saml/SamlSecurityTokenHandler.cs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -677,7 +677,7 @@ protected virtual IEnumerable<ClaimsIdentity> ProcessStatements(SamlSecurityToke
677677

678678
if (!identityDict.TryGetValue(statement.Subject, out ClaimsIdentity identity))
679679
{
680-
identity = ClaimsIdentityFactory.Create(samlToken, validationParameters, issuer);
680+
identity = validationParameters.CreateClaimsIdentity(samlToken, issuer);
681681
ProcessSubject(statement.Subject, identity, issuer);
682682
identityDict.Add(statement.Subject, identity);
683683
}

‎src/Microsoft.IdentityModel.Tokens.Saml/Saml2/Saml2SecurityTokenHandler.cs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1314,7 +1314,7 @@ protected virtual ClaimsIdentity CreateClaimsIdentity(Saml2SecurityToken samlTok
13141314
actualIssuer = ClaimsIdentity.DefaultIssuer;
13151315
}
13161316

1317-
var identity = ClaimsIdentityFactory.Create(samlToken, validationParameters, issuer);
1317+
var identity = validationParameters.CreateClaimsIdentity(samlToken, issuer);
13181318

13191319
ProcessSubject(samlToken.Assertion.Subject, identity, actualIssuer);
13201320
ProcessStatements(samlToken.Assertion.Statements, identity, actualIssuer);

‎src/Microsoft.IdentityModel.Tokens/ClaimsIdentityFactory.cs‎

Lines changed: 0 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -37,45 +37,5 @@ internal static ClaimsIdentity Create(string authenticationType, string nameType
3737
SecurityToken = securityToken,
3838
};
3939
}
40-
41-
internal static ClaimsIdentity Create(SecurityToken securityToken, TokenValidationParameters validationParameters, string issuer)
42-
{
43-
ClaimsIdentity claimsIdentity = validationParameters.CreateClaimsIdentity(securityToken, issuer);
44-
45-
// Set the SecurityToken in cases where derived TokenValidationParameters created a CaseSensitiveClaimsIdentity.
46-
if (claimsIdentity is CaseSensitiveClaimsIdentity caseSensitiveClaimsIdentity && caseSensitiveClaimsIdentity.SecurityToken == null)
47-
{
48-
caseSensitiveClaimsIdentity.SecurityToken = securityToken;
49-
}
50-
else if (claimsIdentity is not CaseSensitiveClaimsIdentity && !AppContextSwitches.UseClaimsIdentityType())
51-
{
52-
claimsIdentity = new CaseSensitiveClaimsIdentity(claimsIdentity)
53-
{
54-
SecurityToken = securityToken,
55-
};
56-
}
57-
58-
return claimsIdentity;
59-
}
60-
61-
internal static ClaimsIdentity Create(TokenHandler tokenHandler, SecurityToken securityToken, TokenValidationParameters validationParameters, string issuer)
62-
{
63-
ClaimsIdentity claimsIdentity = tokenHandler.CreateClaimsIdentityInternal(securityToken, validationParameters, issuer);
64-
65-
// Set the SecurityToken in cases where derived TokenHandler created a CaseSensitiveClaimsIdentity.
66-
if (claimsIdentity is CaseSensitiveClaimsIdentity caseSensitiveClaimsIdentity && caseSensitiveClaimsIdentity.SecurityToken == null)
67-
{
68-
caseSensitiveClaimsIdentity.SecurityToken = securityToken;
69-
}
70-
else if (claimsIdentity is not CaseSensitiveClaimsIdentity && !AppContextSwitches.UseClaimsIdentityType())
71-
{
72-
claimsIdentity = new CaseSensitiveClaimsIdentity(claimsIdentity)
73-
{
74-
SecurityToken = securityToken,
75-
};
76-
}
77-
78-
return claimsIdentity;
79-
}
8040
}
8141
}

‎src/Microsoft.IdentityModel.Tokens/Validation/TokenValidationResult.cs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -135,7 +135,7 @@ internal ClaimsIdentity ClaimsIdentityNoLocking
135135

136136
if (_validationParameters != null && SecurityToken != null && _tokenHandler != null && Issuer != null)
137137
{
138-
_claimsIdentity = ClaimsIdentityFactory.Create(_tokenHandler, SecurityToken, _validationParameters, Issuer);
138+
_claimsIdentity = _tokenHandler.CreateClaimsIdentityInternal(SecurityToken, _validationParameters, Issuer);
139139
}
140140

141141
_claimsIdentityInitialized = true;

‎src/System.IdentityModel.Tokens.Jwt/JwtSecurityTokenHandler.cs‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1527,7 +1527,7 @@ protected virtual ClaimsIdentity CreateClaimsIdentity(JwtSecurityToken jwtToken,
15271527

15281528
private ClaimsIdentity CreateClaimsIdentityWithMapping(JwtSecurityToken jwtToken, string actualIssuer, TokenValidationParameters validationParameters)
15291529
{
1530-
ClaimsIdentity identity = ClaimsIdentityFactory.Create(jwtToken, validationParameters, actualIssuer);
1530+
ClaimsIdentity identity = validationParameters.CreateClaimsIdentity(jwtToken, actualIssuer);
15311531
foreach (Claim jwtClaim in jwtToken.Claims)
15321532
{
15331533
if (_inboundClaimFilter.Contains(jwtClaim.Type))
@@ -1573,7 +1573,7 @@ private ClaimsIdentity CreateClaimsIdentityWithMapping(JwtSecurityToken jwtToken
15731573

15741574
private ClaimsIdentity CreateClaimsIdentityWithoutMapping(JwtSecurityToken jwtToken, string actualIssuer, TokenValidationParameters validationParameters)
15751575
{
1576-
ClaimsIdentity identity = ClaimsIdentityFactory.Create(jwtToken, validationParameters, actualIssuer);
1576+
ClaimsIdentity identity = validationParameters.CreateClaimsIdentity(jwtToken, actualIssuer);
15771577
foreach (Claim jwtClaim in jwtToken.Claims)
15781578
{
15791579
if (_inboundClaimFilter.Contains(jwtClaim.Type))

‎test/Microsoft.IdentityModel.JsonWebTokens.Tests/json/JsonWebTokenHandler.cs‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -806,7 +806,7 @@ private ClaimsIdentity CreateClaimsIdentityWithMapping(JsonWebToken jwtToken, To
806806
{
807807
_ = validationParameters ?? throw LogHelper.LogArgumentNullException(nameof(validationParameters));
808808

809-
ClaimsIdentity identity = ClaimsIdentityFactory.Create(jwtToken, validationParameters, issuer);
809+
ClaimsIdentity identity = validationParameters.CreateClaimsIdentity(jwtToken, issuer);
810810
foreach (Claim jwtClaim in jwtToken.Claims)
811811
{
812812
bool wasMapped = _inboundClaimTypeMap.TryGetValue(jwtClaim.Type, out string claimType);
@@ -875,7 +875,7 @@ private ClaimsIdentity CreateClaimsIdentityPrivate(JsonWebToken jwtToken, TokenV
875875
{
876876
_ = validationParameters ?? throw LogHelper.LogArgumentNullException(nameof(validationParameters));
877877

878-
ClaimsIdentity identity = ClaimsIdentityFactory.Create(jwtToken, validationParameters, issuer);
878+
ClaimsIdentity identity = validationParameters.CreateClaimsIdentity(jwtToken, issuer);
879879
foreach (Claim jwtClaim in jwtToken.Claims)
880880
{
881881
string claimType = jwtClaim.Type;

‎test/Microsoft.IdentityModel.Tokens.Tests/ClaimsIdentityFactoryTests.cs‎

Lines changed: 40 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ public void Create_FromTokenValidationParameters_ReturnsCorrectClaimsIdentity(bo
2525
tokenValidationParameters.NameClaimType = "custom-name";
2626
tokenValidationParameters.RoleClaimType = "custom-role";
2727

28-
var actualClaimsIdentity = ClaimsIdentityFactory.Create(jsonWebToken, tokenValidationParameters, Default.Issuer);
28+
var actualClaimsIdentity = tokenValidationParameters.CreateClaimsIdentity(jsonWebToken, Default.Issuer);
2929

3030
Assert.Equal(tokenValidationParameters.AuthenticationType, actualClaimsIdentity.AuthenticationType);
3131
Assert.Equal(tokenValidationParameters.NameClaimType, actualClaimsIdentity.NameClaimType);
@@ -45,48 +45,39 @@ public void Create_FromTokenValidationParameters_ReturnsCorrectClaimsIdentity(bo
4545
AppContext.SetSwitch(AppContextSwitches.UseClaimsIdentityTypeSwitch, false);
4646
}
4747

48-
[Fact]
49-
public void Create_FromDerivedTokenValidationParameters_HonorsSetSecurityToken()
50-
{
51-
var jsonWebToken = new JsonWebToken(Default.Jwt(Default.SecurityTokenDescriptor()));
52-
var tokenValidationParameters = new DerivedTokenValidationParameters(returnCaseSensitiveClaimsIdentityWithToken: true);
53-
tokenValidationParameters.AuthenticationType = "custom-authentication-type";
54-
tokenValidationParameters.NameClaimType = "custom-name";
55-
tokenValidationParameters.RoleClaimType = "custom-role";
56-
57-
var actualClaimsIdentity = ClaimsIdentityFactory.Create(jsonWebToken, tokenValidationParameters, Default.Issuer);
58-
59-
// The SecurityToken set in derived TokenValidationParameters is honored.
60-
Assert.IsType<CaseSensitiveClaimsIdentity>(actualClaimsIdentity);
61-
62-
var securityToken = ((CaseSensitiveClaimsIdentity)actualClaimsIdentity).SecurityToken;
63-
Assert.NotNull(securityToken);
64-
Assert.IsType<TvpJsonWebToken>(securityToken);
65-
Assert.NotEqual(jsonWebToken, securityToken);
66-
67-
Assert.Equal(tokenValidationParameters.AuthenticationType, actualClaimsIdentity.AuthenticationType);
68-
Assert.Equal(tokenValidationParameters.NameClaimType, actualClaimsIdentity.NameClaimType);
69-
Assert.Equal(tokenValidationParameters.RoleClaimType, actualClaimsIdentity.RoleClaimType);
70-
}
71-
7248
[Theory]
73-
[InlineData(true)]
74-
[InlineData(false)]
75-
public void Create_FromDerivedTokenValidationParameters_ReturnsCorrectClaimsIdentity(bool tvpReturnsCaseSensitiveClaimsIdentityWithoutToken)
49+
[InlineData(true, true)]
50+
[InlineData(true, false)]
51+
[InlineData(false, false)]
52+
public void Create_FromDerivedTokenValidationParameters_ReturnsCorrectClaimsIdentity(bool tvpReturnsCaseSensitiveClaimsIdentity, bool tvpReturnsCaseSensitiveClaimsIdentityWithToken)
7653
{
7754
var jsonWebToken = new JsonWebToken(Default.Jwt(Default.SecurityTokenDescriptor()));
78-
var tokenValidationParameters = new DerivedTokenValidationParameters(returnCaseSensitiveClaimsIdentityWithoutToken: tvpReturnsCaseSensitiveClaimsIdentityWithoutToken);
55+
var tokenValidationParameters = new DerivedTokenValidationParameters(tvpReturnsCaseSensitiveClaimsIdentity, tvpReturnsCaseSensitiveClaimsIdentityWithToken);
7956
tokenValidationParameters.AuthenticationType = "custom-authentication-type";
8057
tokenValidationParameters.NameClaimType = "custom-name";
8158
tokenValidationParameters.RoleClaimType = "custom-role";
8259

83-
var actualClaimsIdentity = ClaimsIdentityFactory.Create(jsonWebToken, tokenValidationParameters, Default.Issuer);
60+
var actualClaimsIdentity = tokenValidationParameters.CreateClaimsIdentity(jsonWebToken, Default.Issuer);
8461

85-
Assert.IsType<CaseSensitiveClaimsIdentity>(actualClaimsIdentity);
86-
87-
var securityToken = ((CaseSensitiveClaimsIdentity)actualClaimsIdentity).SecurityToken;
88-
Assert.NotNull(securityToken);
89-
Assert.Equal(jsonWebToken, securityToken);
62+
if (tvpReturnsCaseSensitiveClaimsIdentity)
63+
{
64+
Assert.IsType<CaseSensitiveClaimsIdentity>(actualClaimsIdentity);
65+
if (tvpReturnsCaseSensitiveClaimsIdentityWithToken)
66+
{
67+
var securityToken = ((CaseSensitiveClaimsIdentity)actualClaimsIdentity).SecurityToken;
68+
Assert.NotNull(securityToken);
69+
Assert.IsType<TvpJsonWebToken>(securityToken);
70+
Assert.NotEqual(jsonWebToken, securityToken);
71+
}
72+
else
73+
{
74+
Assert.Null(((CaseSensitiveClaimsIdentity)actualClaimsIdentity).SecurityToken);
75+
}
76+
}
77+
else
78+
{
79+
Assert.IsType<ClaimsIdentity>(actualClaimsIdentity);
80+
}
9081

9182
Assert.Equal(tokenValidationParameters.AuthenticationType, actualClaimsIdentity.AuthenticationType);
9283
Assert.Equal(tokenValidationParameters.NameClaimType, actualClaimsIdentity.NameClaimType);
@@ -97,28 +88,30 @@ public void Create_FromDerivedTokenValidationParameters_ReturnsCorrectClaimsIden
9788

9889
private class DerivedTokenValidationParameters : TokenValidationParameters
9990
{
91+
private bool _returnCaseSensitiveClaimsIdentity;
10092
private bool _returnCaseSensitiveClaimsIdentityWithToken;
101-
private bool _returnCaseSensitiveClaimsIdentityWithoutToken;
10293

103-
public DerivedTokenValidationParameters(bool returnCaseSensitiveClaimsIdentityWithToken = false, bool returnCaseSensitiveClaimsIdentityWithoutToken = false)
94+
public DerivedTokenValidationParameters(bool returnCaseSensitiveClaimsIdentity = false, bool returnCaseSensitiveClaimsIdentityWithToken = false)
10495
{
96+
_returnCaseSensitiveClaimsIdentity = returnCaseSensitiveClaimsIdentity;
10597
_returnCaseSensitiveClaimsIdentityWithToken = returnCaseSensitiveClaimsIdentityWithToken;
106-
_returnCaseSensitiveClaimsIdentityWithoutToken = returnCaseSensitiveClaimsIdentityWithoutToken;
10798
}
10899

109100
public override ClaimsIdentity CreateClaimsIdentity(SecurityToken securityToken, string issuer)
110101
{
111-
if (_returnCaseSensitiveClaimsIdentityWithToken)
102+
if (_returnCaseSensitiveClaimsIdentity)
112103
{
113-
return new CaseSensitiveClaimsIdentity(AuthenticationType, NameClaimType, RoleClaimType)
104+
if (_returnCaseSensitiveClaimsIdentityWithToken)
114105
{
115-
SecurityToken = new TvpJsonWebToken(Default.Jwt(Default.SecurityTokenDescriptor())),
116-
};
117-
}
118-
119-
if (_returnCaseSensitiveClaimsIdentityWithoutToken)
120-
{
121-
return new CaseSensitiveClaimsIdentity(AuthenticationType, NameClaimType, RoleClaimType);
106+
return new CaseSensitiveClaimsIdentity(AuthenticationType, NameClaimType, RoleClaimType)
107+
{
108+
SecurityToken = new TvpJsonWebToken(Default.Jwt(Default.SecurityTokenDescriptor())),
109+
};
110+
}
111+
else
112+
{
113+
return new CaseSensitiveClaimsIdentity(AuthenticationType, NameClaimType, RoleClaimType);
114+
}
122115
}
123116

124117
return new ClaimsIdentity(AuthenticationType, NameClaimType, RoleClaimType);

0 commit comments

Comments
 (0)