Skip to content

Commit 4b04b52

Browse files
brentschmaltzHP712
authored and
Keegan Caruso
committed
Call TVP.CreateClaimsIdentity to support users that have overloaded. (#2716)
* Call TVP.CreateClaimsIdentity to support users that have overloaded. * picked up SAML changes and TokenValidationResult * updated JwtSecurityTokenHandler, reverted tests and removed method. * touched up tests --------- Co-authored-by: id4s <[email protected]>
1 parent 0ab6170 commit 4b04b52

File tree

8 files changed

+49
-96
lines changed

8 files changed

+49
-96
lines changed

‎src/Microsoft.IdentityModel.JsonWebTokens/JsonWebTokenHandler.cs‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -227,7 +227,7 @@ private ClaimsIdentity CreateClaimsIdentityWithMapping(JsonWebToken jwtToken, To
227227
{
228228
_ = validationParameters ?? throw LogHelper.LogArgumentNullException(nameof(validationParameters));
229229

230-
ClaimsIdentity identity = ClaimsIdentityFactory.Create(jwtToken, validationParameters, issuer);
230+
ClaimsIdentity identity = validationParameters.CreateClaimsIdentity(jwtToken, issuer);
231231
foreach (Claim jwtClaim in jwtToken.Claims)
232232
{
233233
bool wasMapped = _inboundClaimTypeMap.TryGetValue(jwtClaim.Type, out string claimType);
@@ -296,7 +296,7 @@ private ClaimsIdentity CreateClaimsIdentityPrivate(JsonWebToken jwtToken, TokenV
296296
{
297297
_ = validationParameters ?? throw LogHelper.LogArgumentNullException(nameof(validationParameters));
298298

299-
ClaimsIdentity identity = ClaimsIdentityFactory.Create(jwtToken, validationParameters, issuer);
299+
ClaimsIdentity identity = validationParameters.CreateClaimsIdentity(jwtToken, issuer);
300300
foreach (Claim jwtClaim in jwtToken.Claims)
301301
{
302302
string claimType = jwtClaim.Type;

‎src/Microsoft.IdentityModel.Tokens.Saml/Saml/SamlSecurityTokenHandler.cs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -649,7 +649,7 @@ protected virtual IEnumerable<ClaimsIdentity> ProcessStatements(SamlSecurityToke
649649

650650
if (!identityDict.TryGetValue(statement.Subject, out ClaimsIdentity identity))
651651
{
652-
identity = ClaimsIdentityFactory.Create(samlToken, validationParameters, issuer);
652+
identity = validationParameters.CreateClaimsIdentity(samlToken, issuer);
653653
ProcessSubject(statement.Subject, identity, issuer);
654654
identityDict.Add(statement.Subject, identity);
655655
}

‎src/Microsoft.IdentityModel.Tokens.Saml/Saml2/Saml2SecurityTokenHandler.cs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1307,7 +1307,7 @@ protected virtual ClaimsIdentity CreateClaimsIdentity(Saml2SecurityToken samlTok
13071307
actualIssuer = ClaimsIdentity.DefaultIssuer;
13081308
}
13091309

1310-
var identity = ClaimsIdentityFactory.Create(samlToken, validationParameters, issuer);
1310+
var identity = validationParameters.CreateClaimsIdentity(samlToken, issuer);
13111311

13121312
ProcessSubject(samlToken.Assertion.Subject, identity, actualIssuer);
13131313
ProcessStatements(samlToken.Assertion.Statements, identity, actualIssuer);

‎src/Microsoft.IdentityModel.Tokens/ClaimsIdentityFactory.cs‎

Lines changed: 0 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -37,45 +37,5 @@ internal static ClaimsIdentity Create(string authenticationType, string nameType
3737

3838
return new ClaimsIdentity(authenticationType: authenticationType, nameType: nameType, roleType: roleType);
3939
}
40-
41-
internal static ClaimsIdentity Create(SecurityToken securityToken, TokenValidationParameters validationParameters, string issuer)
42-
{
43-
ClaimsIdentity claimsIdentity = validationParameters.CreateClaimsIdentity(securityToken, issuer);
44-
45-
// Set the SecurityToken in cases where derived TokenValidationParameters created a CaseSensitiveClaimsIdentity.
46-
if (claimsIdentity is CaseSensitiveClaimsIdentity caseSensitiveClaimsIdentity && caseSensitiveClaimsIdentity.SecurityToken == null)
47-
{
48-
caseSensitiveClaimsIdentity.SecurityToken = securityToken;
49-
}
50-
else if (claimsIdentity is not CaseSensitiveClaimsIdentity && AppContextSwitches.UseCaseSensitiveClaimsIdentityType())
51-
{
52-
claimsIdentity = new CaseSensitiveClaimsIdentity(claimsIdentity)
53-
{
54-
SecurityToken = securityToken,
55-
};
56-
}
57-
58-
return claimsIdentity;
59-
}
60-
61-
internal static ClaimsIdentity Create(TokenHandler tokenHandler, SecurityToken securityToken, TokenValidationParameters validationParameters, string issuer)
62-
{
63-
ClaimsIdentity claimsIdentity = tokenHandler.CreateClaimsIdentityInternal(securityToken, validationParameters, issuer);
64-
65-
// Set the SecurityToken in cases where derived TokenHandler created a CaseSensitiveClaimsIdentity.
66-
if (claimsIdentity is CaseSensitiveClaimsIdentity caseSensitiveClaimsIdentity && caseSensitiveClaimsIdentity.SecurityToken == null)
67-
{
68-
caseSensitiveClaimsIdentity.SecurityToken = securityToken;
69-
}
70-
else if (claimsIdentity is not CaseSensitiveClaimsIdentity && AppContextSwitches.UseCaseSensitiveClaimsIdentityType())
71-
{
72-
claimsIdentity = new CaseSensitiveClaimsIdentity(claimsIdentity)
73-
{
74-
SecurityToken = securityToken,
75-
};
76-
}
77-
78-
return claimsIdentity;
79-
}
8040
}
8141
}

‎src/Microsoft.IdentityModel.Tokens/TokenValidationResult.cs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -122,7 +122,7 @@ internal ClaimsIdentity ClaimsIdentityNoLocking
122122

123123
if (_validationParameters != null && SecurityToken != null && _tokenHandler != null && Issuer != null)
124124
{
125-
_claimsIdentity = ClaimsIdentityFactory.Create(_tokenHandler, SecurityToken, _validationParameters, Issuer);
125+
_claimsIdentity = _tokenHandler.CreateClaimsIdentityInternal(SecurityToken, _validationParameters, Issuer);
126126
}
127127

128128
_claimsIdentityInitialized = true;

‎src/System.IdentityModel.Tokens.Jwt/JwtSecurityTokenHandler.cs‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1505,7 +1505,7 @@ protected virtual ClaimsIdentity CreateClaimsIdentity(JwtSecurityToken jwtToken,
15051505

15061506
private ClaimsIdentity CreateClaimsIdentityWithMapping(JwtSecurityToken jwtToken, string actualIssuer, TokenValidationParameters validationParameters)
15071507
{
1508-
ClaimsIdentity identity = ClaimsIdentityFactory.Create(jwtToken, validationParameters, actualIssuer);
1508+
ClaimsIdentity identity = validationParameters.CreateClaimsIdentity(jwtToken, actualIssuer);
15091509
foreach (Claim jwtClaim in jwtToken.Claims)
15101510
{
15111511
if (_inboundClaimFilter.Contains(jwtClaim.Type))
@@ -1551,7 +1551,7 @@ private ClaimsIdentity CreateClaimsIdentityWithMapping(JwtSecurityToken jwtToken
15511551

15521552
private ClaimsIdentity CreateClaimsIdentityWithoutMapping(JwtSecurityToken jwtToken, string actualIssuer, TokenValidationParameters validationParameters)
15531553
{
1554-
ClaimsIdentity identity = ClaimsIdentityFactory.Create(jwtToken, validationParameters, actualIssuer);
1554+
ClaimsIdentity identity = validationParameters.CreateClaimsIdentity(jwtToken, actualIssuer);
15551555
foreach (Claim jwtClaim in jwtToken.Claims)
15561556
{
15571557
if (_inboundClaimFilter.Contains(jwtClaim.Type))

‎test/Microsoft.IdentityModel.JsonWebTokens.Tests/json/JsonWebTokenHandler.cs‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -792,7 +792,7 @@ private ClaimsIdentity CreateClaimsIdentityWithMapping(JsonWebToken jwtToken, To
792792
{
793793
_ = validationParameters ?? throw LogHelper.LogArgumentNullException(nameof(validationParameters));
794794

795-
ClaimsIdentity identity = ClaimsIdentityFactory.Create(jwtToken, validationParameters, issuer);
795+
ClaimsIdentity identity = validationParameters.CreateClaimsIdentity(jwtToken, issuer);
796796
foreach (Claim jwtClaim in jwtToken.Claims)
797797
{
798798
bool wasMapped = _inboundClaimTypeMap.TryGetValue(jwtClaim.Type, out string claimType);
@@ -861,7 +861,7 @@ private ClaimsIdentity CreateClaimsIdentityPrivate(JsonWebToken jwtToken, TokenV
861861
{
862862
_ = validationParameters ?? throw LogHelper.LogArgumentNullException(nameof(validationParameters));
863863

864-
ClaimsIdentity identity = ClaimsIdentityFactory.Create(jwtToken, validationParameters, issuer);
864+
ClaimsIdentity identity = validationParameters.CreateClaimsIdentity(jwtToken, issuer);
865865
foreach (Claim jwtClaim in jwtToken.Claims)
866866
{
867867
string claimType = jwtClaim.Type;

‎test/Microsoft.IdentityModel.Tokens.Tests/ClaimsIdentityFactoryTests.cs‎

Lines changed: 40 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ public void Create_FromTokenValidationParameters_ReturnsCorrectClaimsIdentity(bo
2525
tokenValidationParameters.NameClaimType = "custom-name";
2626
tokenValidationParameters.RoleClaimType = "custom-role";
2727

28-
var actualClaimsIdentity = ClaimsIdentityFactory.Create(jsonWebToken, tokenValidationParameters, Default.Issuer);
28+
var actualClaimsIdentity = tokenValidationParameters.CreateClaimsIdentity(jsonWebToken, Default.Issuer);
2929

3030
Assert.Equal(tokenValidationParameters.AuthenticationType, actualClaimsIdentity.AuthenticationType);
3131
Assert.Equal(tokenValidationParameters.NameClaimType, actualClaimsIdentity.NameClaimType);
@@ -45,50 +45,41 @@ public void Create_FromTokenValidationParameters_ReturnsCorrectClaimsIdentity(bo
4545
AppContext.SetSwitch(AppContextSwitches.UseCaseSensitiveClaimsIdentityIdentityTypeSwitch, false);
4646
}
4747

48-
[Fact]
49-
public void Create_FromDerivedTokenValidationParameters_HonorsSetSecurityToken()
50-
{
51-
var jsonWebToken = new JsonWebToken(Default.Jwt(Default.SecurityTokenDescriptor()));
52-
var tokenValidationParameters = new DerivedTokenValidationParameters(returnCaseSensitiveClaimsIdentityWithToken: true);
53-
tokenValidationParameters.AuthenticationType = "custom-authentication-type";
54-
tokenValidationParameters.NameClaimType = "custom-name";
55-
tokenValidationParameters.RoleClaimType = "custom-role";
56-
57-
var actualClaimsIdentity = ClaimsIdentityFactory.Create(jsonWebToken, tokenValidationParameters, Default.Issuer);
58-
59-
// The SecurityToken set in derived TokenValidationParameters is honored.
60-
Assert.IsType<CaseSensitiveClaimsIdentity>(actualClaimsIdentity);
61-
62-
var securityToken = ((CaseSensitiveClaimsIdentity)actualClaimsIdentity).SecurityToken;
63-
Assert.NotNull(securityToken);
64-
Assert.IsType<TvpJsonWebToken>(securityToken);
65-
Assert.NotEqual(jsonWebToken, securityToken);
66-
67-
Assert.Equal(tokenValidationParameters.AuthenticationType, actualClaimsIdentity.AuthenticationType);
68-
Assert.Equal(tokenValidationParameters.NameClaimType, actualClaimsIdentity.NameClaimType);
69-
Assert.Equal(tokenValidationParameters.RoleClaimType, actualClaimsIdentity.RoleClaimType);
70-
}
71-
7248
[Theory]
73-
[InlineData(true)]
74-
[InlineData(false)]
75-
public void Create_FromDerivedTokenValidationParameters_ReturnsCorrectClaimsIdentity(bool tvpReturnsCaseSensitiveClaimsIdentityWithoutToken)
49+
[InlineData(true, true)]
50+
[InlineData(true, false)]
51+
[InlineData(false, false)]
52+
public void Create_FromDerivedTokenValidationParameters_ReturnsCorrectClaimsIdentity(bool tvpReturnsCaseSensitiveClaimsIdentity, bool tvpReturnsCaseSensitiveClaimsIdentityWithToken)
7653
{
7754
AppContext.SetSwitch(AppContextSwitches.UseCaseSensitiveClaimsIdentityIdentityTypeSwitch, true);
7855

7956
var jsonWebToken = new JsonWebToken(Default.Jwt(Default.SecurityTokenDescriptor()));
80-
var tokenValidationParameters = new DerivedTokenValidationParameters(returnCaseSensitiveClaimsIdentityWithoutToken: tvpReturnsCaseSensitiveClaimsIdentityWithoutToken);
57+
var tokenValidationParameters = new DerivedTokenValidationParameters(tvpReturnsCaseSensitiveClaimsIdentity, tvpReturnsCaseSensitiveClaimsIdentityWithToken);
8158
tokenValidationParameters.AuthenticationType = "custom-authentication-type";
8259
tokenValidationParameters.NameClaimType = "custom-name";
8360
tokenValidationParameters.RoleClaimType = "custom-role";
8461

85-
var actualClaimsIdentity = ClaimsIdentityFactory.Create(jsonWebToken, tokenValidationParameters, Default.Issuer);
62+
var actualClaimsIdentity = tokenValidationParameters.CreateClaimsIdentity(jsonWebToken, Default.Issuer);
8663

87-
Assert.IsType<CaseSensitiveClaimsIdentity>(actualClaimsIdentity);
88-
89-
var securityToken = ((CaseSensitiveClaimsIdentity)actualClaimsIdentity).SecurityToken;
90-
Assert.NotNull(securityToken);
91-
Assert.Equal(jsonWebToken, securityToken);
64+
if (tvpReturnsCaseSensitiveClaimsIdentity)
65+
{
66+
Assert.IsType<CaseSensitiveClaimsIdentity>(actualClaimsIdentity);
67+
if (tvpReturnsCaseSensitiveClaimsIdentityWithToken)
68+
{
69+
var securityToken = ((CaseSensitiveClaimsIdentity)actualClaimsIdentity).SecurityToken;
70+
Assert.NotNull(securityToken);
71+
Assert.IsType<TvpJsonWebToken>(securityToken);
72+
Assert.NotEqual(jsonWebToken, securityToken);
73+
}
74+
else
75+
{
76+
Assert.Null(((CaseSensitiveClaimsIdentity)actualClaimsIdentity).SecurityToken);
77+
}
78+
}
79+
else
80+
{
81+
Assert.IsType<ClaimsIdentity>(actualClaimsIdentity);
82+
}
9283

9384
Assert.Equal(tokenValidationParameters.AuthenticationType, actualClaimsIdentity.AuthenticationType);
9485
Assert.Equal(tokenValidationParameters.NameClaimType, actualClaimsIdentity.NameClaimType);
@@ -101,28 +92,30 @@ public void Create_FromDerivedTokenValidationParameters_ReturnsCorrectClaimsIden
10192

10293
private class DerivedTokenValidationParameters : TokenValidationParameters
10394
{
95+
private bool _returnCaseSensitiveClaimsIdentity;
10496
private bool _returnCaseSensitiveClaimsIdentityWithToken;
105-
private bool _returnCaseSensitiveClaimsIdentityWithoutToken;
10697

107-
public DerivedTokenValidationParameters(bool returnCaseSensitiveClaimsIdentityWithToken = false, bool returnCaseSensitiveClaimsIdentityWithoutToken = false)
98+
public DerivedTokenValidationParameters(bool returnCaseSensitiveClaimsIdentity = false, bool returnCaseSensitiveClaimsIdentityWithToken = false)
10899
{
100+
_returnCaseSensitiveClaimsIdentity = returnCaseSensitiveClaimsIdentity;
109101
_returnCaseSensitiveClaimsIdentityWithToken = returnCaseSensitiveClaimsIdentityWithToken;
110-
_returnCaseSensitiveClaimsIdentityWithoutToken = returnCaseSensitiveClaimsIdentityWithoutToken;
111102
}
112103

113104
public override ClaimsIdentity CreateClaimsIdentity(SecurityToken securityToken, string issuer)
114105
{
115-
if (_returnCaseSensitiveClaimsIdentityWithToken)
106+
if (_returnCaseSensitiveClaimsIdentity)
116107
{
117-
return new CaseSensitiveClaimsIdentity(AuthenticationType, NameClaimType, RoleClaimType)
108+
if (_returnCaseSensitiveClaimsIdentityWithToken)
118109
{
119-
SecurityToken = new TvpJsonWebToken(Default.Jwt(Default.SecurityTokenDescriptor())),
120-
};
121-
}
122-
123-
if (_returnCaseSensitiveClaimsIdentityWithoutToken)
124-
{
125-
return new CaseSensitiveClaimsIdentity(AuthenticationType, NameClaimType, RoleClaimType);
110+
return new CaseSensitiveClaimsIdentity(AuthenticationType, NameClaimType, RoleClaimType)
111+
{
112+
SecurityToken = new TvpJsonWebToken(Default.Jwt(Default.SecurityTokenDescriptor())),
113+
};
114+
}
115+
else
116+
{
117+
return new CaseSensitiveClaimsIdentity(AuthenticationType, NameClaimType, RoleClaimType);
118+
}
126119
}
127120

128121
return new ClaimsIdentity(AuthenticationType, NameClaimType, RoleClaimType);

0 commit comments

Comments
 (0)