Serialize and deserialize actor token in claims identity

src/Microsoft.IdentityModel.JsonWebTokens/JsonWebTokenHandler.CreateToken.cs

@@ -668,11 +668,17 @@ internal static void WriteJwsPayload(
             // Duplicates are resolved according to the following priority:
             // SecurityTokenDescriptor.{Audience/Audiences, Issuer, Expires, IssuedAt, NotBefore}, SecurityTokenDescriptor.Claims, SecurityTokenDescriptor.Subject.Claims
             // SecurityTokenDescriptor.Claims are KeyValuePairs<string,object>, whereas SecurityTokenDescriptor.Subject.Claims are System.Security.Claims.Claim and are processed differently.
+            bool isActorFound = false;
 
             if (tokenDescriptor.Claims != null && tokenDescriptor.Claims.Count > 0)
             {
                 foreach (KeyValuePair<string, object> kvp in tokenDescriptor.Claims)
                 {
+                    if (kvp.Key.Equals(tokenDescriptor.ActorClaimType, StringComparison.Ordinal))
+                    {
+                        isActorFound = true;
+                        continue;
+                    }
                     if (!descriptorClaimsAudienceChecked && kvp.Key.Equals(JwtRegisteredClaimNames.Aud, StringComparison.Ordinal))
                     {
                         descriptorClaimsAudienceChecked = true;
@@ -754,6 +760,8 @@ internal static void WriteJwsPayload(
                     JsonPrimitives.WriteObject(ref writer, kvp.Key, kvp.Value);
                 }
             }
+            if (isActorFound || tokenDescriptor.Subject?.Actor != null)
+                WriteActorToken(ref writer, tokenDescriptor, setDefaultTimesOnTokenCreation, tokenLifetimeInMinutes);
 
             AddSubjectClaims(ref writer, tokenDescriptor, audienceSet, issuerSet, ref expSet, ref iatSet, ref nbfSet);
 
@@ -1071,6 +1079,70 @@ internal static byte[] WriteJweHeader(SecurityTokenDescriptor tokenDescriptor)
                 }
             }
         }
+        internal static void WriteActorToken(
+            ref Utf8JsonWriter writer,
+            SecurityTokenDescriptor tokenDescriptor,
+            bool setDefaultTimesOnTokenCreation,
+            int tokenLifetimeInMinutes)
+        {
+            var actorTokenDescriptor = CreateActorTokenDescriptor(tokenDescriptor);
+            if (actorTokenDescriptor == null || actorTokenDescriptor.Subject == null)
+                return;
+
+            writer.WritePropertyName(tokenDescriptor.ActorClaimType);
+            WriteJwsPayload(ref writer, actorTokenDescriptor, setDefaultTimesOnTokenCreation, tokenLifetimeInMinutes);
+        }
+
+        private static void ValidateActorChainDepth(SecurityTokenDescriptor tokenDescriptor)
+        {
+            if (tokenDescriptor.ActorChainDepth >= tokenDescriptor.MaxActorChainLength)
+            {
+                throw LogHelper.LogExceptionMessage(
+                new SecurityTokenException(LogHelper.FormatInvariant(
+                    LogMessages.IDX14313,
+                    LogHelper.MarkAsNonPII(tokenDescriptor.ActorChainDepth),
+                    LogHelper.MarkAsNonPII(tokenDescriptor.MaxActorChainLength))));
+            }
+        }
+
+        private static SecurityTokenDescriptor CreateActorTokenDescriptor(SecurityTokenDescriptor tokenDescriptor)
+        {
+            SecurityTokenDescriptor actorTokenDescriptor = null;
+
+            if (tokenDescriptor.Claims?.TryGetValue(tokenDescriptor.ActorClaimType, out object actorValue) == true)
+            {
+                if (actorValue is not ClaimsIdentity actor)
+                {
+                    throw LogHelper.LogExceptionMessage(new SecurityTokenException(
+                        LogHelper.FormatInvariant(
+                            LogMessages.IDX14315,
+                            LogHelper.MarkAsNonPII(tokenDescriptor.ActorClaimType),
+                            LogHelper.MarkAsNonPII(actorValue?.GetType().FullName ?? "null"))));
+                }
+
+                actorTokenDescriptor = new SecurityTokenDescriptor
+                {
+                    Subject = actor,
+                };
+
+            }
+            // Then check for actor in subject
+            else if (tokenDescriptor.Subject?.Actor != null)
+            {
+                actorTokenDescriptor = new SecurityTokenDescriptor
+                {
+                    Subject = tokenDescriptor.Subject.Actor,
+                };
+            }
+            if (actorTokenDescriptor != null)
+            {
+                ValidateActorChainDepth(tokenDescriptor);
+                actorTokenDescriptor.ActorClaimType = tokenDescriptor.ActorClaimType;
+                actorTokenDescriptor.ActorChainDepth = tokenDescriptor.ActorChainDepth + 1;
+            }
+
+            return actorTokenDescriptor;
+        }
 
         internal static byte[] CompressToken(byte[] utf8Bytes, string compressionAlgorithm)
         {

src/Microsoft.IdentityModel.JsonWebTokens/JsonWebTokenHandler.cs

@@ -4,6 +4,7 @@
 using System;
 using System.Collections.Generic;
 using System.Security.Claims;
+using System.Text.Json;
 using System.Text.RegularExpressions;
 using System.Threading;
 using System.Threading.Tasks;
@@ -222,19 +223,14 @@ private ClaimsIdentity CreateClaimsIdentityWithMapping(JsonWebToken jwtToken, To
                 if (!wasMapped)
                     claimType = jwtClaim.Type;
 
-                if (claimType == ClaimTypes.Actor)
+                if (claimType.Equals(validationParameters.ActorClaimType) || claimType.Equals(JwtRegisteredClaimNames.Actort))
                 {
                     if (identity.Actor != null)
                         throw LogHelper.LogExceptionMessage(new InvalidOperationException(LogHelper.FormatInvariant(
                                     LogMessages.IDX14112,
-                                    LogHelper.MarkAsNonPII(JwtRegisteredClaimNames.Actort),
+                                    LogHelper.MarkAsNonPII(claimType),
                                     jwtClaim.Value)));
-
-                    if (CanReadToken(jwtClaim.Value))
-                    {
-                        JsonWebToken actor = ReadToken(jwtClaim.Value) as JsonWebToken;
-                        identity.Actor = CreateClaimsIdentity(actor, validationParameters);
-                    }
+                    identity.Actor = CreateClaimsIdentityActor(jwtToken, jwtClaim.Value, validationParameters, claimType.Equals(validationParameters.ActorClaimType));
                 }
 
                 if (wasMapped)
@@ -287,16 +283,11 @@ private ClaimsIdentity CreateClaimsIdentityPrivate(JsonWebToken jwtToken, TokenV
             foreach (Claim jwtClaim in jwtToken.Claims)
             {
                 string claimType = jwtClaim.Type;
-                if (claimType == ClaimTypes.Actor)
+                if (claimType == validationParameters.ActorClaimType || claimType.Equals("actort"))
                 {
                     if (identity.Actor != null)
-                        throw LogHelper.LogExceptionMessage(new InvalidOperationException(LogHelper.FormatInvariant(LogMessages.IDX14112, LogHelper.MarkAsNonPII(JwtRegisteredClaimNames.Actort), jwtClaim.Value)));
-
-                    if (CanReadToken(jwtClaim.Value))
-                    {
-                        JsonWebToken actor = ReadToken(jwtClaim.Value) as JsonWebToken;
-                        identity.Actor = CreateClaimsIdentity(actor, validationParameters, issuer);
-                    }
+                        throw LogHelper.LogExceptionMessage(new InvalidOperationException(LogHelper.FormatInvariant(LogMessages.IDX14112, LogHelper.MarkAsNonPII(claimType), jwtClaim.Value)));
+                    identity.Actor = CreateClaimsIdentityActor(jwtToken, jwtClaim.Value, validationParameters, claimType.Equals(validationParameters.ActorClaimType));
                 }
 
                 if (jwtClaim.Properties.Count == 0)
@@ -621,5 +612,132 @@ private static TokenValidationResult ReadToken(string token, TokenValidationPara
                 IsValid = true
             };
         }
+
+        /// <summary>
+        /// Creates a ClaimsIdentity from an actor claim string.
+        /// </summary>
+        /// <param name="jwtToken">The actual JWT token parsed into JsonWebToken class.</param>
+        /// <param name="actorString">The actor claim string.</param>
+        /// <param name="tokenValidationParameters">The token validation parameters.</param>
+        /// <param name="isStandardAct">This tells us if we want to deserialize it as a JWT or Json Object. If this is set to true then we deserialize as JsonObject else as JWT.</param>
+        /// <returns>A ClaimsIdentity representing the actor.</returns>
+        /// <exception cref="ArgumentNullException">Thrown if <paramref name="actorString"/> or <paramref name="tokenValidationParameters"/> is null.</exception>
+        private ClaimsIdentity CreateClaimsIdentityActor(
+            JsonWebToken jwtToken,
+            string actorString,
+            TokenValidationParameters tokenValidationParameters,
+            bool isStandardAct = false)
+        {
+            if (string.IsNullOrEmpty(actorString))
+                throw LogHelper.LogArgumentNullException(nameof(actorString));
+
+            if (tokenValidationParameters == null)
+                throw LogHelper.LogArgumentNullException(nameof(tokenValidationParameters));
+
+            if (isStandardAct)
+            {
+                if (jwtToken.TryGetPayloadValue<JsonElement>(tokenValidationParameters.ActorClaimType, out JsonElement actClaim))
+                {
+                    if (tokenValidationParameters.ActClaimRetrieverDelegate != null)
+                    {
+                        try
+                        {
+                            return tokenValidationParameters.ActClaimRetrieverDelegate(actClaim, tokenValidationParameters);
+                        }
+                        catch (Exception ex)
+                        {
+                            throw LogHelper.LogExceptionMessage(new SecurityTokenDecryptionFailedException(LogHelper.FormatInvariant(
+                                LogMessages.IDX14314,
+                                LogHelper.MarkAsNonPII(ex.ToString()))));
+                        }
+                    }
+                    else
+                    {
+                        return CreateActorClaimsIdentityFromJsonElement(actClaim, tokenValidationParameters);
+                    }
+                }
+            }
+            else
+            {
+                if (CanReadToken(actorString))
+                {
+                    JsonWebToken actor = ReadToken(actorString) as JsonWebToken;
+                    return CreateClaimsIdentity(actor, tokenValidationParameters);
+                }
+            }
+
+            return null;
+        }
+
+        /// <summary>
+        /// Creates a ClaimsIdentity from a JsonElement that represents an actor token.
+        /// </summary>
+        /// <param name="jsonElement">The JsonElement containing actor claims.</param>
+        /// <param name="tokenValidationParameters">These parameters have details like nested actor chain length and max permissible actor length.</param>
+        /// <param name="issuer">The issuer for the claims.</param>
+        /// <returns>A ClaimsIdentity containing claims from the JsonElement.</returns>
+        internal static ClaimsIdentity CreateActorClaimsIdentityFromJsonElement(
+            JsonElement jsonElement,
+            TokenValidationParameters tokenValidationParameters,
+            string issuer = null)
+        {
+            if (tokenValidationParameters == null)
+                throw LogHelper.LogArgumentNullException(nameof(tokenValidationParameters));
+
+            if (tokenValidationParameters.ActorChainDepth >= tokenValidationParameters.MaxActorChainLength)
+            {
+                throw LogHelper.LogExceptionMessage(
+                    new SecurityTokenException(LogHelper.FormatInvariant(
+                    LogMessages.IDX14313,
+                    LogHelper.MarkAsNonPII(tokenValidationParameters.ActorChainDepth),
+                    LogHelper.MarkAsNonPII(tokenValidationParameters.MaxActorChainLength))));
+            }
+
+            if (jsonElement.ValueKind != JsonValueKind.Object)
+                throw LogHelper.LogExceptionMessage(new ArgumentException(LogMessages.IDX14316));
+
+            // Use CaseSensitiveClaimsIdentity for consistent behavior with the rest of the library
+            var identity = new CaseSensitiveClaimsIdentity();
+
+            issuer ??= ClaimsIdentity.DefaultIssuer;
+
+            foreach (var property in jsonElement.EnumerateObject())
+            {
+                string claimType = property.Name;
+                JsonElement value = property.Value;
+
+                // Special handling for nested actor claim
+                if (claimType == tokenValidationParameters.ActorClaimType)
+                {
+                    if (value.ValueKind == JsonValueKind.Object)
+                    {
+                        tokenValidationParameters.ActorChainDepth++;
+                        // Recursively create nested actor identity
+                        identity.Actor = CreateActorClaimsIdentityFromJsonElement(
+                            value, tokenValidationParameters, issuer);
+                    }
+                    continue;
+                }
+
+                // For all other claims, create and add them
+                if (value.ValueKind == JsonValueKind.Array)
+                {
+                    foreach (JsonElement element in value.EnumerateArray())
+                    {
+                        var claim = JsonClaimSet.CreateClaimFromJsonElement(claimType, issuer, element);
+                        if (claim != null)
+                            identity.AddClaim(claim);
+                    }
+                }
+                else
+                {
+                    var claim = JsonClaimSet.CreateClaimFromJsonElement(claimType, issuer, value);
+                    if (claim != null)
+                        identity.AddClaim(claim);
+                }
+            }
+
+            return identity;
+        }
     }
 }

src/Microsoft.IdentityModel.JsonWebTokens/LogMessages.cs

@@ -51,5 +51,9 @@ internal static class LogMessages
         internal const string IDX14310 = "IDX14310: JWE authentication tag is missing.";
         internal const string IDX14311 = "IDX14311: Unable to decode the authentication tag as a Base64Url encoded string.";
         internal const string IDX14312 = "IDX14312: Unable to decode the cipher text as a Base64Url encoded string.";
+        internal const string IDX14313 = "IDX14313: Unable to serialize/deserialize act claim. Maximum actor token depth reached. Current nesting depth is {0} while max depth set is {1}";
+        internal const string IDX14314 = "IDX14314: Unable to deserialize act claim. Exception faced while using custom delegate to deserialize act claim. Nested exception is :{0}";
+        internal const string IDX14315 = "IDX14315: Encountered an exception while processing the actor claim. Actor claim  {0} is not a claims identity. It is of type {1}.";
+        internal const string IDX14316 = "IDX14316: Actor token must be a JSON object";
     }
 }

src/Microsoft.IdentityModel.JsonWebTokens/Microsoft.IdentityModel.JsonWebTokens.csproj

@@ -1,4 +1,4 @@
-<Project Sdk="Microsoft.NET.Sdk">
+<Project Sdk="Microsoft.NET.Sdk">
 
   <Import Project="..\..\build\common.props" />
 

src/Microsoft.IdentityModel.Tokens/Delegates.cs

@@ -3,6 +3,7 @@
 
 using System;
 using System.Collections.Generic;
+using System.Security.Claims;
 using System.Text.Json;
 using System.Threading.Tasks;
 
@@ -194,4 +195,12 @@ namespace Microsoft.IdentityModel.Tokens
     /// <param name="claimValue">The claim value that was read and parsed from the reader.</param>
     /// <returns>True, if the claim value was read successfully; false otherwise.</returns>
     public delegate bool TryReadJwtClaim(ref Utf8JsonReader reader, JwtSegmentType jwtSegmentType, string claimName, out object claimValue);
+
+    /// <summary>
+    /// Delegate to validate the 'act' claim and create actor's ClaimsIdentity.
+    /// </summary>
+    /// <param name="actClaim">The JSON element representing the 'act' claim.</param>
+    /// <param name="tokenValidationParameters"> Opitonal validation parameters if needed</param>
+    /// <returns>A ClaimsIdentity representing the actor.</returns>
+    public delegate ClaimsIdentity ActClaimRetrieverDelegate(JsonElement actClaim, TokenValidationParameters tokenValidationParameters = null);
 }

src/Microsoft.IdentityModel.Tokens/InternalAPI.Unshipped.txt

@@ -1,4 +1,7 @@
 const Microsoft.IdentityModel.Tokens.AppContextSwitches.UseCapitalizedXMLTypeAttrSwitch = "Switch.Microsoft.IdentityModel.UseCapitalizedXMLTypeAttr" -> string
+const Microsoft.IdentityModel.Tokens.LogMessages.IDX11027 = "IDX11027: Invalid JsonWebToken handler configuration parameter value provided for {0}. {1}" -> string
+static Microsoft.IdentityModel.Tokens.AppContextSwitches.EnableActClaimSupport.get -> bool
+static Microsoft.IdentityModel.Tokens.AppContextSwitches.UseCapitalizedXMLTypeAttr.get -> bool
 const Microsoft.IdentityModel.Tokens.LogMessages.IDX10278 = "IDX10278: Unable to retrieve configuration from authority: '{0}'. \nProceeding with token decryption in case the relevant properties have been set manually on the TokenValidationParameters. Exception caught: \n {1}. See https://aka.ms/validate-using-configuration-manager for additional information." -> string
 static Microsoft.IdentityModel.Tokens.AppContextSwitches.UseCapitalizedXMLTypeAttr.get -> bool
 const Microsoft.IdentityModel.Telemetry.TelemetryConstants.BlockingTypeTag = "Blocking" -> string
@@ -110,3 +113,11 @@ virtual Microsoft.IdentityModel.Tokens.TokenHandler.CreateClaimsIdentityInternal
 virtual Microsoft.IdentityModel.Tokens.TokenHandler.ValidateTokenAsync(Microsoft.IdentityModel.Tokens.SecurityToken token, Microsoft.IdentityModel.Tokens.Experimental.ValidationParameters validationParameters, Microsoft.IdentityModel.Tokens.CallContext callContext, System.Threading.CancellationToken cancellationToken) -> System.Threading.Tasks.Task<Microsoft.IdentityModel.Tokens.Experimental.ValidationResult<Microsoft.IdentityModel.Tokens.Experimental.ValidatedToken, Microsoft.IdentityModel.Tokens.Experimental.ValidationError>>
 virtual Microsoft.IdentityModel.Tokens.TokenHandler.ValidateTokenAsync(string token, Microsoft.IdentityModel.Tokens.Experimental.ValidationParameters validationParameters, Microsoft.IdentityModel.Tokens.CallContext callContext, System.Threading.CancellationToken cancellationToken) -> System.Threading.Tasks.Task<Microsoft.IdentityModel.Tokens.Experimental.ValidationResult<Microsoft.IdentityModel.Tokens.Experimental.ValidatedToken, Microsoft.IdentityModel.Tokens.Experimental.ValidationError>>
 virtual Microsoft.IdentityModel.Tokens.ValidationError.CreateException() -> System.Exception
+Microsoft.IdentityModel.Tokens.TokenValidationParameters.ActorChainDepth.get -> int
+Microsoft.IdentityModel.Tokens.TokenValidationParameters.ActorChainDepth.set -> void
+Microsoft.IdentityModel.Tokens.TokenValidationParameters.MaxActorChainLength.get -> int
+Microsoft.IdentityModel.Tokens.TokenValidationParameters.MaxActorChainLength.set -> void
+Microsoft.IdentityModel.Tokens.SecurityTokenDescriptor.ActorChainDepth.get -> int
+Microsoft.IdentityModel.Tokens.SecurityTokenDescriptor.ActorChainDepth.set -> void
+Microsoft.IdentityModel.Tokens.SecurityTokenDescriptor.MaxActorChainLength.get -> int
+Microsoft.IdentityModel.Tokens.SecurityTokenDescriptor.MaxActorChainLength.set -> void

src/Microsoft.IdentityModel.Tokens/LogMessages.cs

@@ -317,6 +317,7 @@ internal static class LogMessages
         public const string IDX11023 = "IDX11023: Expecting json reader to be positioned on '{0}', reader was positioned at: '{1}', Reading: '{2}', Position: '{3}', CurrentDepth: '{4}', BytesConsumed: '{5}'.";
         public const string IDX11025 = "IDX11025: Cannot serialize object of type: '{0}' into property: '{1}'.";
         public const string IDX11026 = "IDX11026: Unable to get claim value as a string from claim type:'{0}', value type was:'{1}'. Acceptable types are String, IList<String>, and System.Text.Json.JsonElement.";
+        public const string IDX11027 = "IDX11027: Invalid JsonWebToken handler configuration parameter value provided for {0}. {1}";
 
 #pragma warning restore 1591
     }