Add MapIdentityApi<TUser>() #47414

halter73 · 2023-03-25T02:12:31Z

Addresses #47227

src/Identity/Endpoints/src/IdentityBearerAuthenticationHandler.cs

src/Identity/Endpoints/src/IdentityEndpointServiceCollectionExtensions.cs

src/Identity/Endpoints/src/IdentityBearerAuthenticationHandler.cs

src/Identity/Endpoints/src/IdentityBearerOptions.cs

src/Identity/Endpoints/src/IdentityBearerAuthenticationHandler.cs

src/Identity/test/Identity.FunctionalTests/MapIdentityTests.cs

src/Identity/Endpoints/src/IdentityEndpointsServiceCollectionExtensions.cs

ghost · 2023-04-13T03:00:55Z

Looks like this PR hasn't been active for some time and the codebase could have been changed in the meantime.
To make sure no breaking changes are introduced, please leave an /azp run comment here to rerun the CI pipeline and confirm success before merging the change.

src/Identity/Endpoints/src/IdentityBearerAuthenticationHandler.cs

javiercn

Looks good to me

halter73 · 2023-04-26T19:54:04Z

/backport to release/8.0-preview4

github-actions · 2023-04-26T19:54:18Z

Started backporting to release/8.0-preview4: https://github.com/dotnet/aspnetcore/actions/runs/4812793273

github-actions · 2023-04-26T19:54:56Z

@halter73 backporting to release/8.0-preview4 failed, the patch most likely resulted in conflicts:

$ git am --3way --ignore-whitespace --keep-non-patch changes.patch

Applying: Add MapIdentityApi<TUser>()
.git/rebase-apply/patch:1330: new blank line at EOF.
+
warning: 1 line adds whitespace errors.
Using index info to reconstruct a base tree...
M	src/Identity/Core/src/PublicAPI.Unshipped.txt
M	src/Identity/Identity.slnf
M	src/Security/Security.slnf
Falling back to patching base and 3-way merge...
Auto-merging src/Security/Security.slnf
Auto-merging src/Identity/Identity.slnf
CONFLICT (content): Merge conflict in src/Identity/Identity.slnf
Auto-merging src/Identity/Core/src/PublicAPI.Unshipped.txt
CONFLICT (content): Merge conflict in src/Identity/Core/src/PublicAPI.Unshipped.txt
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
Patch failed at 0001 Add MapIdentityApi<TUser>()
When you have resolved this problem, run "git am --continue".
If you prefer to skip this patch, run "git am --skip" instead.
To restore the original branch and stop patching, run "git am --abort".
Error: The process '/usr/bin/git' failed with exit code 128

Please backport manually!

github-actions · 2023-04-26T19:54:57Z

@halter73 an error occurred while backporting to release/8.0-preview4, please check the run log for details!

Error: git am failed, most likely due to a merge conflict.

Tratcher · 2023-04-27T19:43:44Z

src/Identity/Core/src/IdentityApiEndpointsIdentityBuilderExtensions.cs

+public static class IdentityApiEndpointsIdentityBuilderExtensions
+{
+    /// <summary>
+    /// Adds configuration ans services needed to support <see cref="IdentityApiEndpointRouteBuilderExtensions.MapIdentityApi{TUser}(IEndpointRouteBuilder)"/>


Tratcher · 2023-04-27T19:49:26Z

src/Security/Authentication/BearerToken/src/BearerTokenHandler.cs

+#pragma warning restore IDE0060 // Remove unused parameter
+    : SignInAuthenticationHandler<BearerTokenOptions>(optionsMonitor, loggerFactory, urlEncoder)
+{
+    private const string BearerTokenPurpose = $"Microsoft.AspNetCore.Authentication.BearerToken:v1:BearerToken";


Tratcher · 2023-04-27T19:54:54Z

src/Security/Authentication/BearerToken/src/BearerTokenHandler.cs

+
+        var ticket = BearerTokenProtector.Unprotect(token);
+
+        if (ticket?.Properties?.ExpiresUtc is null)


store ExpiresUtc in a variable, it's parsed on-demand.

aspnetcore/src/Http/Authentication.Abstractions/src/AuthenticationProperties.cs

Line 105 in 6d30638

get => GetDateTimeOffset(ExpiresUtcKey);

Tratcher · 2023-04-27T19:56:33Z

src/Security/Authentication/BearerToken/src/BearerTokenHandler.cs

+
+        if (properties.ExpiresUtc is null)
+        {
+            properties.ExpiresUtc ??= utcNow + Options.BearerTokenExpiration;


Tratcher · 2023-04-27T19:57:07Z

src/Security/Authentication/BearerToken/src/BearerTokenHandler.cs

+
+        properties ??= new();
+
+        if (properties.ExpiresUtc is null)


store locally

Tratcher · 2023-04-27T19:58:51Z

src/Security/Authentication/BearerToken/src/BearerTokenHandler.cs

+    {
+        var authorization = Request.Headers.Authorization.ToString();
+
+        return authorization.StartsWith("Bearer ", StringComparison.Ordinal)


OrdinalIgnoreCase
https://github.com/dotnet/aspnetcore/blob/main/src/Security/Authentication/JwtBearer/src/JwtBearerHandler.cs#L87

This is new, and I like being strict until we see a client that cannot send "Bearer" with the standard casing.

This is the kind of thing clients are guaranteed to get wrong sooner or later. There's no reason to be strict about it.

Tratcher · 2023-04-27T20:04:55Z

src/Security/Authentication/BearerToken/src/BearerTokenEvents.cs

+/// <summary>
+/// Specifies events which the bearer token handler invokes to enable developer control over the authentication process.
+/// </summary>
+public class BearerTokenEvents


There should also be an OnSignIn event that would let you take over the response generation, or at least mess with the identity before the token is created.

Tratcher · 2023-04-27T20:08:11Z

src/Security/Authentication/BearerToken/src/BearerTokenHandler.cs

+    private static readonly AuthenticateResult FailedUnprotectingToken = AuthenticateResult.Fail("Unprotected token failed");
+    private static readonly AuthenticateResult TokenExpired = AuthenticateResult.Fail("Token expired");
+
+    private ISecureDataFormat<AuthenticationTicket> BearerTokenProtector


You can do this one in PostConfigure options to avoid creating it per request.

aspnetcore/src/Security/Authentication/Cookies/src/PostConfigureCookieAuthenticationOptions.cs

Lines 40 to 44 in 6d30638

if (options.TicketDataFormat == null)

{

// Note: the purpose for the data protector must remain fixed for interop to work.

var dataProtector = options.DataProtectionProvider.CreateProtector("Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationMiddleware", name, "v2");

options.TicketDataFormat = new TicketDataFormat(dataProtector);

ghost added the area-identity Includes: Identity and providers label Mar 25, 2023

davidfowl reviewed Mar 25, 2023

View reviewed changes

src/Identity/Endpoints/src/IdentityBearerAuthenticationHandler.cs Outdated Show resolved Hide resolved

mkArtakMSFT reviewed Mar 29, 2023

View reviewed changes

src/Identity/Endpoints/src/IdentityEndpointServiceCollectionExtensions.cs Outdated Show resolved Hide resolved

davidfowl mentioned this pull request Mar 30, 2023

ASP.NET Core SPA Templates Need Better Options for Authentication #42158

Closed

1 task

halter73 force-pushed the halter73/47227 branch from 364c640 to 9411969 Compare March 30, 2023 16:07

halter73 requested review from javiercn and Tratcher March 30, 2023 16:07

halter73 marked this pull request as ready for review March 30, 2023 16:07

halter73 requested review from a team and wtgodbe as code owners March 30, 2023 16:07

BrennanConroy reviewed Mar 30, 2023

View reviewed changes

src/Identity/Endpoints/src/IdentityBearerAuthenticationHandler.cs Outdated Show resolved Hide resolved

Tratcher reviewed Mar 30, 2023

View reviewed changes

halter73 mentioned this pull request Mar 31, 2023

Add API endpoints for generating identity tokens #47227

Closed

halter73 linked an issue Mar 31, 2023 that may be closed by this pull request

Add API endpoints for generating identity tokens #47227

Closed

ghost added the pending-ci-rerun When assigned to a PR indicates that the CI checks should be rerun label Apr 13, 2023

halter73 mentioned this pull request Apr 19, 2023

Only call AddDataProtection in Authentication Services that require it #47410

Open

javiercn reviewed Apr 20, 2023

View reviewed changes

src/Identity/Endpoints/src/IdentityBearerAuthenticationHandler.cs Outdated Show resolved Hide resolved

javiercn approved these changes Apr 20, 2023

View reviewed changes

halter73 mentioned this pull request Apr 24, 2023

Simplify and optimize async parameters in RequestDelegateFactory #42588

Closed

halter73 force-pushed the halter73/47227 branch from 9411969 to f32a1b4 Compare April 26, 2023 06:15

halter73 mentioned this pull request Apr 26, 2023

Add suppression message to JSON serialization #47908

Merged

halter73 force-pushed the halter73/47227 branch from f32a1b4 to 2ab66d5 Compare April 26, 2023 19:46

Add MapIdentityApi<TUser>()

8bbab02

halter73 force-pushed the halter73/47227 branch from 2ab66d5 to 8bbab02 Compare April 26, 2023 19:53

halter73 changed the title ~~Add MapIdentity<TUser>()~~ Add MapIdentityApi<TUser>() Apr 26, 2023

halter73 removed the pending-ci-rerun When assigned to a PR indicates that the CI checks should be rerun label Apr 26, 2023

halter73 mentioned this pull request Apr 26, 2023

Obsolete and replace ISystemClock in Security, Identity #47472 #47717

Merged

Fix CI

490c873

halter73 mentioned this pull request Apr 27, 2023

[release/8.0-preview4] Add MapIdentityApi<TUser>() #47927

Merged

10 tasks

halter73 merged commit d4430f0 into main Apr 27, 2023

halter73 deleted the halter73/47227 branch April 27, 2023 19:06

ghost added this to the 8.0-preview5 milestone Apr 27, 2023

Tratcher reviewed Apr 27, 2023

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add MapIdentityApi<TUser>() #47414

Add MapIdentityApi<TUser>() #47414

halter73 commented Mar 25, 2023

ghost commented Apr 13, 2023

javiercn left a comment

halter73 commented Apr 26, 2023

github-actions bot commented Apr 26, 2023

github-actions bot commented Apr 26, 2023

github-actions bot commented Apr 26, 2023

Tratcher Apr 27, 2023

Tratcher Apr 27, 2023

Tratcher Apr 27, 2023

Tratcher Apr 27, 2023

Tratcher Apr 27, 2023

Tratcher Apr 27, 2023

halter73 Apr 27, 2023

Tratcher Apr 28, 2023

Tratcher Apr 27, 2023 •

edited

Loading

Tratcher Apr 27, 2023


		var ticket = BearerTokenProtector.Unprotect(token);

		if (ticket?.Properties?.ExpiresUtc is null)

	if (options.TicketDataFormat == null)
	{
	// Note: the purpose for the data protector must remain fixed for interop to work.
	var dataProtector = options.DataProtectionProvider.CreateProtector("Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationMiddleware", name, "v2");
	options.TicketDataFormat = new TicketDataFormat(dataProtector);

Add MapIdentityApi<TUser>() #47414

Add MapIdentityApi<TUser>() #47414

Conversation

halter73 commented Mar 25, 2023

ghost commented Apr 13, 2023

javiercn left a comment

Choose a reason for hiding this comment

halter73 commented Apr 26, 2023

github-actions bot commented Apr 26, 2023

github-actions bot commented Apr 26, 2023

github-actions bot commented Apr 26, 2023

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Tratcher Apr 27, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Tratcher Apr 27, 2023 •

edited

Loading