MusicStore => Auth 2.0

This commit is contained in:
Hao Kung 2017-04-19 12:00:39 -07:00
parent 229d817d83
commit 4237a93ee8
12 changed files with 181 additions and 179 deletions

View File

@ -1,9 +1,9 @@
using System.Linq;
using System.Security.Claims;
using System.Threading.Tasks;
using Microsoft.AspNetCore.Authentication;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Hosting;
using Microsoft.AspNetCore.Http.Authentication;
using Microsoft.AspNetCore.Identity;
using Microsoft.AspNetCore.Mvc;
using Microsoft.AspNetCore.Mvc.Rendering;

View File

@ -1,6 +1,7 @@
using System.Linq;
using System.Security.Claims;
using System.Threading.Tasks;
using Microsoft.AspNetCore.Authentication;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Identity;
using Microsoft.AspNetCore.Mvc;
@ -13,16 +14,20 @@ namespace MusicStore.Controllers
{
public ManageController(
UserManager<ApplicationUser> userManager,
SignInManager<ApplicationUser> signInManager)
SignInManager<ApplicationUser> signInManager,
IAuthenticationSchemeProvider schemes)
{
UserManager = userManager;
SignInManager = signInManager;
SchemeProvider = schemes;
}
public UserManager<ApplicationUser> UserManager { get; }
public SignInManager<ApplicationUser> SignInManager { get; }
public IAuthenticationSchemeProvider SchemeProvider { get; }
//
// GET: /Manage/Index
public async Task<ActionResult> Index(ManageMessageId? message = null)
@ -285,7 +290,8 @@ namespace MusicStore.Controllers
return View("Error");
}
var userLogins = await UserManager.GetLoginsAsync(user);
var otherLogins = SignInManager.GetExternalAuthenticationSchemes().Where(auth => userLogins.All(ul => auth.AuthenticationScheme != ul.LoginProvider)).ToList();
var schemes = await SchemeProvider.GetAllSchemesAsync();
var otherLogins = schemes.Where(auth => userLogins.All(ul => auth.Name != ul.LoginProvider)).ToList();
ViewBag.ShowRemoveButton = user.PasswordHash != null || userLogins.Count > 1;
return View(new ManageLoginsViewModel
{

View File

@ -1,5 +1,4 @@
using Microsoft.AspNetCore.Authentication;
using Microsoft.AspNetCore.Http.Authentication;
using Newtonsoft.Json;
namespace MusicStore.Mocks.Common

View File

@ -58,6 +58,29 @@ namespace MusicStore
.AddEntityFrameworkStores<MusicStoreContext>()
.AddDefaultTokenProviders();
// Create an Azure Active directory application and copy paste the following
services.AddOpenIdConnectAuthentication(options =>
{
options.Authority = "https://login.windows.net/[tenantName].onmicrosoft.com";
options.ClientId = "c99497aa-3ee2-4707-b8a8-c33f51323fef";
options.BackchannelHttpHandler = new OpenIdConnectBackChannelHttpHandler();
options.StringDataFormat = new CustomStringDataFormat();
options.StateDataFormat = new CustomStateDataFormat();
options.ResponseType = OpenIdConnectResponseType.CodeIdToken;
options.UseTokenLifetime = false;
options.TokenValidationParameters.ValidateLifetime = false;
options.ProtocolValidator.RequireNonce = true;
options.ProtocolValidator.NonceLifetime = TimeSpan.FromDays(36500);
options.Events = new OpenIdConnectEvents
{
OnMessageReceived = TestOpenIdConnectEvents.MessageReceived,
OnAuthorizationCodeReceived = TestOpenIdConnectEvents.AuthorizationCodeReceived,
OnRedirectToIdentityProvider = TestOpenIdConnectEvents.RedirectToIdentityProvider,
OnTokenValidated = TestOpenIdConnectEvents.TokenValidated,
};
});
services.AddCors(options =>
{
options.AddPolicy("CorsPolicy", builder =>
@ -105,32 +128,8 @@ namespace MusicStore
// Add static files to the request pipeline
app.UseStaticFiles();
// Add cookie-based authentication to the request pipeline
app.UseIdentity();
// Create an Azure Active directory application and copy paste the following
var options = new OpenIdConnectOptions
{
Authority = "https://login.windows.net/[tenantName].onmicrosoft.com",
ClientId = "c99497aa-3ee2-4707-b8a8-c33f51323fef",
BackchannelHttpHandler = new OpenIdConnectBackChannelHttpHandler(),
StringDataFormat = new CustomStringDataFormat(),
StateDataFormat = new CustomStateDataFormat(),
ResponseType = OpenIdConnectResponseType.CodeIdToken,
UseTokenLifetime = false,
Events = new OpenIdConnectEvents
{
OnMessageReceived = TestOpenIdConnectEvents.MessageReceived,
OnAuthorizationCodeReceived = TestOpenIdConnectEvents.AuthorizationCodeReceived,
OnRedirectToIdentityProvider = TestOpenIdConnectEvents.RedirectToIdentityProvider,
OnTokenValidated = TestOpenIdConnectEvents.TokenValidated,
}
};
options.TokenValidationParameters.ValidateLifetime = false;
options.ProtocolValidator.RequireNonce = true;
options.ProtocolValidator.NonceLifetime = TimeSpan.FromDays(36500);
app.UseOpenIdConnectAuthentication(options);
// Add authentication to the request pipeline
app.UseAuthentication();
// Add MVC to the request pipeline
app.UseMvc(routes =>

View File

@ -6,6 +6,7 @@ using Microsoft.AspNetCore.Builder;
using Microsoft.AspNetCore.Diagnostics.EntityFrameworkCore;
using Microsoft.AspNetCore.Hosting;
using Microsoft.AspNetCore.Http;
using Microsoft.AspNetCore.Identity;
using Microsoft.AspNetCore.Identity.EntityFrameworkCore;
using Microsoft.EntityFrameworkCore;
using Microsoft.Extensions.Caching.Memory;
@ -59,13 +60,12 @@ namespace MusicStore
}
// Add Identity services to the services container
services.AddIdentity<ApplicationUser, IdentityRole>(options =>
{
options.Cookies.ApplicationCookie.AccessDeniedPath = new PathString("/Home/AccessDenied");
})
services.AddIdentity<ApplicationUser, IdentityRole>()
.AddEntityFrameworkStores<MusicStoreContext>()
.AddDefaultTokenProviders();
services.ConfigureApplicationCookie(options => options.AccessDeniedPath = "/Home/AccessDenied");
services.AddCors(options =>
{
options.AddPolicy("CorsPolicy", builder =>
@ -93,6 +93,70 @@ namespace MusicStore
{
options.AddPolicy("ManageStore", new AuthorizationPolicyBuilder().RequireClaim("ManageStore", "Allowed").Build());
});
services.AddFacebookAuthentication(options =>
{
options.AppId = "[AppId]";
options.AppSecret = "[AppSecret]";
options.Events = new OAuthEvents()
{
OnCreatingTicket = TestFacebookEvents.OnCreatingTicket,
OnTicketReceived = TestFacebookEvents.OnTicketReceived,
OnRedirectToAuthorizationEndpoint = TestFacebookEvents.RedirectToAuthorizationEndpoint
};
options.BackchannelHttpHandler = new FacebookMockBackChannelHttpHandler();
options.StateDataFormat = new CustomStateDataFormat();
options.Scope.Add("email");
options.Scope.Add("read_friendlists");
options.Scope.Add("user_checkins");
});
services.AddGoogleAuthentication(options =>
{
options.ClientId = "[ClientId]";
options.ClientSecret = "[ClientSecret]";
options.AccessType = "offline";
options.Events = new OAuthEvents()
{
OnCreatingTicket = TestGoogleEvents.OnCreatingTicket,
OnTicketReceived = TestGoogleEvents.OnTicketReceived,
OnRedirectToAuthorizationEndpoint = TestGoogleEvents.RedirectToAuthorizationEndpoint
};
options.StateDataFormat = new CustomStateDataFormat();
options.BackchannelHttpHandler = new GoogleMockBackChannelHttpHandler();
});
services.AddTwitterAuthentication(options =>
{
options.ConsumerKey = "[ConsumerKey]";
options.ConsumerSecret = "[ConsumerSecret]";
options.Events = new TwitterEvents()
{
OnCreatingTicket = TestTwitterEvents.OnCreatingTicket,
OnTicketReceived = TestTwitterEvents.OnTicketReceived,
OnRedirectToAuthorizationEndpoint = TestTwitterEvents.RedirectToAuthorizationEndpoint
};
options.StateDataFormat = new CustomTwitterStateDataFormat();
options.BackchannelHttpHandler = new TwitterMockBackChannelHttpHandler();
});
services.AddMicrosoftAccountAuthentication(options =>
{
options.DisplayName = "MicrosoftAccount - Requires project changes";
options.ClientId = "[ClientId]";
options.ClientSecret = "[ClientSecret]";
options.Events = new OAuthEvents()
{
OnCreatingTicket = TestMicrosoftAccountEvents.OnCreatingTicket,
OnTicketReceived = TestMicrosoftAccountEvents.OnTicketReceived,
OnRedirectToAuthorizationEndpoint = TestMicrosoftAccountEvents.RedirectToAuthorizationEndpoint
};
options.BackchannelHttpHandler = new MicrosoftAccountMockBackChannelHandler();
options.StateDataFormat = new CustomStateDataFormat();
options.Scope.Add("wl.basic");
options.Scope.Add("wl.signin");
});
}
public void Configure(IApplicationBuilder app, ILoggerFactory loggerFactory)
@ -114,67 +178,7 @@ namespace MusicStore
app.UseStaticFiles();
// Add cookie-based authentication to the request pipeline
app.UseIdentity();
app.UseFacebookAuthentication(new FacebookOptions
{
AppId = "[AppId]",
AppSecret = "[AppSecret]",
Events = new OAuthEvents()
{
OnCreatingTicket = TestFacebookEvents.OnCreatingTicket,
OnTicketReceived = TestFacebookEvents.OnTicketReceived,
OnRedirectToAuthorizationEndpoint = TestFacebookEvents.RedirectToAuthorizationEndpoint
},
BackchannelHttpHandler = new FacebookMockBackChannelHttpHandler(),
StateDataFormat = new CustomStateDataFormat(),
Scope = { "email", "read_friendlists", "user_checkins" }
});
app.UseGoogleAuthentication(new GoogleOptions
{
ClientId = "[ClientId]",
ClientSecret = "[ClientSecret]",
AccessType = "offline",
Events = new OAuthEvents()
{
OnCreatingTicket = TestGoogleEvents.OnCreatingTicket,
OnTicketReceived = TestGoogleEvents.OnTicketReceived,
OnRedirectToAuthorizationEndpoint = TestGoogleEvents.RedirectToAuthorizationEndpoint
},
StateDataFormat = new CustomStateDataFormat(),
BackchannelHttpHandler = new GoogleMockBackChannelHttpHandler()
});
app.UseTwitterAuthentication(new TwitterOptions
{
ConsumerKey = "[ConsumerKey]",
ConsumerSecret = "[ConsumerSecret]",
Events = new TwitterEvents()
{
OnCreatingTicket = TestTwitterEvents.OnCreatingTicket,
OnTicketReceived = TestTwitterEvents.OnTicketReceived,
OnRedirectToAuthorizationEndpoint = TestTwitterEvents.RedirectToAuthorizationEndpoint
},
StateDataFormat = new CustomTwitterStateDataFormat(),
BackchannelHttpHandler = new TwitterMockBackChannelHttpHandler()
});
app.UseMicrosoftAccountAuthentication(new MicrosoftAccountOptions
{
DisplayName = "MicrosoftAccount - Requires project changes",
ClientId = "[ClientId]",
ClientSecret = "[ClientSecret]",
Events = new OAuthEvents()
{
OnCreatingTicket = TestMicrosoftAccountEvents.OnCreatingTicket,
OnTicketReceived = TestMicrosoftAccountEvents.OnTicketReceived,
OnRedirectToAuthorizationEndpoint = TestMicrosoftAccountEvents.RedirectToAuthorizationEndpoint
},
BackchannelHttpHandler = new MicrosoftAccountMockBackChannelHandler(),
StateDataFormat = new CustomStateDataFormat(),
Scope = { "wl.basic", "wl.signin" }
});
app.UseAuthentication();
// Add MVC to the request pipeline
app.UseMvc(routes =>

View File

@ -1,6 +1,6 @@
using System.Collections.Generic;
using System.ComponentModel.DataAnnotations;
using Microsoft.AspNetCore.Http.Authentication;
using Microsoft.AspNetCore.Authentication;
using Microsoft.AspNetCore.Identity;
using Microsoft.AspNetCore.Mvc.Rendering;
@ -18,7 +18,7 @@ namespace MusicStore.Models
public class ManageLoginsViewModel
{
public IList<UserLoginInfo> CurrentLogins { get; set; }
public IList<AuthenticationDescription> OtherLogins { get; set; }
public IList<AuthenticationScheme> OtherLogins { get; set; }
}
public class FactorViewModel

View File

@ -1,5 +1,6 @@
using Microsoft.AspNetCore.Builder;
using Microsoft.AspNetCore.Hosting;
using Microsoft.AspNetCore.Identity;
using Microsoft.AspNetCore.Identity.EntityFrameworkCore;
using Microsoft.EntityFrameworkCore;
using Microsoft.Extensions.Configuration;
@ -48,13 +49,11 @@ namespace MusicStore
}
// Add Identity services to the services container
services.AddIdentity<ApplicationUser, IdentityRole>(options =>
{
options.Cookies.ApplicationCookie.AccessDeniedPath = "/Home/AccessDenied";
})
services.AddIdentity<ApplicationUser, IdentityRole>()
.AddEntityFrameworkStores<MusicStoreContext>()
.AddDefaultTokenProviders();
services.ConfigureApplicationCookie(options => options.AccessDeniedPath = "/Home/AccessDenied");
services.AddCors(options =>
{
@ -89,6 +88,45 @@ namespace MusicStore
authBuilder.RequireClaim("ManageStore", "Allowed");
});
});
services.AddFacebookAuthentication(options =>
{
options.AppId = "550624398330273";
options.AppSecret = "10e56a291d6b618da61b1e0dae3a8954";
});
services.AddGoogleAuthentication(options =>
{
options.ClientId = "995291875932-0rt7417v5baevqrno24kv332b7d6d30a.apps.googleusercontent.com";
options.ClientSecret = "J_AT57H5KH_ItmMdu0r6PfXm";
});
services.AddTwitterAuthentication(options =>
{
options.ConsumerKey = "lDSPIu480ocnXYZ9DumGCDw37";
options.ConsumerSecret = "fpo0oWRNc3vsZKlZSq1PyOSoeXlJd7NnG4Rfc94xbFXsdcc3nH";
});
// The MicrosoftAccount service has restrictions that prevent the use of
// http://localhost:5001/ for test applications.
// As such, here is how to change this sample to uses http://ktesting.com:5001/ instead.
// From an admin command console first enter:
// notepad C:\Windows\System32\drivers\etc\hosts
// and add this to the file, save, and exit (and reboot?):
// 127.0.0.1 ktesting.com
// Then you can choose to run the app as admin (see below) or add the following ACL as admin:
// netsh http add urlacl url=http://ktesting:5001/ user=[domain\user]
// The sample app can then be run via:
// dnx . web
services.AddMicrosoftAccountAuthentication(options =>
{
options.DisplayName = "MicrosoftAccount - Requires project changes";
options.ClientId = "000000004012C08A";
options.ClientSecret = "GaMQ2hCnqAC6EcDLnXsAeBVIJOLmeutL";
});
}
//This method is invoked when ASPNETCORE_ENVIRONMENT is 'Development' or is not defined
@ -146,46 +184,7 @@ namespace MusicStore
app.UseStaticFiles();
// Add cookie-based authentication to the request pipeline
app.UseIdentity();
app.UseFacebookAuthentication(new FacebookOptions
{
AppId = "550624398330273",
AppSecret = "10e56a291d6b618da61b1e0dae3a8954"
});
app.UseGoogleAuthentication(new GoogleOptions
{
ClientId = "995291875932-0rt7417v5baevqrno24kv332b7d6d30a.apps.googleusercontent.com",
ClientSecret = "J_AT57H5KH_ItmMdu0r6PfXm"
});
app.UseTwitterAuthentication(new TwitterOptions
{
ConsumerKey = "lDSPIu480ocnXYZ9DumGCDw37",
ConsumerSecret = "fpo0oWRNc3vsZKlZSq1PyOSoeXlJd7NnG4Rfc94xbFXsdcc3nH"
});
// The MicrosoftAccount service has restrictions that prevent the use of
// http://localhost:5001/ for test applications.
// As such, here is how to change this sample to uses http://ktesting.com:5001/ instead.
// From an admin command console first enter:
// notepad C:\Windows\System32\drivers\etc\hosts
// and add this to the file, save, and exit (and reboot?):
// 127.0.0.1 ktesting.com
// Then you can choose to run the app as admin (see below) or add the following ACL as admin:
// netsh http add urlacl url=http://ktesting:5001/ user=[domain\user]
// The sample app can then be run via:
// dnx . web
app.UseMicrosoftAccountAuthentication(new MicrosoftAccountOptions
{
DisplayName = "MicrosoftAccount - Requires project changes",
ClientId = "000000004012C08A",
ClientSecret = "GaMQ2hCnqAC6EcDLnXsAeBVIJOLmeutL"
});
app.UseAuthentication();
// Add MVC to the request pipeline
app.UseMvc(routes =>

View File

@ -101,6 +101,14 @@ namespace MusicStore
authBuilder.RequireClaim("ManageStore", "Allowed");
});
});
// Create an Azure Active directory application and copy paste the following
services.AddOpenIdConnectAuthentication(options =>
{
options.Authority = "https://login.windows.net/[tenantName].onmicrosoft.com";
options.ClientId = "[ClientId]";
options.ResponseType = OpenIdConnectResponseType.CodeIdToken;
});
}
public void Configure(IApplicationBuilder app, ILoggerFactory loggerFactory)
@ -121,17 +129,6 @@ namespace MusicStore
// Add static files to the request pipeline
app.UseStaticFiles();
// Add cookie-based authentication to the request pipeline
app.UseIdentity();
// Create an Azure Active directory application and copy paste the following
app.UseOpenIdConnectAuthentication(new OpenIdConnectOptions
{
Authority = "https://login.windows.net/[tenantName].onmicrosoft.com",
ClientId = "[ClientId]",
ResponseType = OpenIdConnectResponseType.CodeIdToken,
});
// Add MVC to the request pipeline
app.UseMvc(routes =>
{

View File

@ -1,9 +1,11 @@
@model ExternalLoginListViewModel
@inject SignInManager<ApplicationUser> SignInManager
@using Microsoft.AspNetCore.Authentication
@model ExternalLoginListViewModel
@inject IAuthenticationSchemeProvider SchemeProvider
<h4>Use another service to log in.</h4>
<hr />
@{
var loginProviders = SignInManager.GetExternalAuthenticationSchemes();
var schemes = await SchemeProvider.GetAllSchemesAsync();
var loginProviders = schemes.ToList();
if (!loginProviders.Any())
{
<div>
@ -20,7 +22,7 @@
<p>
@foreach (var p in loginProviders)
{
<button type="submit" class="btn btn-default" id="@p.AuthenticationScheme" name="provider" value="@p.AuthenticationScheme" title="Log in using your @p.DisplayName account">@p.AuthenticationScheme</button>
<button type="submit" class="btn btn-default" id="@p.Name" name="provider" value="@p.Name" title="Log in using your @p.Name account">@p.Name</button>
}
</p>
</div>

View File

@ -45,7 +45,7 @@
<p>
@foreach (var p in Model.OtherLogins)
{
<button type="submit" class="btn btn-default" id="@p.AuthenticationScheme" name="provider" value="@p.AuthenticationScheme" title="Log in using your @p.DisplayName account">@p.AuthenticationScheme</button>
<button type="submit" class="btn btn-default" id="@p.Name" name="provider" value="@p.Name" title="Log in using your @p.Name account">@p.Name</button>
}
</p>
</div>

View File

@ -2,12 +2,13 @@ using System;
using System.Collections.Generic;
using System.Security.Claims;
using System.Threading.Tasks;
using Microsoft.AspNetCore.Authentication;
using Microsoft.AspNetCore.Http;
using Microsoft.AspNetCore.Http.Features.Authentication;
using Microsoft.AspNetCore.Identity;
using Microsoft.AspNetCore.Identity.EntityFrameworkCore;
using Microsoft.AspNetCore.Mvc;
using Microsoft.EntityFrameworkCore;
using Microsoft.Extensions.Configuration;
using Microsoft.Extensions.DependencyInjection;
using MusicStore.Models;
using Xunit;
@ -23,6 +24,7 @@ namespace MusicStore.Controllers
var efServiceProvider = new ServiceCollection().AddEntityFrameworkInMemoryDatabase().BuildServiceProvider();
var services = new ServiceCollection();
services.AddSingleton<IConfiguration>(new ConfigurationBuilder().Build());
services.AddOptions();
services
.AddDbContext<MusicStoreContext>(b => b.UseInMemoryDatabase("Scratch").UseInternalServiceProvider(efServiceProvider));
@ -30,12 +32,12 @@ namespace MusicStore.Controllers
services.AddIdentity<ApplicationUser, IdentityRole>()
.AddEntityFrameworkStores<MusicStoreContext>();
services.AddMvc();
services.AddSingleton<IAuthenticationService, NoOpAuth>();
services.AddLogging();
services.AddOptions();
// IHttpContextAccessor is required for SignInManager, and UserManager
var context = new DefaultHttpContext();
context.Features.Set<IHttpAuthenticationFeature>(new HttpAuthenticationFeature() { Handler = new TestAuthHandler() });
services.AddSingleton<IHttpContextAccessor>(
new HttpContextAccessor()
{
@ -63,8 +65,11 @@ namespace MusicStore.Controllers
var httpContext = _serviceProvider.GetRequiredService<IHttpContextAccessor>().HttpContext;
httpContext.User = new ClaimsPrincipal(new ClaimsIdentity(claims));
var controller = new ManageController(userManager, signInManager);
httpContext.RequestServices = _serviceProvider;
var schemeProvider = _serviceProvider.GetRequiredService<IAuthenticationSchemeProvider>();
var controller = new ManageController(userManager, signInManager, schemeProvider);
controller.ControllerContext.HttpContext = httpContext;
// Act
@ -83,38 +88,28 @@ namespace MusicStore.Controllers
Assert.True(model.HasPassword);
}
private class TestAuthHandler : IAuthenticationHandler
public class NoOpAuth : IAuthenticationService
{
public void Authenticate(AuthenticateContext context)
public Task<AuthenticateResult> AuthenticateAsync(HttpContext context, string scheme)
{
context.NotAuthenticated();
return Task.FromResult(AuthenticateResult.None());
}
public Task AuthenticateAsync(AuthenticateContext context)
public Task ChallengeAsync(HttpContext context, string scheme, AuthenticationProperties properties, ChallengeBehavior behavior)
{
context.NotAuthenticated();
return Task.FromResult(0);
}
public Task ChallengeAsync(ChallengeContext context)
public Task SignInAsync(HttpContext context, string scheme, ClaimsPrincipal principal, AuthenticationProperties properties)
{
throw new NotImplementedException();
}
public void GetDescriptions(DescribeSchemesContext context)
{
throw new NotImplementedException();
}
public Task SignInAsync(SignInContext context)
{
throw new NotImplementedException();
}
public Task SignOutAsync(SignOutContext context)
public Task SignOutAsync(HttpContext context, string scheme, AuthenticationProperties properties)
{
throw new NotImplementedException();
}
}
}
}

View File

@ -12,6 +12,7 @@
</ItemGroup>
<ItemGroup>
<PackageReference Include="Microsoft.AspNetCore.Authentication.Core" Version="$(AspNetCoreVersion)" />
<PackageReference Include="Microsoft.Extensions.Logging.Testing" Version="$(AspNetCoreVersion)" />
<PackageReference Include="Microsoft.NET.Test.Sdk" Version="$(TestSdkVersion)" />
<PackageReference Include="System.Globalization.Extensions" Version="$(CoreFxVersion)" />