Commit Graph

246 Commits

Author SHA1 Message Date
John Luo 098be5f5ee
Use LDAP support from DirectoryServices.Protocols for RBAC claim resolution on Linux for Negotiate (#25075) 2020-08-25 13:21:46 -07:00
Chris Ross e5ab127f74
Update OAuth providers #4684 (#25112) 2020-08-23 17:04:43 -07:00
Martin Costello b22512de0e
Right-size Lists when created (#23714)
Create new instances of List<T> with an appropriate capacity for the items that will be added.
Use Array.Empty<T>() where appropriate, rather than create an empty list and then return it.
2020-08-19 09:45:52 -07:00
John Luo cfe158cbed
Convert DatabaseErrorPage to exception filter (#24588)
* Convert DatabaseErrorPage middleware to exception filter
2020-08-17 11:13:17 -07:00
John Luo eb1d6aec16
Update exception handling condition in WsFederationHandler (#24886)
Fixes
2020-08-13 22:48:04 +00:00
Hao Kung fae4a56ff6
Add MapInboundClaims top level sugar for JwtBearerOptions (#24636)
* Add MapInboundClaims option

* Update JwtBearerOptions.cs

* Update JwtBearerTests.cs

* Update JwtBearerOptions.cs

* Update JwtBearerOptions.cs

* Update JwtBearerTests.cs

* Add MapImboundClaims to OIDC

* Update OpenIdConnectTests.cs

* Update OpenIdConnectOptions.cs

* Update OpenIdConnectOptions.cs

* Use MapInboundClaims

* Update OpenIdConnectTests.cs
2020-08-13 22:44:10 +00:00
Levi Broderick bbf7c8780c
Clean up some usage of SHA1 and SHA256 in the code base (#24696)
* AntiForgery: Use SHA256 one-shot

* AuthN: Use SHA256 one-shot APIs

* MVC/Razor: Cleanup SHA256 references

* WebSockets: Use SHA1 one-shots

* dotnet-openapi: Use preferred SHA256 factory

* SignalR: Prefer RNG.Fill over RNG.GetBytes
2020-08-10 14:26:41 -07:00
David Fowler 0e592df3ec
Make authentication linker friendly (#24708)
* Make authentication linker friendly
- Preserve constructors wherever open generics or type arguments exist
2020-08-10 13:06:19 -07:00
Pranav K 3e1e69ecce
Add nullable annotations to Authenticator.Core & Authentication.Cookies (#24307)
Contributes to https://github.com/dotnet/aspnetcore/issues/5680
2020-07-30 17:09:14 -07:00
Kahbazi 6097145096
[Security] Move to GenericHost (#24282) 2020-07-27 13:09:15 -07:00
Hao Kung 697b397b9b
Revert AuthenticationAddXyz overload changes (#24253) 2020-07-23 15:00:01 -07:00
Doug Bunting 5266918ed2
Use Roslyn to create ref/ assemblies (#23403)
* Remove all ref/ projects

* Remove GenAPI infrastructure

* Remove notion of a reference assembly project
  - remove `$(IsReferenceAssemblyProject)`, `$(ReferenceReferenceAssemblies)` and `$(ReferenceImplementationAssemblies)`
    - remove unnecessary `$(NoWarn)` settings

nits:
- remove a few misleading comments
- wrap some long lines

* Move .0 package version workaround into Versions.props
  - touch up SharedFramework.External.props

* Expose `%(LatestPackageReference.RTMVersion)` metadata
  - automate use of properties in the `@(LatestPackageReference)` item group to make this maintainable
    - add a couple of special cases at the bottom of eng/Dependencies.props
    - add one more `$(...PackageVersion)` property to avoid yet-another special case

* Enable Roslyn reference assemblies
  - exclude ref/ assembly from packages other than targeting pack
  - update Microsoft.AspNetCore.App.Ref.csproj
    - `%(IsReferenceAssembly)` and `%(ReferenceGrouping)` metadata no longer relevant
    - only ref/ assemblies are in `@(ReferencePathWithRefAssemblies)` item group

nits:
  - remove now-unnecessary workaround
    - issues with TFM transition are behind us
  - clean up Microsoft.AspNetCore.App.Runtime.csproj slightly
    - use `GeneratePathProperty="true"`
        - reorder item / property settings for meta-expansion
    - correct spelling errors and phrasing in comments

* Update documentation to reflect recent changes
  - remove CrossRepoBreakingChanges.md; was tied to old TeamCity infrastructure
    - also much less relevant given repo merges
  - adjust details and examples in ReferenceResolution.md
    - reflect repo merges, Dependencies.props changes, and current Maestro++ channels
    - add a few more details e.g. specific files where Version.Details.xml versions are used

* !fixup! Remove another irrelevant doc file

* !fixup! Address PR review suggestions
  - convert a couple of warnings to errors
  - use consistent casing for Microsoft.NETCore.App.Runtime.* packages
  - reduce `%(LatestPackageReference.Version)` metadata special cases
  - add and improve comments e.g.
    - improve comments about `$(*V0PackageVersion)` properties
    - improve placement of comments about item removal in ResolveReferences.targets
    - confirmed `$(*V0PackageVersion)` property list is complete

nits:
- fix solution example in ReferenceResolution.md
- remove item group definition for `@(LatestPackageReference)`
- remove `%(LatestPackageReference.VersionName)` metadata after use; large item group
    - similarly, remove `%(LatestPackageReference.RTMVersion)` when not needed; just complicates `Condition`s

When I squash, I must remember this fixes
- #14801
- dotnet/aspnetcore-internal#2693

* Actually use `%(LatestPackageReference.RTMVersion)` metadata
  - gather RTM package references in a new project
    - a (very) separate project to work around package conflict resolution
    - empty `Test` target works around Arcade's testing approach
  - new target in ResolveReferences.targets updates relevant assembly paths to use the RTM packages
    - done as soon as possible after `ResolvePackageAssets` determines the paths
    - done for all compilation inputs, not just ref/ assemblies
2020-07-17 13:35:17 -07:00
Hao Kung fae3dd12ae
Switch to new host apis (#23783)
* Update tests

* Switch to new host apis

* Update host apis

* Update CookieTests.cs

* Update tests

* PR feedback/cleanup

* More cleanup
2020-07-11 00:56:18 +00:00
Kevin Pilch 3117f43c33
Migrate to single sln file + slnf files (#23581) 2020-07-08 15:27:22 -07:00
Pranav K 93634cd772
Follow ups for nullable (#23736)
* Follow ups for nullable

* Update src/Http/Routing/src/Matching/DfaMatcherBuilder.cs

Co-authored-by: James Newton-King <james@newtonking.com>

Co-authored-by: James Newton-King <james@newtonking.com>
2020-07-07 21:46:50 +00:00
Kahbazi 5a375a7c22
Add Extensions method for options (#23602) 2020-07-06 11:54:44 -07:00
Pranav K 9a4e6cf97c
Merge remote-tracking branch 'origin/release/5.0-preview7' 2020-07-02 11:42:14 -07:00
Hans Bakker 5db89514e8
Allow extensibility of DefaultAuthorizationService (#23143)
* Allow extensibility of DefaultAuthorizationService

When only a small behavior change of the `DefaultAuthorizationService` is wanted, it would be nice if you could override its methods and building upon them rather than having a copy-paste of the class in your codebase.

Inside the `override` methods in your inherited class you could call the `base` method to reuse parts of its logic.

Please refer to https://github.com/dotnet/aspnetcore/issues/23094 for the usecase.

* updated ref assembly
2020-06-30 17:06:00 -07:00
Ajay Bhargav B 7f4b846e9f
Made the encodings of .razor and .cshtml files in the repo consistent (#23502)
* Added UTF8 BOMs to .razor and .cshtml files

* Fixes and unquarantined BOM tests

* Update .editorconfig
2020-06-30 12:03:01 -07:00
Hao Kung 1c27ba1bbd
Add compat switch to opt out of breaking change in AuthZ (#23324) 2020-06-29 21:50:27 -07:00
Hao Kung be0b9e48b5
Update System.IdentityModel.Tokens.Jwt to 6.6 (#22846)
* Update System.IdentityModel.Tokens.Jwt to 6.6

* Update Versions.props

* Add newtonsoft refs

* Update OIDC instructions

* Fixup JwtBearerSample TFM

Co-authored-by: John Luo <johluo@microsoft.com>
2020-06-25 14:25:59 -07:00
Hao Kung 8541bf6c98
Flow endpoint and httpcontext always from authz middleware (#22672) 2020-06-19 18:14:47 -07:00
Pranav K f3b370c1ac
Annotate Authorization.Core, Authorization.Policy with nullable (#22990)
Contributes to https://github.com/dotnet/aspnetcore/issues/5680
2020-06-18 23:43:35 +00:00
Doug Bunting c4c6e25a06
Add missing doc files and cleanup nits (#22931)
* nit: Remove useless `$(HasReferenceAssembly)` settings
  - set in /Directory.Build.targets
    - `true` only in `$(IsAspNetCoreApp)` projects
* nit: Remove useless `$(CompileUsingReferenceAssemblies)` settings
  - no current versioning differences between ref/ and src/ assemblies when targeting default TFM
* Add more `$(GenerateDocumentationFile)` settings
  - increases the number of generated doc files, mostly without problems
- !fixup! correct typo in `DebugProxyHost` doc comments
    - was not generating a doc file before
  - remove previous (ineffective) src/Components/Directory.Build.targets setting
  - nit: remove a duplicate `$(GenerateDocumentationFile)` setting
* nit: Remove useless `$(IsPackable)` settings
  - only analyzers and implementation projects are packable by default
    - main use case for explicit setting is projects shipping only in shared framework
  - conditional setting in src/Mvc/Directory.Build.props just subset logic in /Directory.Build.targets
* nit: Remove useless `$(IsProjectReferenceProvider)` settings
  - only implementation projects are providers by default
* nit: Remove useless `$(IsTestAssetProject)` settings
  - set in src/Mvc/test/WebSites/Directory.Build.props
* !fixup! Looks like `InProcessNewShimWebSite` must compile w/o ref/ assemblies
  - restore `$(CompileUsingReferenceAssemblies)` in this one project
2020-06-17 13:04:45 -07:00
Hao Kung c330c0b37d
Cookie renew ticket if it already exists (#22732) 2020-06-16 14:51:57 -07:00
Hao Kung ef5ab43b6f
Use redirect helper (#22847) 2020-06-15 11:34:56 -07:00
John Luo ef9a3662d6
Also set no-store when we set no-cache in response cache control headers (#22842) 2020-06-11 20:38:54 -07:00
Smit Patel 3cdc7164e7 Add pragma disable to older migration files
Resolves #22630
2020-06-07 11:17:45 -07:00
Smit Patel a963bbebf9 Add obsolete disable in older model snapshot
Revert to using older API

Resolves #22610
2020-06-06 12:01:31 -07:00
Hao Kung 8e4dadc0dd
Add certificate validation cache (#21847) 2020-06-05 00:58:47 -07:00
Chris Ross 2bf3960dea
Optional client certificates sample (#21484)
* Add an optional client certs example

* Add the Challenge event

* PR cleanup
2020-06-05 01:34:21 +00:00
Doug Bunting 256045729a
Add `SuccessfulTests` to ensure something runs in every non-Helix run (#22406)
* Remove extra `[SkipOnHelix]` attribute
- only need the one compiled into Microsoft.AspNetCore.Testing
- update the documentation to reflect this
  - nit: address Markdown warnings that VS Code showed

* Add `SuccessfulTests` to ensure something runs in every non-Helix runs
- #22241
- cleans up hundreds of warnings but leaves a couple for the Blazor tests assembly
  - see comments about xUnit runner command line in the new class
2020-06-02 12:19:28 -07:00
Giuseppe Campanelli 78edd18524
Clean up logs for Negotiate Authentication and Authorization (#21927)
* Clean up logs for Negotiate Authentication and Authorization

* Add missing arg in NegotiateLoggingExtensions.cs

* Adjust formatting

* Remaining text changes

* Update src/Security/Authentication/Negotiate/src/Internal/NegotiateLoggingExtensions.cs

Co-authored-by: Chris Ross <Tratcher@Outlook.com>

* Update src/Security/Authentication/Negotiate/src/Internal/NegotiateLoggingExtensions.cs

Co-authored-by: Chris Ross <Tratcher@Outlook.com>

* Update src/Security/Authentication/Negotiate/src/NegotiateHandler.cs

Co-authored-by: Chris Ross <Tratcher@Outlook.com>

* Update src/Security/Authentication/Negotiate/src/Internal/NegotiateLoggingExtensions.cs

Co-authored-by: Chris Ross <Tratcher@Outlook.com>

* Apply changes to feedback committed

* Update logger call to refactored name

Co-authored-by: Chris Ross <Tratcher@Outlook.com>
Co-authored-by: Giuseppe Campanelli <campanelli_g@yahoo.com>
2020-05-19 15:59:29 +00:00
Dawid Szmidka 6c7a8bb397
Allow custom handling of authorization failures (with sample app) (#21117) 2020-05-19 00:56:21 -07:00
Kahbazi eff4e4bf52
Add AllowAnonymous extension method on IEndpointConventionBuilder (#21909) 2020-05-18 16:42:13 -07:00
Justin Kotalik 41eb22a0ac
Unquarantine tests (#21895)
* Unquarantine tests

* Update ShutdownTests.cs

* Update ShutdownTests.cs

* Update HubConnectionHandlerTests.cs

* Update src/SignalR/server/SignalR/test/HubConnectionHandlerTests.cs

Co-authored-by: Brennan <brecon@microsoft.com>

* Update HubConnectionTests.cs

Co-authored-by: Sébastien Ros <sebastienros@gmail.com>
Co-authored-by: Brennan <brecon@microsoft.com>
2020-05-18 19:04:48 +00:00
Christian Wenz 64a0d0396e
Upgrade jQuery in samples to version 3.5.1 (#21577)
Fixes #21572
2020-05-07 14:42:14 -07:00
Christian Wenz f1dcc59255
Update jQuery 2.2 and 3.3.1 in samples to 3.4.1 (#20356) 2020-04-25 11:26:43 -07:00
John Luo 84a04c9df1
Quarantining tests (#20631)
* Quarantining tests

* Namespace collision
2020-04-08 12:53:53 -07:00
Kahbazi 1f76cce14a
Add overloads to CookieAuthentication to config options with services (#19268)
* Add overloads to CookieAuthentication to config options with services

* Update reference assembly

* Use the new method in sampple

* Add overloads for other authentication providers

* Update ref assemblies

* Change IServiceProvider to TService
2020-04-06 21:23:49 +00:00
Andrew Stanton-Nurse 3f683916bc
unquarantine negotiate tests (#20378)
these were quarantined because of the runtime JIT bug that caused DI failures, they can come out of the box now that the runtime issue is fixed
2020-03-31 23:56:45 +00:00
Kevin Pilch f34033a415 Add .vsconfig files in root and beside slns 2020-03-31 14:25:44 -07:00
huysentruitw 16e2586724
Use Backchannel.DefaultRequestVersion in OAuth & OIDC requests #20096 (#20295) 2020-03-30 20:12:54 +00:00
Roman Marusyk 28de202a3b
Use the custom token endpoint if it's available in OIDC Handler (#20230) 2020-03-30 19:52:33 +00:00
Patrick Goode ae192af856
Make change for #18729 (#19756) 2020-03-17 22:22:28 +00:00
Andrew Stanton-Nurse 3b4be4f51a
Quarantining some tests (#19568) 2020-03-04 11:27:55 -08:00
Sedat Kapanoglu 7e139c9b5f
Add HeaderNames.XRequestedWith = "X-Requested-With" (#19470)
* Add HeaderNames.XRequestedWith = "X-Requested-With"

X-Requested-With is the standard for differentiating AJAX requests and is commonly used. Having this in HeaderNames would prevent typos related to typing this header name. I couldn't find any rationale about excluding this but there might be legitimate reasons like discouraging the use of HTTP headers or differentiating AJAX requests, etc. Please reject this if that's the case.

* Replace "X-Requested-With" references with HeaderNames.XRequestedWith

The only remaining instance is WebSocketsTransport.cs in
SignalR\clients\csharp\Http.Connections.Client which doesn't have
Microsoft.Net in its references. I didn't want to impose a new
dependency as its risky.

* Fix the order of using statements

* Add XRequestedWith to the ref assembly
2020-03-03 15:45:50 -08:00
Ryan Nowak 1360d6559e
Add AddOptions to AddAuthorizationCore (#18911)
Fixes: #18471

AddAuthorizationCore previously assumed that options were already
registered. This isn't the case in 5.0 in Blazor WASM.

We don't want Blazor to register options in the default host because it
prevents options from being linked out.

note: we will have some remaining work for this issue after this change
is merged. The Blazor WASM hosting changes haven't landed in master yet,
so we'll need to update that code to remove options from the host.
2020-02-25 21:57:19 +00:00
John Luo 5f9f1ce183 Merge branch 'master' into johluo/migrating-extensions 2020-02-20 16:44:06 -08:00
John Luo 7d1f5d8c0b Updates for extensions migrations
- Multi-target ObjectPool
- Move Embedded.Manifest.Task.Internal.Entry to the public namespace
- Remove ref assemblies from AspNetCore.Testing
- Skip TestPathUtilitiesTest since it's a pattern we want to migrate away from
- Fix FileProviders.Abstractions version in Embedded.*.nuspec
- Add workarounds for project references to FileProviders.Embedded
2020-02-20 14:00:29 -08:00