-
Notifications
You must be signed in to change notification settings - Fork 60
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Include a return URL in /Authenticate requests (#76)
Some auth scenarios (WS-Fed, OIDC) were having issues with remote app auth because, as part of authentication, they redirected to an external auth provider to log the user in. When the auth provider redirected back to the app, it would re-direct back to the ASP.NET app's /systemweb-adapters/authenticate endpoint (which the ASP.NET Core app calls to in order to authenticate the user) instead of to the actual endpoint in the ASP.NET Core app that the user was originally trying to get to. This PR fixes that by including the original request URL as a query string parameter when calling the authenticate endpoint (for example: https://localhost:4321/systemweb-adapters/authenticate?original-url=http://localhost:8765/SomeController/SomeAction (except that the original-url value is URL encoded)). Then, when the ASP.NET app handles request to /systemweb-adapters/authenticate, if no API key is provided (this is only present when called from the ASP.NET Core app), it will assume that the request may be a redirect back and if an original-url query string is present (the auth flows I tested all preserved the query string), the ASP.NET app will re-direct the request to that URL instead. This PR also adds an OIDC sample to demonstrate this scenario working. Fixes #72
- Loading branch information
Showing
59 changed files
with
3,096 additions
and
62 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
30 changes: 30 additions & 0 deletions
30
samples/RemoteAuth/OIDC/OIDCAuth/App_Start/BundleConfig.cs
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,30 @@ | ||
| using System.Web; | ||
| using System.Web.Optimization; | ||
|
|
||
| namespace OIDCAuth | ||
| { | ||
| public class BundleConfig | ||
| { | ||
| // For more information on bundling, visit https://go.microsoft.com/fwlink/?LinkId=301862 | ||
| public static void RegisterBundles(BundleCollection bundles) | ||
| { | ||
| bundles.Add(new ScriptBundle("~/bundles/jquery").Include( | ||
| "~/Scripts/jquery-{version}.min.js")); | ||
|
|
||
| bundles.Add(new ScriptBundle("~/bundles/jqueryval").Include( | ||
| "~/Scripts/jquery.validate*")); | ||
|
|
||
| // Use the development version of Modernizr to develop with and learn from. Then, when you're | ||
| // ready for production, use the build tool at https://modernizr.com to pick only the tests you need. | ||
| bundles.Add(new ScriptBundle("~/bundles/modernizr").Include( | ||
| "~/Scripts/modernizr-*")); | ||
|
|
||
| bundles.Add(new ScriptBundle("~/bundles/bootstrap").Include( | ||
| "~/Scripts/bootstrap.min.js")); | ||
|
|
||
| bundles.Add(new StyleBundle("~/Content/css").Include( | ||
| "~/Content/bootstrap.min.css", | ||
| "~/Content/site.css")); | ||
| } | ||
| } | ||
| } |
13 changes: 13 additions & 0 deletions
13
samples/RemoteAuth/OIDC/OIDCAuth/App_Start/FilterConfig.cs
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,13 @@ | ||
| using System.Web; | ||
| using System.Web.Mvc; | ||
|
|
||
| namespace OIDCAuth | ||
| { | ||
| public class FilterConfig | ||
| { | ||
| public static void RegisterGlobalFilters(GlobalFilterCollection filters) | ||
| { | ||
| filters.Add(new HandleErrorAttribute()); | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,23 @@ | ||
| using System; | ||
| using System.Collections.Generic; | ||
| using System.Linq; | ||
| using System.Web; | ||
| using System.Web.Mvc; | ||
| using System.Web.Routing; | ||
|
|
||
| namespace OIDCAuth | ||
| { | ||
| public class RouteConfig | ||
| { | ||
| public static void RegisterRoutes(RouteCollection routes) | ||
| { | ||
| routes.IgnoreRoute("{resource}.axd/{*pathInfo}"); | ||
|
|
||
| routes.MapRoute( | ||
| name: "Default", | ||
| url: "{controller}/{action}/{id}", | ||
| defaults: new { controller = "Home", action = "Index", id = UrlParameter.Optional } | ||
| ); | ||
| } | ||
| } | ||
| } |
66 changes: 66 additions & 0 deletions
66
samples/RemoteAuth/OIDC/OIDCAuth/App_Start/Startup.Auth.cs
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,66 @@ | ||
| using System; | ||
| using System.Configuration; | ||
| using System.Security.Claims; | ||
| using Microsoft.Owin.Security; | ||
| using Microsoft.Owin.Security.Cookies; | ||
| using Microsoft.Owin.Security.OpenIdConnect; | ||
| using Owin; | ||
|
|
||
| namespace OIDCAuth | ||
| { | ||
| public partial class Startup | ||
| { | ||
| private static string clientId = ConfigurationManager.AppSettings["ida:ClientId"]; | ||
| private static string clientSecret = ConfigurationManager.AppSettings["ida:ClientSecret"]; | ||
| private static string aadInstance = EnsureTrailingSlash(ConfigurationManager.AppSettings["ida:AADInstance"]); | ||
| private static string tenantId = ConfigurationManager.AppSettings["ida:TenantId"]; | ||
| private static string redirectUri = ConfigurationManager.AppSettings["ida:RedirectUri"]; | ||
| private static string policyName = ConfigurationManager.AppSettings["ida:PolicyName"]; | ||
| private static string scope = ConfigurationManager.AppSettings["ida:Scope"]; | ||
| private static string authority = aadInstance + tenantId + "/" + policyName; | ||
|
|
||
| public void ConfigureAuth(IAppBuilder app) | ||
| { | ||
| app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType); | ||
|
|
||
| app.UseCookieAuthentication(new CookieAuthenticationOptions()); | ||
|
|
||
| app.UseOpenIdConnectAuthentication( | ||
| new OpenIdConnectAuthenticationOptions | ||
| { | ||
| ClientId = clientId, | ||
| ClientSecret = clientSecret, | ||
| ResponseType = "id_token", | ||
| Scope = scope, | ||
| Authority = authority, | ||
| RedirectUri = redirectUri, | ||
|
|
||
| Notifications = new OpenIdConnectAuthenticationNotifications() | ||
| { | ||
| SecurityTokenValidated = (context) => | ||
| { | ||
| string name = context.AuthenticationTicket.Identity.FindFirst("name").Value; | ||
| context.AuthenticationTicket.Identity.AddClaim(new Claim(ClaimTypes.Name, name, string.Empty)); | ||
| return System.Threading.Tasks.Task.FromResult(0); | ||
| } | ||
| } | ||
| }); | ||
|
|
||
| } | ||
|
|
||
| private static string EnsureTrailingSlash(string value) | ||
| { | ||
| if (value == null) | ||
| { | ||
| value = string.Empty; | ||
| } | ||
|
|
||
| if (!value.EndsWith("/", StringComparison.Ordinal)) | ||
| { | ||
| return value + "/"; | ||
| } | ||
|
|
||
| return value; | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,30 @@ | ||
| body { | ||
| padding-top: 50px; | ||
| padding-bottom: 20px; | ||
| } | ||
|
|
||
| /* Set padding to keep content from hitting the edges */ | ||
| .body-content { | ||
| padding-left: 15px; | ||
| padding-right: 15px; | ||
| } | ||
|
|
||
| /* Override the default bootstrap behavior where horizontal description lists | ||
| will truncate terms that are too long to fit in the left column | ||
| */ | ||
| .dl-horizontal dt { | ||
| white-space: normal; | ||
| } | ||
|
|
||
| /* Set width on the form input elements since they're 100% wide by default */ | ||
| input, | ||
| select, | ||
| textarea { | ||
| max-width: 280px; | ||
| } | ||
|
|
||
| .navbar-inverse .navbar-toggle:hover, | ||
| .navbar-inverse .navbar-toggle:focus { | ||
| background-color: #777; | ||
| border-color: #fff | ||
| } |
6 changes: 6 additions & 0 deletions
6
samples/RemoteAuth/OIDC/OIDCAuth/Content/bootstrap-theme.min.css
Large diffs are not rendered by default.
Oops, something went wrong.
Large diffs are not rendered by default.
Oops, something went wrong.
Large diffs are not rendered by default.
Oops, something went wrong.
44 changes: 44 additions & 0 deletions
44
samples/RemoteAuth/OIDC/OIDCAuth/Controllers/AccountController.cs
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,44 @@ | ||
| using System; | ||
| using System.Collections.Generic; | ||
| using System.Linq; | ||
| using System.Web; | ||
| using System.Web.Mvc; | ||
| using Microsoft.Owin.Security.Cookies; | ||
| using Microsoft.Owin.Security.OpenIdConnect; | ||
| using Microsoft.Owin.Security; | ||
|
|
||
| namespace OIDCAuth.Controllers | ||
| { | ||
| public class AccountController : Controller | ||
| { | ||
| public void SignIn() | ||
| { | ||
| // Send an OpenID Connect sign-in request. | ||
| if (!Request.IsAuthenticated) | ||
| { | ||
| HttpContext.GetOwinContext().Authentication.Challenge(new AuthenticationProperties { RedirectUri = "/" }, | ||
| OpenIdConnectAuthenticationDefaults.AuthenticationType); | ||
| } | ||
| } | ||
|
|
||
| public void SignOut() | ||
| { | ||
| string callbackUrl = Url.Action("SignOutCallback", "Account", routeValues: null, protocol: Request.Url.Scheme); | ||
|
|
||
| HttpContext.GetOwinContext().Authentication.SignOut( | ||
| new AuthenticationProperties { RedirectUri = callbackUrl }, | ||
| OpenIdConnectAuthenticationDefaults.AuthenticationType, CookieAuthenticationDefaults.AuthenticationType); | ||
| } | ||
|
|
||
| public ActionResult SignOutCallback() | ||
| { | ||
| if (Request.IsAuthenticated) | ||
| { | ||
| // Redirect to home page if the user is authenticated. | ||
| return RedirectToAction("Index", "Home"); | ||
| } | ||
|
|
||
| return View(); | ||
| } | ||
| } | ||
| } |
37 changes: 37 additions & 0 deletions
37
samples/RemoteAuth/OIDC/OIDCAuth/Controllers/HomeController.cs
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,37 @@ | ||
| using System; | ||
| using System.Collections.Generic; | ||
| using System.Linq; | ||
| using System.Web; | ||
| using System.Web.Mvc; | ||
|
|
||
| namespace OIDCAuth.Controllers | ||
| { | ||
| public class HomeController : Controller | ||
| { | ||
| public ActionResult Index() | ||
| { | ||
| return View(); | ||
| } | ||
|
|
||
| public ActionResult About() | ||
| { | ||
| ViewBag.Message = "Your application description page."; | ||
|
|
||
| return View(); | ||
| } | ||
|
|
||
| public ActionResult Contact() | ||
| { | ||
| ViewBag.Message = "Your contact page."; | ||
|
|
||
| return View(); | ||
| } | ||
|
|
||
|
|
||
| [Authorize] | ||
| public ActionResult UserInfo() | ||
| { | ||
| return View(); | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| <%@ Application Codebehind="Global.asax.cs" Inherits="OIDCAuth.MvcApplication" Language="C#" %> |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,27 @@ | ||
| using System; | ||
| using System.Collections.Generic; | ||
| using System.Linq; | ||
| using System.Web; | ||
| using System.Web.Mvc; | ||
| using System.Web.Optimization; | ||
| using System.Web.Routing; | ||
|
|
||
| namespace OIDCAuth | ||
| { | ||
| public class MvcApplication : System.Web.HttpApplication | ||
| { | ||
| protected void Application_Start() | ||
| { | ||
| AreaRegistration.RegisterAllAreas(); | ||
| FilterConfig.RegisterGlobalFilters(GlobalFilters.Filters); | ||
| RouteConfig.RegisterRoutes(RouteTable.Routes); | ||
| BundleConfig.RegisterBundles(BundleTable.Bundles); | ||
|
|
||
| SystemWebAdapterConfiguration.AddSystemWebAdapters(this) | ||
| .AddProxySupport(options => options.UseForwardedHeaders = true) | ||
| .AddRemoteApp(options => options.ApiKey = "test-key") | ||
| .AddRemoteAppAuthentication(); | ||
|
|
||
| } | ||
| } | ||
| } |
Oops, something went wrong.