How to Secure ASP.NET Core Applications with OpenIddict: Tech Case Study

                                    //With these lines we load authorization settings from configuration
services.AddOptions<Platform.Core.Security.AuthorizationOptions>().Bind(Configuration.GetSection("Authorization")).ValidateDataAnnotations(); 
var authorizationOptions = Configuration.GetSection("Authorization").Get<Platform.Core.Security.AuthorizationOptions>(); 
// Register the OpenIddict services.
// Note: use the generic overload if you need
// to replace the default OpenIddict entities.
services.AddOpenIddict() 
.AddCore(options => 
{
//Use EF integration pass to OpenIddict tha database is used by ASP.NET Identity stores
options.UseEntityFrameworkCore() 
.UseDbContext<SecurityDbContext>(); 
}).AddServer(options => 
{ 
// bind OpenIdConnectRequest or OpenIdConnectResponse parameters.
var builder = options.UseAspNetCore(). 
EnableTokenEndpointPassthrough(). 
EnableAuthorizationEndpointPassthrough(); 
// Enable the authorization, logout, token and userinfo endpoints.
options.SetTokenEndpointUris("/connect/token"); 
options.SetUserinfoEndpointUris("/api/security/userinfo"); 
options.AllowPasswordFlow() 
.AllowRefreshTokenFlow() 
.AllowClientCredentialsFlow();
//Set the lifetime for tokens are loaded from configuration
options.SetRefreshTokenLifetime(authorizationOptions?.RefreshTokenLifeTime); 
options.SetAccessTokenLifetime(authorizationOptions?.AccessTokenLifeTime); 
options.AcceptAnonymousClients(); 
// When request caching is enabled, authorization and logout requests
// are stored in the distributed cache by OpenIddict and the user agent
// is redirected to the same page with a single parameter (request_id).
// This allows flowing large OpenID Connect requests even when using
// an external authentication provider like Google, Facebook or Twitter.
builder.EnableAuthorizationRequestCaching(); 
builder.EnableLogoutRequestCaching();
//We don't use scopes validation, instead we use internal permissions-based authroization, where each permission is stored as user claims and included in the JWT token that will be used later for authorizations checks
options.DisableScopeValidation(); 
// During development or when you explicitly run the platform in production mode without https, need to disable the HTTPS requirement.
 
if (WebHostEnvironment.IsDevelopment() || !Configuration.IsHttpsServerUrlSet()) 
{ 
builder.DisableTransportSecurityRequirement(); 
} 
// Note: to use JWT access tokens instead of the default
// encrypted format, the following lines are required:
options.DisableAccessTokenEncryption(); 
var bytes = File.ReadAllBytes(Configuration["Auth:PrivateKeyPath"]); 
X509Certificate2 privateKey; 
if (RuntimeInformation.IsOSPlatform(OSPlatform.OSX)) 
{ 
// https://github.com/dotnet/corefx/blob/release/2.2/Documentation/architecture/cross-platform-cryptography.md
// macOS cannot load certificate private keys without a keychain object, which requires writing to disk. Keychains are created automatically for PFX loading, and are deleted when no longer in use. Since the X509KeyStorageFlags.EphemeralKeySet option means that the private key should not be written to disk, asserting that flag on macOS results in a PlatformNotSupportedException.
privateKey = new X509Certificate2(bytes, Configuration["Auth:PrivateKeyPassword"], X509KeyStorageFlags.MachineKeySet); 
} 
else 
{ 
privateKey = new X509Certificate2(bytes, Configuration["Auth:PrivateKeyPassword"], X509KeyStorageFlags.MachineKeySet | X509KeyStorageFlags.EphemeralKeySet); 
} 
options.AddSigningCertificate(privateKey); 
options.AddEncryptionCertificate(privateKey); 
});
                                

                                    [HttpPost("~/connect/token"), Produces("application/json")] 
public async Task<ActionResult> Exchange() 
{ 
OpenIddictRequest openIdConnectRequest = HttpContext.GetOpenIddictServerRequest(); 
if (openIdConnectRequest.IsPasswordGrantType()) 
{ 
var user = await _userManager.FindByNameAsync(openIdConnectRequest.Username); 
if (user == null) 
{ 
 var properties = new AuthenticationProperties(new Dictionary<string, string>
                    {
                        [OpenIddictServerAspNetCoreConstants.Properties.Error] = Errors.InvalidGrant,
                        [OpenIddictServerAspNetCoreConstants.Properties.ErrorDescription] = "The username/password couple is invalid."
                    });
} 
// Validate the username/password parameters and ensure the account is not locked out.
var result = await _signInManager.CheckPasswordSignInAsync(user, openIdConnectRequest.Password, lockoutOnFailure: true); 
if (!result.Succeeded) 
{ 
 var properties = new AuthenticationProperties(new Dictionary<string, string>
                    {
                        [OpenIddictServerAspNetCoreConstants.Properties.Error] = Errors.InvalidGrant,
                        [OpenIddictServerAspNetCoreConstants.Properties.ErrorDescription] = "The username/password couple is invalid."
                    });
} 
// Create a new authentication ticket.
var ticket = await CreateTicketAsync(openIdConnectRequest, user); 
var claimsPrincipal = await _userClaimsPrincipalFactory.CreateAsync(user); 
//Do not allow login to customers
if (claimsPrincipal.Claims.Any(x => x.Type == _identityOptions.Value.ClaimsIdentity.RoleClaimType && x.Value == PlatformConstants.Security.SystemRoles.Customer)) 
{ 
 
 var properties = new AuthenticationProperties(new Dictionary<string, string>
                    {
                        [OpenIddictServerAspNetCoreConstants.Properties.Error] = Errors.InvalidGrant,
                        [OpenIddictServerAspNetCoreConstants.Properties.ErrorDescription] = "The user is not allowed to sign in."
                    });
 
                    return Forbid(properties, OpenIddictServerAspNetCoreDefaults.AuthenticationScheme);
} 
var limitedPermissions = _authorizationOptions.LimitedCookiePermissions?.Split(PlatformConstants.Security.Claims.PermissionClaimTypeDelimiter, StringSplitOptions.RemoveEmptyEntries) ?? new string[0]; 
if (!user.IsAdministrator) 
{ 
limitedPermissions = claimsPrincipal 
.Claims 
.Where(c => c.Type == PlatformConstants.Security.Claims.PermissionClaimType) 
.Select(c => c.Value) 
.Intersect(limitedPermissions, StringComparer.OrdinalIgnoreCase) 
.ToArray(); 
} 
if (limitedPermissions.Any()) 
{ 
// Set limited permissions and authenticate user with combined mode Cookies + Bearer.
//
// LimitedPermissions claims that will be granted to the user by cookies when bearer token authentication is enabled.
// This can help to authorize the user for direct(non - AJAX) GET requests to the VC platform API and / or to use some 3rd - party web applications for the VC platform(like Hangfire dashboard).
//
// If the user identity has a claim named "limited_permissions", this attribute should authorize only permissions listed in that claim. Any permissions that are required by this attribute but
// not listed in the claim should cause this method to return false. However, if permission limits of user identity are not defined ("limited_permissions" claim is missing),
// then no limitations should be applied to the permissions.
((ClaimsIdentity)claimsPrincipal.Identity).AddClaim(new Claim(PlatformConstants.Security.Claims.LimitedPermissionsClaimType, string.Join(PlatformConstants.Security.Claims.PermissionClaimTypeDelimiter, limitedPermissions))); 
await HttpContext.SignInAsync(IdentityConstants.ApplicationScheme, claimsPrincipal); 
} 
await _eventPublisher.Publish(new UserLoginEvent(user)); 
return SignIn(ticket.Principal, ticket.Properties, ticket.AuthenticationScheme); 
}
                                

                                    app.factory('BearerAuthInterceptor', function ($window, $q) { 
return { 
request: function (config) { 
config.headers = config.headers || {}; 
return extractAuthData() 
.then(function (authData) { 
if (authData) { 
config.headers.Authorization = 'Bearer ' + authData.token; 
} 
return config; 
}); 
}, 
response: function(response) { 
if (response.status === 401) { 
// Redirect user to login page / signup Page.
} 
return response || $q.when(response); 
} 
}; 
function extractAuthData() { 
var authData = $window.localStorage.getItem('auth_data').getStoredData(); 
if (Date.now() < authData.expiresAt) { 
return $q.resolve(authData); 
}
var data = 'grant_type=refresh_token&refresh_token=' + encodeURIComponent(authData.refreshToken);
return $http.post('connect/token', data, { headers: { 'Content-Type': 'application/x-www-form-urlencoded' } }).then( 
//store new access_token and refresh_token in the local storage. Rest of code skip for clarity
) 
}
}); 
// Register the previously created AuthInterceptor.
app.config(function ($httpProvider) { 
$httpProvider.interceptors.push('BearerAuthInterceptor'); 
});
                                

                                    authBuilder.AddJwtBearer(options => 
{ 
options.Authority = Configuration["Auth:Authority"]; 
options.Audience = Configuration["Auth:Audience"]; 
if (WebHostEnvironment.IsDevelopment()) 
{ 
options.RequireHttpsMetadata = false; 
} 
options.IncludeErrorDetails = true; 
X509SecurityKey publicKey = null; 
if (!Configuration["Auth:PublicCertPath"].IsNullOrEmpty()) 
{ 
var publicCert = new X509Certificate2(Configuration["Auth:PublicCertPath"]); 
publicKey = new X509SecurityKey(publicCert); 
} 
options.TokenValidationParameters = new TokenValidationParameters() 
{ 
NameClaimType = OpenIddictConstants.Claims.Subject, 
RoleClaimType = OpenIddictConstants.Claims.Role, 
ValidateIssuer = !string.IsNullOrEmpty(options.Authority), 
ValidateIssuerSigningKey = true, 
IssuerSigningKey = publicKey 
}; 
});
                                

                                    ...
"Auth": {
//Is the address of the token-issuing authentication server.
//The JWT bearer authentication middleware uses this URI to get the public key that can be used to validate the token's signature.
//The middleware also confirms that the iss parameter in the token matches this URI.
"Authority": "https://authentication-server-url",
//represents the receiver of the incoming token or the resource that the token grants access to.
//If the value specified in this parameter does not match the parameter in the token,
//the token will be rejected.
"Audience": "resource_server",
 
"PublicCertPath": "./Certificates/virtocommerce.crt",
"PrivateKeyPath": "./Certificates/virtocommerce.pfx",
"PrivateKeyPassword": "virto"
}
...
                                

                                    var options = new AzureAdOptions(); 
azureAdSection.Bind(options); 
if (options.Enabled) 
{
//https://docs.microsoft.com/en-us/azure/active-directory/develop/microsoft-identity-web
authBuilder.AddOpenIdConnect(options.AuthenticationType, options.AuthenticationCaption, 
openIdConnectOptions => 
{ 
openIdConnectOptions.ClientId = options.ApplicationId; 
openIdConnectOptions.Authority = $"{options.AzureAdInstance}{options.TenantId}"; 
openIdConnectOptions.UseTokenLifetime = true; 
openIdConnectOptions.RequireHttpsMetadata = false; 
openIdConnectOptions.SignInScheme = IdentityConstants.ExternalScheme; 
openIdConnectOptions.SecurityTokenValidator = defaultTokenHandler; 
openIdConnectOptions.MetadataAddress = options.MetadataAddress; 
}); 
}