JWT Authentication

2021-11-01 18:27:08 +01:00
parent 505ae8b2f8
commit e5e3e7dff3
16 changed files with 415 additions and 9 deletions
@@ -0,0 +1,8 @@
+namespace Prospect.Server.Api.Services.Auth
+{
+    public static class AuthClaimTypes
+    {
+        public const string Id = "id";
+        public const string Type = "type";
+    }
+}
@@ -0,0 +1,81 @@
+using System;
+using System.Collections.Generic;
+using System.IdentityModel.Tokens.Jwt;
+using System.Security.Claims;
+using System.Text;
+using Microsoft.Extensions.Options;
+using Microsoft.IdentityModel.Tokens;
+using Prospect.Server.Api.Services.Database.Models;
+
+namespace Prospect.Server.Api.Services.Auth
+{
+    public class AuthTokenService
+    {
+        private const string DefaultIssuer = "ProspectApi";
+        private const string DefaultAudience = "Prospect";
+        
+        private readonly SymmetricSecurityKey _securityKey;
+        private readonly JwtSecurityTokenHandler _tokenHandler;
+        
+        public AuthTokenService(IOptions<AuthTokenSettings> options)
+        {
+            _securityKey = new SymmetricSecurityKey(Encoding.ASCII.GetBytes(options.Value.Secret));
+            _tokenHandler = new JwtSecurityTokenHandler();
+        }
+
+        private string CreateToken(IEnumerable<Claim> claims)
+        {
+            var tokenDescriptor = new SecurityTokenDescriptor
+            {
+                Subject = new ClaimsIdentity(claims),
+                Expires = DateTime.UtcNow.AddDays(7),
+                Issuer = DefaultIssuer,
+                Audience = DefaultAudience,
+                SigningCredentials = new SigningCredentials(_securityKey, SecurityAlgorithms.HmacSha256Signature)
+            };
+
+            var token = _tokenHandler.CreateToken(tokenDescriptor);
+            return _tokenHandler.WriteToken(token);
+        }
+
+        public string Generate(PlayFabUser user)
+        {
+            return CreateToken(new[]
+            {
+                new Claim(AuthClaimTypes.Id, user.Id),
+                new Claim(AuthClaimTypes.Type, AuthType.User),
+            });
+        }
+
+        public string Generate(PlayFabEntity entity)
+        {
+            return CreateToken(new[]
+            {
+                new Claim(AuthClaimTypes.Id, entity.Id),
+                new Claim(AuthClaimTypes.Type, AuthType.Entity),
+            });
+        }
+
+        public ClaimsPrincipal Validate(string token)
+        {
+            var tokenHandler = new JwtSecurityTokenHandler();
+            
+            try
+            {
+                return tokenHandler.ValidateToken(token, new TokenValidationParameters
+                {
+                    ValidateIssuerSigningKey = true,
+                    ValidateIssuer = true,
+                    ValidateAudience = true,
+                    ValidIssuer = DefaultIssuer,
+                    ValidAudience = DefaultAudience,
+                    IssuerSigningKey = _securityKey
+                }, out _);
+            }
+            catch
+            {
+                return null;
+            }
+        }
+    }
+}
@@ -0,0 +1,7 @@
+namespace Prospect.Server.Api.Services.Auth
+{
+    public class AuthTokenSettings
+    {
+        public string Secret { get; set; }
+    }
+}
@@ -0,0 +1,8 @@
+namespace Prospect.Server.Api.Services.Auth
+{
+    public static class AuthType
+    {
+        public const string User = "User";
+        public const string Entity = "Entity";
+    }
+}
@@ -0,0 +1,20 @@
+using System;
+using Microsoft.AspNetCore.Authentication;
+using Prospect.Server.Api.Services.Auth.Entity;
+using Prospect.Server.Api.Services.Auth.User;
+
+namespace Prospect.Server.Api.Services.Auth
+{
+    public static class AuthenticationBuilderExtensions
+    {
+        public static AuthenticationBuilder AddUserAuthentication(this AuthenticationBuilder authenticationBuilder, Action<UserAuthenticationOptions> options)
+        {
+            return authenticationBuilder.AddScheme<UserAuthenticationOptions, UserAuthenticationHandler>(UserAuthenticationOptions.DefaultScheme, options);
+        }
+        
+        public static AuthenticationBuilder AddEntityAuthentication(this AuthenticationBuilder authenticationBuilder, Action<EntityAuthenticationOptions> options)
+        {
+            return authenticationBuilder.AddScheme<EntityAuthenticationOptions, EntityAuthenticationHandler>(EntityAuthenticationOptions.DefaultScheme, options);
+        }
+    }
+}
@@ -0,0 +1,87 @@
+using System.Collections.Generic;
+using System.Linq;
+using System.Security.Claims;
+using System.Text.Encodings.Web;
+using System.Text.Json;
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.Authentication;
+using Microsoft.AspNetCore.Http;
+using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Options;
+using Prospect.Server.Api.Models.Client;
+using Prospect.Server.Api.Services.Auth.Extensions;
+
+namespace Prospect.Server.Api.Services.Auth.Entity
+{
+    public class EntityAuthenticationHandler : AuthenticationHandler<EntityAuthenticationOptions>
+    {
+        private const string Header = "X-EntityToken";
+        private const string Type = AuthType.Entity;
+        
+        private readonly AuthTokenService _authTokenService;
+        
+        public EntityAuthenticationHandler(
+            IOptionsMonitor<EntityAuthenticationOptions> options, 
+            ILoggerFactory logger, 
+            UrlEncoder encoder, 
+            ISystemClock clock,
+            AuthTokenService authTokenService) : base(options, logger, encoder, clock)
+        {
+            _authTokenService = authTokenService;
+        }
+        
+        private ClientResponse Res { get; set; } = new ClientResponse
+        {
+            Code = 401,
+            Status = "Unauthorized",
+            Error = "NotAuthenticated",
+            ErrorCode = 1074,
+            ErrorMessage = "This API method does not allow anonymous callers."
+        };
+
+        protected override Task<AuthenticateResult> HandleAuthenticateAsync()
+        {
+            if (!Request.Headers.TryGetValue(Header, out var headerValues) || headerValues.Count == 0)
+            {
+                return Task.FromResult(AuthenticateResult.Fail("No header"));
+            }
+            
+            var headerValue = headerValues.FirstOrDefault();
+
+            if (string.IsNullOrWhiteSpace(headerValue))
+            {
+                return Task.FromResult(AuthenticateResult.Fail("Empty header value"));
+            }
+
+            Res.Error = "EntityTokenInvalid";
+            Res.ErrorCode = 1335;
+            Res.ErrorMessage = "EntityTokenInvalid";
+            
+            var token = _authTokenService.Validate(headerValue);
+            if (token != null)
+            {
+                var identity = new ClaimsIdentity(token.Claims, Options.AuthenticationType);
+                var identities = new List<ClaimsIdentity> { identity };
+                var principal = new ClaimsPrincipal(identities);
+                if (principal.FindAuthType() != Type)
+                {
+                    return Task.FromResult(AuthenticateResult.Fail("Invalid auth type"));
+                }
+                
+                var ticket = new AuthenticationTicket(principal, Options.Scheme);
+                
+                return Task.FromResult(AuthenticateResult.Success(ticket));
+            }
+
+            return Task.FromResult(AuthenticateResult.Fail("Invalid JWT"));
+        }
+
+        protected override async Task HandleChallengeAsync(AuthenticationProperties properties)
+        {
+            Response.StatusCode = 401;
+            Response.ContentType = "application/json";
+        
+            await Response.WriteAsync(JsonSerializer.Serialize(Res));
+        }
+    }
+}
@@ -0,0 +1,11 @@
+using Microsoft.AspNetCore.Authentication;
+
+namespace Prospect.Server.Api.Services.Auth.Entity
+{
+    public class EntityAuthenticationOptions : AuthenticationSchemeOptions
+    {
+        public const string DefaultScheme = "EntityAuth";
+        public string Scheme => DefaultScheme;
+        public string AuthenticationType = DefaultScheme;
+    }
+}
@@ -0,0 +1,29 @@
+using System.Security.Claims;
+using Prospect.Server.Api.Exceptions;
+
+namespace Prospect.Server.Api.Services.Auth.Extensions
+{
+    public static class ClaimsPrincipalExtensions
+    {
+        public static string FindAuthId(this ClaimsPrincipal principal)
+        {
+            return Find(principal, AuthClaimTypes.Id);
+        }
+        
+        public static string FindAuthType(this ClaimsPrincipal principal)
+        {
+            return Find(principal, AuthClaimTypes.Type);
+        }
+
+        private static string Find(ClaimsPrincipal principal, string claimType)
+        {
+            var claim = principal.FindFirst(claimType);
+            if (claim == null)
+            {
+                throw new ProspectException($"Failed to find claim {claimType}");
+            }
+
+            return claim.Value;
+        }
+    }
+}
@@ -0,0 +1,85 @@
+using System.Collections.Generic;
+using System.Linq;
+using System.Security.Claims;
+using System.Text.Encodings.Web;
+using System.Text.Json;
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.Authentication;
+using Microsoft.AspNetCore.Http;
+using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Options;
+using Prospect.Server.Api.Models.Client;
+using Prospect.Server.Api.Services.Auth.Extensions;
+
+namespace Prospect.Server.Api.Services.Auth.User
+{
+    public class UserAuthenticationHandler : AuthenticationHandler<UserAuthenticationOptions>
+    {
+        private const string Header = "X-Authorization";
+        private const string Type = AuthType.User;
+        
+        private readonly AuthTokenService _authTokenService;
+        
+        public UserAuthenticationHandler(
+            IOptionsMonitor<UserAuthenticationOptions> options, 
+            ILoggerFactory logger, 
+            UrlEncoder encoder, 
+            ISystemClock clock,
+            AuthTokenService authTokenService) : base(options, logger, encoder, clock)
+        {
+            _authTokenService = authTokenService;
+        }
+        
+        private string Failure { get; set; } = "Not Authenticated";
+
+        protected override Task<AuthenticateResult> HandleAuthenticateAsync()
+        {
+            if (!Request.Headers.TryGetValue(Header, out var headerValues) || headerValues.Count == 0)
+            {
+                return Task.FromResult(AuthenticateResult.Fail("No header"));
+            }
+            
+            var headerValue = headerValues.FirstOrDefault();
+
+            if (string.IsNullOrWhiteSpace(headerValue))
+            {
+                return Task.FromResult(AuthenticateResult.Fail("Empty header value"));
+            }
+
+            Failure = "X-Authentication HTTP header contains invalid ticket";
+
+            var token = _authTokenService.Validate(headerValue);
+            if (token != null)
+            {
+                var identity = new ClaimsIdentity(token.Claims, Options.AuthenticationType);
+                var identities = new List<ClaimsIdentity> { identity };
+                var principal = new ClaimsPrincipal(identities);
+                if (principal.FindAuthType() != Type)
+                {
+                    return Task.FromResult(AuthenticateResult.Fail("Invalid auth type"));
+                }
+                
+                var ticket = new AuthenticationTicket(principal, Options.Scheme);
+                
+                return Task.FromResult(AuthenticateResult.Success(ticket));
+            }
+            
+            return Task.FromResult(AuthenticateResult.Fail("Invalid JWT"));
+        }
+
+        protected override async Task HandleChallengeAsync(AuthenticationProperties properties)
+        {
+            Response.StatusCode = 401;
+            Response.ContentType = "application/json";
+        
+            await Response.WriteAsync(JsonSerializer.Serialize(new ClientResponse
+            {
+                Code = 401,
+                Status = "Unauthorized",
+                Error = "NotAuthenticated",
+                ErrorCode = 1074,
+                ErrorMessage = Failure
+            }));
+        }
+    }
+}
@@ -0,0 +1,11 @@
+using Microsoft.AspNetCore.Authentication;
+
+namespace Prospect.Server.Api.Services.Auth.User
+{
+    public class UserAuthenticationOptions : AuthenticationSchemeOptions
+    {
+        public const string DefaultScheme = "UserAuth";
+        public string Scheme => DefaultScheme;
+        public string AuthenticationType = DefaultScheme;
+    }
+}