Recently I worked with a customer assisting them in implementing their Web APIs using the new ASP.NET Web API framework. Their API would be public so obviously security came up as the key concern to address. Claims-Based-Security is widely used in SOAP/WS-* world and we have rich APIs available in .NET Framework in the form of WCF, WIF & ADFS 2.0. Even though we now have this cool library to develop Web APIs, the claims-based-security story for REST/HTTP is still catching up. OAuth 2.0 is almost ready, OpenID Connect is catching up quickly however it would still take sometime before we have WIF equivalent libraries for implementing claims-based-security in REST/HTTP world. DotNetOpenAuth seems to be the most prominent open-source library claiming to support OAuth 2.0 so I decided to give it a go to implement the ‘Resource Owner Password Credentials’authorization grant. Following diagram shows the solution structure for my target scenario.

1. OAuth 2.0 issuer is an ASP.NET MVC application responsible for issuing token based on OAuth 2.0 ‘Password Credentials’ grant type.

2. Web API Host exposes secured Web APIs which can only be accessed by presenting a valid token issued by the trusted issuer

3. Sample thick client which consumes the Web API

I have used the DotNetOpenAuth.Ultimate NuGet package which is just a single assembly implementing quite a few security protocols. From OAuth 2.0 perspective, AuthorizationServer is the main class responsible for processing the token issuance request, producing and returning a token for valid & authenticated request. The token issuance action of my OAuthIssuerController looks like this:

OAuth 2.0 Issuer

public class OAuthIssuerController : Controller {
public ActionResult Index()
{
var configuration = new IssuerConfiguration {
EncryptionCertificate = new X509Certificate2(Server.MapPath("~/Certs/localhost.cer")),
SigningCertificate = new X509Certificate2(Server.MapPath("~/Certs/localhost.pfx"), "a")
}; var authorizationServer = new AuthorizationServer(new OAuth2Issuer(configuration));
var response = authorizationServer.HandleTokenRequest(Request).AsActionResult(); return response;
}
}

AuthorizationServer handles all the protocol details and delegate the real token issuance logic to a custom token issuer handler (OAuth2Issuer in following snippet)

Protocol independent issuer
public class OAuth2Issuer : IAuthorizationServer
{
private readonly IssuerConfiguration _configuration;
public OAuth2Issuer(IssuerConfiguration configuration)
{
if (configuration == null) throw new ArgumentNullException(“configuration”);
_configuration = configuration;
}
public RSACryptoServiceProvider AccessTokenSigningKey
{
get
{
return (RSACryptoServiceProvider)_configuration.SigningCertificate.PrivateKey;
}
}
public DotNetOpenAuth.Messaging.Bindings.ICryptoKeyStore CryptoKeyStore
{
get { throw new NotImplementedException(); }
}
public TimeSpan GetAccessTokenLifetime(DotNetOpenAuth.OAuth2.Messages.IAccessTokenRequest accessTokenRequestMessage)
{
return _configuration.TokenLifetime;
}
public IClientDescription GetClient(string clientIdentifier)
{
const string secretPassword = “test1243″;
return new ClientDescription(secretPassword, new Uri(“http://localhost/”), ClientType.Confidential);
}
public RSACryptoServiceProvider GetResourceServerEncryptionKey(DotNetOpenAuth.OAuth2.Messages.IAccessTokenRequest accessTokenRequestMessage)
{
return (RSACryptoServiceProvider)_configuration.EncryptionCertificate.PublicKey.Key;
}
public bool IsAuthorizationValid(DotNetOpenAuth.OAuth2.ChannelElements.IAuthorizationDescription authorization)
{
//claims added to the token
authorization.Scope.Add(“adminstrator”);
authorization.Scope.Add(“poweruser”);
return true;
}
public bool IsResourceOwnerCredentialValid(string userName, string password)
{
return true;
}
public DotNetOpenAuth.Messaging.Bindings.INonceStore VerificationCodeNonceStore
{
get
{
throw new NotImplementedException();
}
}
}

Now with my issuer setup, I can acquire access tokens by POSTing following request to the token issuer endpoint

Client

POST /Issuer HTTP/1.1

Content-Type: application/x-www-form-urlencoded; charset=utf-8

scope=http%3A%2F%2Flocalhost%2F&grant_type=client_credentials&client_id=zamd&client_secret=test1243

In response, I get 200 OK with following payload

HTTP/1.1 200 OK

Cache-Control: no-cache, no-store, max-age=0, must-revalidate

Pragma: no-cache

Content-Type: application/json; charset=utf-8

Server: Microsoft-IIS/7.5

Content-Length: 685

{“access_token”:”gAAAAC5KksmbH0FyG5snks_xOcROnIcPldpgksi5b8Egk7DmrRhbswiEYCX7RLdb2l0siW8ZWyqTqxOFxBCjthjTfAHrE8owe3hPxur7Wmn2LZciTYfTlKQZW6ujlhEv6N4V1HL4Md5hdtwy51_7RMzGG6MvvNbEU8_3GauIgaF7JcbQJAEAAIAAAABR4tbwLFF57frAdPyZsIeA6ljo_Y01u-2p5KTfJ2xa6ZhtEpzmC46Omcvps9MbFWgyz6536_77jx9nE3sePTSeyB5zyLznkGDKhjfWwx3KjbYnxCVCV-n2pqKtry0l8nkMj4MrjqoTXpvd_P0c_VGfVXCsVt7BYOO68QbD-m7Yz9rHIZn-CQ4po0FqS2elDVe9qwu_uATbAmOXlkWsbnFwa6_ZDHcSr2M-WZxHTVFin7vEWO7FxIQStabu_r4_0Mo_xaFlBKp2hl9Podq8ltx7KvhqFS0Xu8oIJGp1t5lQKoaJSRTgU8N8iEyQfCeU5hvynZVeoVPaXfMA-gyYfMGspLybaw7XaBOuFJ20-BZW0sAFGm_0sqNq7CLm7LibWNw”,”token_type”:”bearer”,”expires_in”:”300″,”scope”:”http:\/\/localhost\/ adminstrator poweruser”}

DotNetOpenAuth also has a WebServerClient class which can be used to acquire tokens and I have used in my test application instead of crafting raw HTTP requests. Following code snippet generates the same above request/response

Get Access Token
private static IAuthorizationState GetAccessToken()
{
var authorizationServer = new AuthorizationServerDescription
{
TokenEndpoint = new Uri(“http://localhost:1960/Issuer”),
ProtocolVersion = ProtocolVersion.V20
};
var client = new WebServerClient(authorizationServer, “http://localhost/”);
client.ClientIdentifier = “zamd”;
client.ClientSecret = “test1243″;
var state = client.GetClientAccessToken(new[] { “http://localhost/” });
return state;
}

Ok Now the 2nd part is to use this access token for authentication & authorization when consuming ASP.NET Web APIs.

Web API Client
static void Main(string[] args)
{
var state = GetAccessToken();
Console.WriteLine(“Expires = {0}”, state.AccessTokenExpirationUtc);
Console.WriteLine(“Token = {0}”, state.AccessToken);
var httpClient = new OAuthHttpClient(state.AccessToken)
{
BaseAddress = new Uri(“http://localhost:2150/api/values”)
};
Console.WriteLine(“Calling web api…”);
Console.WriteLine();
var response = httpClient.GetAsync(“”).Result;
if (response.StatusCode==HttpStatusCode.OK)
Console.WriteLine(response.Content.ReadAsStringAsync().Result);
else
Console.WriteLine(response);
Console.ReadLine();
}

On line 8, I’m creating an instance of a customized HttpClient passing in the access token. The httpClient would use this access token for all subsequent HTTP requests

OAuth enabled HttpClient
public class OAuthHttpClient : HttpClient
{
public OAuthHttpClient(string accessToken)
: base(new OAuthTokenHandler(accessToken))
{
}
class OAuthTokenHandler : MessageProcessingHandler
{
string _accessToken;
public OAuthTokenHandler(string accessToken)
: base(new HttpClientHandler())
{
_accessToken = accessToken;
}
protected override HttpRequestMessage ProcessRequest(HttpRequestMessage request, System.Threading.CancellationToken cancellationToken)
{
request.Headers.Authorization = new AuthenticationHeaderValue(“Bearer”, _accessToken);
return request;
}
protected override HttpResponseMessage ProcessResponse(HttpResponseMessage response, System.Threading.CancellationToken cancellationToken)
{
return response;
}
}
}

Relying Party (ASP.NET Web APIs)

Finally on the RP side, I have used standard MessageHandler extensibility to extract and validate the ‘access token’. The OAuth2 message handler also extracts the claims from the access token and create a ClaimsPrincipal which is passed on the Web API implementation for authorization decisions.

OAuth2 Message Handler
public class OAuth2Handler : DelegatingHandler
{
private readonly ResourceServerConfiguration _configuration;
public OAuth2Handler(ResourceServerConfiguration configuration)
{
if (configuration == null) throw new ArgumentNullException(“configuration”);
_configuration = configuration;
}
protected override Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
{
HttpContextBase httpContext;
string userName;
HashSet<string> scope;
if (!request.TryGetHttpContext(out httpContext))
throw new InvalidOperationException(“HttpContext must not be null.”);
var resourceServer = new ResourceServer(new StandardAccessTokenAnalyzer(
(RSACryptoServiceProvider)_configuration.IssuerSigningCertificate.PublicKey.Key,
(RSACryptoServiceProvider)_configuration.EncryptionVerificationCertificate.PrivateKey));
var error = resourceServer.VerifyAccess(httpContext.Request, out userName, out scope);
if (error != null)
return Task<HttpResponseMessage>.Factory.StartNew(error.ToHttpResponseMessage);
var identity = new ClaimsIdentity(scope.Select(s => new Claim(s, s)));
if (!string.IsNullOrEmpty(userName))
identity.Claims.Add(new Claim(ClaimTypes.Name, userName));
httpContext.User = ClaimsPrincipal.CreateFromIdentity(identity);
Thread.CurrentPrincipal = httpContext.User;
return base.SendAsync(request, cancellationToken);
}
}

Inside my Web API, I access the claims information using the standard IClaimsIdentity abstraction.

Accessing claims information
public IEnumerable<string> Get()
{
if (User.Identity.IsAuthenticated && User.Identity is IClaimsIdentity)
return ((IClaimsIdentity) User.Identity).Claims.Select(c => c.Value);
return new string[] { “value1″, “value2″ };
}

Fiddler Testing

Once I got the “access token”, I can test few scenarios in fiddler by attaching and tweaking the token when calling my web api.

401 without an “access token”

200 OK with a Valid token

401 with Expired token

401 with Tempered token

Source code attached. Please feel free to download and use.

Original Post by ZulfiqarAhmed on May4th, 2012

Here: http://zamd.net/2012/05/04/claim-based-security-for-asp-net-web-apis-using-dotnetopenauth/

Claim-based-security for ASP.NET Web APIs using DotNetOpenAuth的更多相关文章

  1. ASP.NET Web APIs 基于令牌TOKEN验证的实现(保存到DB的Token)

    http://www.cnblogs.com/niuww/p/5639637.html 保存到DB的Token 基于.Net Framework 4.0 Web API开发(4):ASP.NET We ...

  2. 基于.Net Framework 4.0 Web API开发(4):ASP.NET Web APIs 基于令牌TOKEN验证的实现

    概述:  ASP.NET Web API 的好用使用过的都知道,没有复杂的配置文件,一个简单的ApiController加上需要的Action就能工作.但是在使用API的时候总会遇到跨域请求的问题, ...

  3. 基于.Net Framework 4.0 Web API开发(2):ASP.NET Web APIs 参数传递方式详解

    概述:  ASP.NET Web API 的好用使用过的都知道,没有复杂的配置文件,一个简单的ApiController加上需要的Action就能工作.调用API过程中参数的传递是必须的,本节就来谈谈 ...

  4. 基于.Net Framework 4.0 Web API开发(3):ASP.NET Web APIs 异常的统一处理Attribute 和统一写Log 的Attribute的实现

    概述:  ASP.NET Web API 的好用使用过的都知道,没有复杂的配置文件,一个简单的ApiController加上需要的Action就能工作.但是项目,总有异常发生,本节就来谈谈API的异常 ...

  5. 基于.Net Framework 4.0 Web API开发(5):ASP.NET Web APIs AJAX 跨域请求解决办法(CORS实现)

    概述:  ASP.NET Web API 的好用使用过的都知道,没有复杂的配置文件,一个简单的ApiController加上需要的Action就能工作.但是在使用API的时候总会遇到跨域请求的问题,特 ...

  6. ASP.NET Web API 2 external logins with Facebook and Google in AngularJS app

    转载:http://bitoftech.net/2014/08/11/asp-net-web-api-2-external-logins-social-logins-facebook-google-a ...

  7. 在ASP.NET Web API 2中使用Owin OAuth 刷新令牌(示例代码)

    在上篇文章介绍了Web Api中使用令牌进行授权的后端实现方法,基于WebApi2和OWIN OAuth实现了获取access token,使用token访问需授权的资源信息.本文将介绍在Web Ap ...

  8. 在ASP.NET Web API 2中使用Owin基于Token令牌的身份验证

    基于令牌的身份验证 基于令牌的身份验证主要区别于以前常用的常用的基于cookie的身份验证,基于cookie的身份验证在B/S架构中使用比较多,但是在Web Api中因其特殊性,基于cookie的身份 ...

  9. ASP.NET Web API安全认证

    http://www.cnblogs.com/codeon/p/6123863.html http://open.taobao.com/docs/doc.htm?spm=a219a.7629140.0 ...

随机推荐

  1. lintcode 中等题:Evaluate Reverse Polish notation逆波兰表达式求值

    题目 逆波兰表达式求值 在逆波兰表达法中,其有效的运算符号包括 +, -, *, / .每个运算对象可以是整数,也可以是另一个逆波兰计数表达. 样例 ["2", "1&q ...

  2. 自己常用的wireshark过滤条件

    抓发给NVR的StrartRealPlay命令包: ip.src eq 118.123.114.8 and  tcp contains 02:63:64:61 抓发给NVR的心跳包: ip.src e ...

  3. iOS开发--调试必备 — NSLog

    对于程序的开发者来说,拥有一手强大的DEBUG能力,那就好比在武侠世界中拥有一种强大的内功心法一样,走到哪里都是大写的牛B.在我们DEBUG的时候,大部分情况都是要查看我们的调试日志的,这些打印日志可 ...

  4. Windows下gcc以及Qt的DLL文件调用之总结(三种方法)

    DLL与LIB的区别 :1.DLL是一个完整程序,其已经经过链接,即不存在同名引用,且有导出表,与导入表lib是一个代码集(也叫函数集)他没有链接,所以lib有冗余,当两个lib相链接时地址会重新建立 ...

  5. 77. Combinations

    题目: Given two integers n and k, return all possible combinations of k numbers out of 1 ... n. For ex ...

  6. Android viewPage notifyDataSetChanged无刷新

    转载 http://www.67tgb.com/?p=624 最近项目结束,搞了一次代码分享.其中一位同学分享了一下自己在解决问题过程中的一些心得体会,感觉受益匪浅.整理出来,分享给大家. 建议使用自 ...

  7. Android Apps开发环境搭建

    一 Android开发工具简介 用于Eclipse的Android开发工具(AdnroidDeveloper Tools,简称ADT)插件提供了专业级别的开发环境,利用该环境来构建AndroidApp ...

  8. struts2中利用POI导出Excel文档并下载

    1.项目组负责人让我实现这个接口,因为以前做过类似的,中间并没有遇到什么太困难的事情.其他不说,先上代码: package com.tydic.eshop.action.feedback; impor ...

  9. UserAccountInfo时间倒计时

    界面如下: 代码如下: using System;using System.Collections.Generic;using System.ComponentModel;using System.D ...

  10. c扩展调用php的函数(调用实现php函数的c函数)

    上一次是写的c扩展调用c的标准函数,但是只能调用头文件中申明的函数,今天来说下c扩展调用实现php函数的c函数,比方说,c扩展要用到php中ip2long这个函数,但是c不可能去php中调用,肯定是去 ...