Claim-based-security for ASP.NET Web APIs using DotNetOpenAuth
2014-11-27 10:08
531 查看
Recently I worked with a customer assisting them in implementing their Web APIs using the new ASP.NET Web API framework. Their API would be public so obviously security came up as the key concern to address. Claims-Based-Security is widely used in SOAP/WS-* world and we have rich APIs available in .NET Framework in the form of WCF, WIF & ADFS 2.0. Even though we now have this cool library to develop Web APIs, the claims-based-security story for REST/HTTP is still catching up. OAuth 2.0 is almost ready, OpenID Connect is catching up quickly however it would still take sometime before we have WIF equivalent libraries for implementing claims-based-security in REST/HTTP world. DotNetOpenAuth seems to be the most prominent open-source library claiming to support OAuth 2.0 so I decided to give it a go to implement the ‘Resource Owner Password Credentials’authorization grant. Following diagram shows the solution structure for my target scenario.
1. OAuth 2.0 issuer is an ASP.NET MVC application responsible for issuing token based on OAuth 2.0 ‘Password Credentials’ grant type.
2. Web API Host exposes secured Web APIs which can only be accessed by presenting a valid token issued by the trusted issuer
3. Sample thick client which consumes the Web API
I have used the DotNetOpenAuth.Ultimate NuGet package which is just a single assembly implementing quite a few security protocols. From OAuth 2.0 perspective, AuthorizationServer is the main class responsible for processing the token issuance request, producing and returning a token for valid & authenticated request. The token issuance action of my OAuthIssuerController looks like this:
AuthorizationServer handles all the protocol details and delegate the real token issuance logic to a custom token issuer handler (OAuth2Issuer in following snippet)
Protocol independent issuer
Now with my issuer setup, I can acquire access tokens by POSTing following request to the token issuer endpoint
Content-Type: application/x-www-form-urlencoded; charset=utf-8
scope=http%3A%2F%2Flocalhost%2F&grant_type=client_credentials&client_id=zamd&client_secret=test1243
In response, I get 200 OK with following payload
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Content-Type: application/json; charset=utf-8
Server: Microsoft-IIS/7.5
Content-Length: 685
{“access_token”:”gAAAAC5KksmbH0FyG5snks_xOcROnIcPldpgksi5b8Egk7DmrRhbswiEYCX7RLdb2l0siW8ZWyqTqxOFxBCjthjTfAHrE8owe3hPxur7Wmn2LZciTYfTlKQZW6ujlhEv6N4V1HL4Md5hdtwy51_7RMzGG6MvvNbEU8_3GauIgaF7JcbQJAEAAIAAAABR4tbwLFF57frAdPyZsIeA6ljo_Y01u-2p5KTfJ2xa6ZhtEpzmC46Omcvps9MbFWgyz6536_77jx9nE3sePTSeyB5zyLznkGDKhjfWwx3KjbYnxCVCV-n2pqKtry0l8nkMj4MrjqoTXpvd_P0c_VGfVXCsVt7BYOO68QbD-m7Yz9rHIZn-CQ4po0FqS2elDVe9qwu_uATbAmOXlkWsbnFwa6_ZDHcSr2M-WZxHTVFin7vEWO7FxIQStabu_r4_0Mo_xaFlBKp2hl9Podq8ltx7KvhqFS0Xu8oIJGp1t5lQKoaJSRTgU8N8iEyQfCeU5hvynZVeoVPaXfMA-gyYfMGspLybaw7XaBOuFJ20-BZW0sAFGm_0sqNq7CLm7LibWNw”,”token_type”:”bearer”,”expires_in”:”300″,”scope”:”http:\/\/localhost\/ adminstrator poweruser”}
DotNetOpenAuth also has a WebServerClient class which can be used to acquire tokens and I have used in my test application instead of crafting raw HTTP requests. Following code snippet generates the same above request/response
Get Access Token
Ok Now the 2nd part is to use this access token for authentication & authorization when consuming ASP.NET Web APIs.
Web API Client
On line 8, I’m creating an instance of a customized HttpClient passing in the access token. The httpClient would use this access token for all subsequent HTTP requests
OAuth enabled HttpClient
OAuth2 Message Handler
Inside my Web API, I access the claims information using the standard IClaimsIdentity abstraction.
Accessing claims information
401 without an “access token”
200 OK with a Valid token
401 with Expired token
401 with Tempered token
Source code attached. Please feel free to download and use.
Original Post by ZulfiqarAhmed on May4th, 2012
Here: http://zamd.net/2012/05/04/claim-based-security-for-asp-net-web-apis-using-dotnetopenauth/
1. OAuth 2.0 issuer is an ASP.NET MVC application responsible for issuing token based on OAuth 2.0 ‘Password Credentials’ grant type.
2. Web API Host exposes secured Web APIs which can only be accessed by presenting a valid token issued by the trusted issuer
3. Sample thick client which consumes the Web API
I have used the DotNetOpenAuth.Ultimate NuGet package which is just a single assembly implementing quite a few security protocols. From OAuth 2.0 perspective, AuthorizationServer is the main class responsible for processing the token issuance request, producing and returning a token for valid & authenticated request. The token issuance action of my OAuthIssuerController looks like this:
OAuth 2.0 Issuer
public class OAuthIssuerController : Controller { public ActionResult Index() { var configuration = new IssuerConfiguration { EncryptionCertificate = new X509Certificate2(Server.MapPath("~/Certs/localhost.cer")), SigningCertificate = new X509Certificate2(Server.MapPath("~/Certs/localhost.pfx"), "a") }; var authorizationServer = new AuthorizationServer(new OAuth2Issuer(configuration)); var response = authorizationServer.HandleTokenRequest(Request).AsActionResult(); return response; } }
AuthorizationServer handles all the protocol details and delegate the real token issuance logic to a custom token issuer handler (OAuth2Issuer in following snippet)
Protocol independent issuer
public class OAuth2Issuer : IAuthorizationServer { private readonly IssuerConfiguration _configuration; public OAuth2Issuer(IssuerConfiguration configuration) { if (configuration == null) throw new ArgumentNullException(“configuration”); _configuration = configuration; } public RSACryptoServiceProvider AccessTokenSigningKey { get { return (RSACryptoServiceProvider)_configuration.SigningCertificate.PrivateKey; } } public DotNetOpenAuth.Messaging.Bindings.ICryptoKeyStore CryptoKeyStore { get { throw new NotImplementedException(); } } public TimeSpan GetAccessTokenLifetime(DotNetOpenAuth.OAuth2.Messages.IAccessTokenRequest accessTokenRequestMessage) { return _configuration.TokenLifetime; } public IClientDescription GetClient(string clientIdentifier) { const string secretPassword = “test1243″; return new ClientDescription(secretPassword, new Uri(“http://localhost/”), ClientType.Confidential); } public RSACryptoServiceProvider GetResourceServerEncryptionKey(DotNetOpenAuth.OAuth2.Messages.IAccessTokenRequest accessTokenRequestMessage) { return (RSACryptoServiceProvider)_configuration.EncryptionCertificate.PublicKey.Key; } public bool IsAuthorizationValid(DotNetOpenAuth.OAuth2.ChannelElements.IAuthorizationDescription authorization) { //claims added to the token authorization.Scope.Add(“adminstrator”); authorization.Scope.Add(“poweruser”); return true; } public bool IsResourceOwnerCredentialValid(string userName, string password) { return true; } public DotNetOpenAuth.Messaging.Bindings.INonceStore VerificationCodeNonceStore { get { throw new NotImplementedException(); } } }
Now with my issuer setup, I can acquire access tokens by POSTing following request to the token issuer endpoint
Client
POST /Issuer HTTP/1.1Content-Type: application/x-www-form-urlencoded; charset=utf-8
scope=http%3A%2F%2Flocalhost%2F&grant_type=client_credentials&client_id=zamd&client_secret=test1243
In response, I get 200 OK with following payload
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Content-Type: application/json; charset=utf-8
Server: Microsoft-IIS/7.5
Content-Length: 685
{“access_token”:”gAAAAC5KksmbH0FyG5snks_xOcROnIcPldpgksi5b8Egk7DmrRhbswiEYCX7RLdb2l0siW8ZWyqTqxOFxBCjthjTfAHrE8owe3hPxur7Wmn2LZciTYfTlKQZW6ujlhEv6N4V1HL4Md5hdtwy51_7RMzGG6MvvNbEU8_3GauIgaF7JcbQJAEAAIAAAABR4tbwLFF57frAdPyZsIeA6ljo_Y01u-2p5KTfJ2xa6ZhtEpzmC46Omcvps9MbFWgyz6536_77jx9nE3sePTSeyB5zyLznkGDKhjfWwx3KjbYnxCVCV-n2pqKtry0l8nkMj4MrjqoTXpvd_P0c_VGfVXCsVt7BYOO68QbD-m7Yz9rHIZn-CQ4po0FqS2elDVe9qwu_uATbAmOXlkWsbnFwa6_ZDHcSr2M-WZxHTVFin7vEWO7FxIQStabu_r4_0Mo_xaFlBKp2hl9Podq8ltx7KvhqFS0Xu8oIJGp1t5lQKoaJSRTgU8N8iEyQfCeU5hvynZVeoVPaXfMA-gyYfMGspLybaw7XaBOuFJ20-BZW0sAFGm_0sqNq7CLm7LibWNw”,”token_type”:”bearer”,”expires_in”:”300″,”scope”:”http:\/\/localhost\/ adminstrator poweruser”}
DotNetOpenAuth also has a WebServerClient class which can be used to acquire tokens and I have used in my test application instead of crafting raw HTTP requests. Following code snippet generates the same above request/response
Get Access Token
private static IAuthorizationState GetAccessToken() { var authorizationServer = new AuthorizationServerDescription { TokenEndpoint = new Uri(“http://localhost:1960/Issuer”), ProtocolVersion = ProtocolVersion.V20 }; var client = new WebServerClient(authorizationServer, “http://localhost/”); client.ClientIdentifier = “zamd”; client.ClientSecret = “test1243″; var state = client.GetClientAccessToken(new[] { “http://localhost/” }); return state; }
Ok Now the 2nd part is to use this access token for authentication & authorization when consuming ASP.NET Web APIs.
Web API Client
static void Main(string[] args) { var state = GetAccessToken(); Console.WriteLine(“Expires = {0}”, state.AccessTokenExpirationUtc); Console.WriteLine(“Token = {0}”, state.AccessToken); var httpClient = new OAuthHttpClient(state.AccessToken) { BaseAddress = new Uri(“http://localhost:2150/api/values”) }; Console.WriteLine(“Calling web api…”); Console.WriteLine(); var response = httpClient.GetAsync(“”).Result; if (response.StatusCode==HttpStatusCode.OK) Console.WriteLine(response.Content.ReadAsStringAsync().Result); else Console.WriteLine(response); Console.ReadLine(); }
On line 8, I’m creating an instance of a customized HttpClient passing in the access token. The httpClient would use this access token for all subsequent HTTP requests
OAuth enabled HttpClient
public class OAuthHttpClient : HttpClient { public OAuthHttpClient(string accessToken) : base(new OAuthTokenHandler(accessToken)) { } class OAuthTokenHandler : MessageProcessingHandler { string _accessToken; public OAuthTokenHandler(string accessToken) : base(new HttpClientHandler()) { _accessToken = accessToken; } protected override HttpRequestMessage ProcessRequest(HttpRequestMessage request, System.Threading.CancellationToken cancellationToken) { request.Headers.Authorization = new AuthenticationHeaderValue(“Bearer”, _accessToken); return request; } protected override HttpResponseMessage ProcessResponse(HttpResponseMessage response, System.Threading.CancellationToken cancellationToken) { return response; } } }
Relying Party (ASP.NET Web APIs)
Finally on the RP side, I have used standard MessageHandler extensibility to extract and validate the ‘access token’. The OAuth2 message handler also extracts the claims from the access token and create a ClaimsPrincipal which is passed on the Web API implementation for authorization decisions.OAuth2 Message Handler
public class OAuth2Handler : DelegatingHandler { private readonly ResourceServerConfiguration _configuration; public OAuth2Handler(ResourceServerConfiguration configuration) { if (configuration == null) throw new ArgumentNullException(“configuration”); _configuration = configuration; } protected override Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken cancellationToken) { HttpContextBase httpContext; string userName; HashSet<string> scope; if (!request.TryGetHttpContext(out httpContext)) throw new InvalidOperationException(“HttpContext must not be null.”); var resourceServer = new ResourceServer(new StandardAccessTokenAnalyzer( (RSACryptoServiceProvider)_configuration.IssuerSigningCertificate.PublicKey.Key, (RSACryptoServiceProvider)_configuration.EncryptionVerificationCertificate.PrivateKey)); var error = resourceServer.VerifyAccess(httpContext.Request, out userName, out scope); if (error != null) return Task<HttpResponseMessage>.Factory.StartNew(error.ToHttpResponseMessage); var identity = new ClaimsIdentity(scope.Select(s => new Claim(s, s))); if (!string.IsNullOrEmpty(userName)) identity.Claims.Add(new Claim(ClaimTypes.Name, userName)); httpContext.User = ClaimsPrincipal.CreateFromIdentity(identity); Thread.CurrentPrincipal = httpContext.User; return base.SendAsync(request, cancellationToken); } }
Inside my Web API, I access the claims information using the standard IClaimsIdentity abstraction.
Accessing claims information
public IEnumerable<string> Get() { if (User.Identity.IsAuthenticated && User.Identity is IClaimsIdentity) return ((IClaimsIdentity) User.Identity).Claims.Select(c => c.Value); return new string[] { “value1″, “value2″ }; }
Fiddler Testing
Once I got the “access token”, I can test few scenarios in fiddler by attaching and tweaking the token when calling my web api.401 without an “access token”
200 OK with a Valid token
401 with Expired token
401 with Tempered token
Source code attached. Please feel free to download and use.
Original Post by ZulfiqarAhmed on May4th, 2012
Here: http://zamd.net/2012/05/04/claim-based-security-for-asp-net-web-apis-using-dotnetopenauth/
相关文章推荐
- Integrating OpenID in an ASP.NET MVC Application using DotNetOpenAuth
- Professional DotNetNuke 4: Open Source Web Application Framework for ASP.NET 2.0
- [收藏]The Baker's Dozen: 13 Tips for Building Database Web Applications Using ASP.NET 3.5, LINQ, and SQL Server 2005 Reporting Services
- NWebsec 1.0.3 The Security library for ASP.NET
- Building an AJAX Based Web Chatting Application using ASP.NET 2.0(转载)
- [转]ASP.NET MVC 3 使用 DotNetOpenAuth 实现SSO
- [原]ASP.NET MVC 3 使用 DotNetOpenAuth 实现SSO
- ASP.NET MVC 3 使用 DotNetOpenAuth 实现SSO
- How to generate an RSS feed for your web site using ASP.NET
- How to generate an RSS feed for your web site using ASP.NET
- Building a Robust Web Based Email Client (WebMail) Using the IP*Works! ADO.NET Data Provider(中文)
- [ASP.NET]10 Tips for Writing High-Performance Web Applications
- Solution for Asp.net Exception about "Unable to load DLL (OraOps9.dll)" While using ODP.NET
- ComponentArt Web.UI for ASP.NET 2.X序列号
- ComponentArt WebChart 2006.1 for ASP.NET
- ComponentArt Web.UI 2006.1 for asp.net 2.0
- Rearchitect Your Web Applications for Microsoft ASP.NET 2.0
- Asp.net,IBatis For .Net,DAOFactory在Web开发中的数据表示
- Asp.net based Web Application部署后的问题
- Ajax Web Controls for ASP.NET!