Skip to content

Commit 4c59689

Browse files
RevsgaardRevsgaard
authored
Merge pull request #18 from ITfoxtec/Development
.NET 6.0 and .NET 5.0 only read ID token. .NET Standard 2.0 validates…
2 parents d1a980c + edefb51 commit 4c59689

File tree

2 files changed

+44
-28
lines changed

2 files changed

+44
-28
lines changed

‎src/ITfoxtec.Identity.BlazorWA.Oidc/ITfoxtec.Identity.BlazorWA.Oidc.csproj

+3-3
Original file line numberDiff line numberDiff line change
@@ -22,9 +22,9 @@ The component automatically handle token / session update with use of the refres
2222
<PackageTags>Blazor WebAssembly OpenID Connect (OIDC) Proof Key for Code Exchange (PKCE) id token access token refresh token</PackageTags>
2323
<GeneratePackageOnBuild>true</GeneratePackageOnBuild>
2424
<Copyright>© 2020 ITfoxtec</Copyright>
25-
<AssemblyVersion>1.6.2.0</AssemblyVersion>
26-
<FileVersion>1.6.2.0</FileVersion>
27-
<Version>1.6.2</Version>
25+
<AssemblyVersion>1.6.3.0</AssemblyVersion>
26+
<FileVersion>1.6.3.0</FileVersion>
27+
<Version>1.6.3</Version>
2828
</PropertyGroup>
2929

3030
<ItemGroup>

‎src/ITfoxtec.Identity.BlazorWA.Oidc/OpenidConnectPkce.cs

+41-25
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,9 @@
1515
using System.Security;
1616
using System.Security.Claims;
1717
using System.Threading.Tasks;
18+
#if !NET50 && !NET60
19+
using ITfoxtec.Identity.Models;
20+
#endif
1821

1922
namespace ITfoxtec.Identity.BlazorWebAssembly.OpenidConnect
2023
{
@@ -161,13 +164,19 @@ public async Task LoginCallBackAsync(string responseUrl)
161164
if (tokenResponse.AccessToken.IsNullOrEmpty()) throw new ArgumentNullException(nameof(tokenResponse.AccessToken), tokenResponse.GetTypeName());
162165
if (tokenResponse.ExpiresIn <= 0) throw new ArgumentNullException(nameof(tokenResponse.ExpiresIn), tokenResponse.GetTypeName());
163166

164-
//var oidcDiscoveryKeySet = await GetOidcDiscoveryKeysAsync(openidClientPkceState.OidcDiscoveryUri);
165-
166-
//(var idTokenPrincipal, _) = JwtHandler.ValidateToken(tokenResponse.IdToken, oidcDiscovery.Issuer, oidcDiscoveryKeySet.Keys.ToMSJsonWebKeys(), openidClientPkceState.ClientId,
167-
// nameClaimType: globalOpenidClientPkceSettings.NameClaimType, roleClaimType: globalOpenidClientPkceSettings.RoleClaimType);
168-
// Changed to only read ID token and not do validation
169-
167+
// .NET 5.0 error, System.Security.Cryptography.RSA.Create() - System.PlatformNotSupportedException: System.Security.Cryptography.Algorithms is not supported on this platform.
168+
// https://github.com/dotnet/aspnetcore/issues/26123
169+
// https://github.com/dotnet/runtime/issues/40074
170+
// .NET 7
171+
// https://github.com/dotnet/designs/blob/main/accepted/2021/blazor-wasm-crypto.md#net-7-plan
172+
#if !NET50 && !NET60
173+
var oidcDiscoveryKeySet = await GetOidcDiscoveryKeysAsync(openidClientPkceState.OidcDiscoveryUri);
174+
175+
(var idTokenPrincipal, _) = JwtHandler.ValidateToken(tokenResponse.IdToken, oidcDiscovery.Issuer, oidcDiscoveryKeySet.Keys.ToMSJsonWebKeys(), openidClientPkceState.ClientId,
176+
nameClaimType: globalOpenidClientPkceSettings.NameClaimType, roleClaimType: globalOpenidClientPkceSettings.RoleClaimType);
177+
#else
170178
var idTokenPrincipal = JwtHandler.ReadTokenClaims(tokenResponse.IdToken);
179+
#endif
171180

172181
var nonce = idTokenPrincipal.Claims.Where(c => c.Type == JwtClaimTypes.Nonce).Select(c => c.Value).FirstOrDefault();
173182
if (!openidClientPkceState.Nonce.Equals(nonce, StringComparison.Ordinal))
@@ -228,13 +237,19 @@ public async Task<OidcUserSession> HandleRefreshTokenAsync(OidcUserSession userS
228237
if (tokenResponse.AccessToken.IsNullOrEmpty()) throw new ArgumentNullException(nameof(tokenResponse.AccessToken), tokenResponse.GetTypeName());
229238
if (tokenResponse.ExpiresIn <= 0) throw new ArgumentNullException(nameof(tokenResponse.ExpiresIn), tokenResponse.GetTypeName());
230239

231-
//var oidcDiscoveryKeySet = await GetOidcDiscoveryKeysAsync(oidcDiscoveryUri);
232-
233-
//(var idTokenPrincipal, _) = JwtHandler.ValidateToken(tokenResponse.IdToken, oidcDiscovery.Issuer, oidcDiscoveryKeySet.Keys, clientId,
234-
// nameClaimType: globalOpenidClientPkceSettings.NameClaimType, roleClaimType: globalOpenidClientPkceSettings.RoleClaimType);
235-
// Changed to only read ID token and not do validation
236-
240+
// .NET 5.0 error, System.Security.Cryptography.RSA.Create() - System.PlatformNotSupportedException: System.Security.Cryptography.Algorithms is not supported on this platform.
241+
// https://github.com/dotnet/aspnetcore/issues/26123
242+
// https://github.com/dotnet/runtime/issues/40074
243+
// .NET 7
244+
// https://github.com/dotnet/designs/blob/main/accepted/2021/blazor-wasm-crypto.md#net-7-plan
245+
#if !NET50 && !NET60
246+
var oidcDiscoveryKeySet = await GetOidcDiscoveryKeysAsync(oidcDiscoveryUri);
247+
248+
(var idTokenPrincipal, _) = JwtHandler.ValidateToken(tokenResponse.IdToken, oidcDiscovery.Issuer, oidcDiscoveryKeySet.Keys, clientId,
249+
nameClaimType: globalOpenidClientPkceSettings.NameClaimType, roleClaimType: globalOpenidClientPkceSettings.RoleClaimType);
250+
#else
237251
var idTokenPrincipal = JwtHandler.ReadTokenClaims(tokenResponse.IdToken);
252+
#endif
238253

239254
if (!subject.IsNullOrEmpty() && subject != idTokenPrincipal.Claims.Where(c => c.Type == globalOpenidClientPkceSettings.NameClaimType).Single().Value)
240255
{
@@ -353,19 +368,20 @@ private async Task<OidcDiscovery> GetOidcDiscoveryAsync(string oidcDiscoveryUri)
353368
}
354369
}
355370

356-
// Changed to only read ID token and not do validation
357-
//private async Task<JsonWebKeySet> GetOidcDiscoveryKeysAsync(string oidcDiscoveryUri)
358-
//{
359-
// try
360-
// {
361-
// var oidcDiscoveryHandler = serviceProvider.GetService<OidcDiscoveryHandler>();
362-
// return await oidcDiscoveryHandler.GetOidcDiscoveryKeysAsync(oidcDiscoveryUri);
363-
// }
364-
// catch (Exception ex)
365-
// {
366-
// throw new Exception($"Failed to fetch OIDC Discovery Keys from discovery '{oidcDiscoveryUri}'.", ex);
367-
// }
368-
//}
371+
#if !NET50 && !NET60
372+
private async Task<JsonWebKeySet> GetOidcDiscoveryKeysAsync(string oidcDiscoveryUri)
373+
{
374+
try
375+
{
376+
var oidcDiscoveryHandler = serviceProvider.GetService<OidcDiscoveryHandler>();
377+
return await oidcDiscoveryHandler.GetOidcDiscoveryKeysAsync(oidcDiscoveryUri);
378+
}
379+
catch (Exception ex)
380+
{
381+
throw new Exception($"Failed to fetch OIDC Discovery Keys from discovery '{oidcDiscoveryUri}'.", ex);
382+
}
383+
}
384+
#endif
369385

370386
private async Task<string> SaveStateAsync(OpenidConnectPkceSettings openidConnectPkceSettings, string callBackUri, string redirectUri, string codeVerifier = null, string nonce = null)
371387
{

0 commit comments

Comments
 (0)