diff --git a/Owin.Security.Providers/EVEOnline/Constants.cs b/Owin.Security.Providers/EVEOnline/Constants.cs new file mode 100644 index 0000000..113e213 --- /dev/null +++ b/Owin.Security.Providers/EVEOnline/Constants.cs @@ -0,0 +1,7 @@ +namespace Owin.Security.Providers.EVEOnline +{ + internal static class Constants + { + internal const string DefaultAuthenticationType = "EVEOnline"; + } +} diff --git a/Owin.Security.Providers/EVEOnline/EVEOnlineAuthenticationExtensions.cs b/Owin.Security.Providers/EVEOnline/EVEOnlineAuthenticationExtensions.cs new file mode 100644 index 0000000..e14ed56 --- /dev/null +++ b/Owin.Security.Providers/EVEOnline/EVEOnlineAuthenticationExtensions.cs @@ -0,0 +1,27 @@ +using System; + +namespace Owin.Security.Providers.EVEOnline +{ + public static class EVEOnlineAuthenticationExtensions + { + public static IAppBuilder UseEVEOnlineAuthentication(this IAppBuilder app, EVEOnlineAuthenticationOptions options) + { + if (app == null) + throw new ArgumentException("app"); + if (options == null) + throw new ArgumentException("options"); + + app.Use(typeof(EVEOnlineAuthenticationMiddleware), app, options); + + return app; + } + public static IAppBuilder UseEVEOnlineAuthentication(this IAppBuilder app, string clientId, string clientSecret) + { + return app.UseEVEOnlineAuthentication(new EVEOnlineAuthenticationOptions + { + ClientId = clientId, + ClientSecret = clientSecret + }); + } + } +} diff --git a/Owin.Security.Providers/EVEOnline/EVEOnlineAuthenticationHandler.cs b/Owin.Security.Providers/EVEOnline/EVEOnlineAuthenticationHandler.cs new file mode 100644 index 0000000..a0ea078 --- /dev/null +++ b/Owin.Security.Providers/EVEOnline/EVEOnlineAuthenticationHandler.cs @@ -0,0 +1,284 @@ +using System; +using System.Collections.Generic; +using System.Net.Http; +using System.Security.Claims; +using System.Threading.Tasks; +using Microsoft.Owin.Infrastructure; +using Microsoft.Owin.Logging; +using Microsoft.Owin.Security; +using Microsoft.Owin.Security.Infrastructure; +using Newtonsoft.Json; +using Newtonsoft.Json.Linq; + +namespace Owin.Security.Providers.EVEOnline +{ + public class EVEOnlineAuthenticationHandler : AuthenticationHandler + { + + private const string XmlSchemaString = "http://www.w3.org/2001/XMLSchema#string"; + private string _tokenEndpoint, + _characterIdEndpoint, + _oauthAuthEndpoint, + _serverHost; + + private readonly string _serverScheme = "https://"; + private readonly ILogger _logger; + private readonly HttpClient _httpClient; + + public EVEOnlineAuthenticationHandler(HttpClient httpClient, ILogger logger) + { + _httpClient = httpClient; + _logger = logger; + } + + protected override System.Threading.Tasks.Task InitializeCoreAsync() + { + return Task.Run(() => + { + switch (Options.Server) + { + case Server.Singularity: + _serverHost = "sisilogin.testeveonline.com"; + break; + default: + _serverHost = "login.eveonline.com"; + break; + } + + _tokenEndpoint = _serverScheme + _serverHost + "/oauth/token"; + _oauthAuthEndpoint = _serverScheme + _serverHost + "/oauth/authorize"; + _characterIdEndpoint = _serverScheme + _serverHost + "/oauth/verify"; + }); + } + + protected override async Task AuthenticateCoreAsync() + { + AuthenticationProperties properties = null; + + try + { + string code = null; + string state = null; + + var query = Request.Query; + var values = query.GetValues("code"); + if (values != null && values.Count == 1) + { + code = values[0]; + } + values = query.GetValues("state"); + if (values != null && values.Count == 1) + { + state = values[0]; + } + + properties = Options.StateDataFormat.Unprotect(state); + if (properties == null) + { + return null; + } + + // OAuth2 10.12 CSRF + if (!ValidateCorrelationId(properties, _logger)) + { + return new AuthenticationTicket(null, properties); + } + + // Check for error + if (Request.Query.Get("error") != null) + return new AuthenticationTicket(null, properties); + + var requestPrefix = Request.Scheme + "://" + Request.Host; + var redirectUri = requestPrefix + Request.PathBase + Options.CallbackPath; + + // Build up the body for the token request + var body = new List> + { + new KeyValuePair("grant_type", "authorization_code"), + new KeyValuePair("code", code), + new KeyValuePair("redirect_uri", redirectUri), + new KeyValuePair("client_id", Options.ClientId), + new KeyValuePair("client_secret", Options.ClientSecret) + }; + + // Request the token + var tokenResponse = await _httpClient.PostAsync(_tokenEndpoint, new FormUrlEncodedContent(body)); + tokenResponse.EnsureSuccessStatusCode(); + var text = await tokenResponse.Content.ReadAsStringAsync(); + + // Deserializes the token response + var response = JsonConvert.DeserializeObject(text); + var accessToken = (string)response.access_token; + var refreshToken = string.Empty; + if (response.refresh_token != null) + refreshToken = (string)response.refresh_token; + + var expires = (string)response.expires_in; + + // Get character data + var graphRequest = new HttpRequestMessage() + { + Method = HttpMethod.Get, + RequestUri = new Uri(_characterIdEndpoint) + }; + + graphRequest.Headers.Add("Authorization", "Bearer " + accessToken); + graphRequest.Headers.Add("Host", _serverHost); + graphRequest.Headers.UserAgent.ParseAdd("Microsoft Owin EVEOnline middleware"); + var graphResponse = await _httpClient.SendAsync(graphRequest); + graphResponse.EnsureSuccessStatusCode(); + text = await graphResponse.Content.ReadAsStringAsync(); + var characterId = JObject.Parse(text); + + var context = new EVEOnlineAuthenticatedContext(Context, characterId, accessToken, refreshToken, expires) + { + Identity = new ClaimsIdentity( + Options.AuthenticationType, + ClaimsIdentity.DefaultNameClaimType, + ClaimsIdentity.DefaultRoleClaimType) + }; + + if (!string.IsNullOrEmpty(context.CharacterId)) + { + context.Identity.AddClaim(new Claim(ClaimTypes.NameIdentifier, context.CharacterId, XmlSchemaString, Options.AuthenticationType)); + } + if (!string.IsNullOrEmpty(context.CharacterName)) + { + context.Identity.AddClaim(new Claim(ClaimTypes.Name, context.CharacterName, XmlSchemaString, Options.AuthenticationType)); + } + if (!string.IsNullOrEmpty(context.CharacterOwnerHash)) + { + context.Identity.AddClaim(new Claim("urn:eveonline:character_owner_hash", context.CharacterOwnerHash, XmlSchemaString, Options.AuthenticationType)); + } + if (!string.IsNullOrEmpty(context.AccessToken)) + { + context.Identity.AddClaim(new Claim("urn:eveonline:access_token", context.AccessToken, XmlSchemaString, Options.AuthenticationType)); + } + if (!string.IsNullOrEmpty(context.RefreshToken)) + { + context.Identity.AddClaim(new Claim("urn:eveonline:refresh_token", context.RefreshToken, XmlSchemaString, Options.AuthenticationType)); + } + context.Properties = properties; + + await Options.Provider.Authenticated(context); + + return new AuthenticationTicket(context.Identity, context.Properties); + + } + catch (Exception ex) + { + _logger.WriteError(ex.Message); + } + return new AuthenticationTicket(null, properties); + } + + protected override Task ApplyResponseChallengeAsync() + { + if (Response.StatusCode != 401) + { + return Task.FromResult(null); + } + + var challenge = Helper.LookupChallenge(Options.AuthenticationType, Options.AuthenticationMode); + + if (challenge != null) + { + var baseUri = + Request.Scheme + + Uri.SchemeDelimiter + + Request.Host + + Request.PathBase; + + var currentUri = + baseUri + + Request.Path + + Request.QueryString; + + var redirectUri = + baseUri + + Options.CallbackPath; + + var properties = challenge.Properties; + if (string.IsNullOrEmpty(properties.RedirectUri)) + { + properties.RedirectUri = currentUri; + } + + // OAuth2 10.12 CSRF + GenerateCorrelationId(properties); + + // comma separated + var scope = string.Join(" ", Options.Scope); + + var state = Options.StateDataFormat.Protect(properties); + + var authorizationEndpoint = + _oauthAuthEndpoint + + "?response_type=code" + + "&client_id=" + Uri.EscapeDataString(Options.ClientId) + + "&redirect_uri=" + Uri.EscapeDataString(redirectUri) + + "&scope=" + Uri.EscapeDataString(scope) + + "&state=" + Uri.EscapeDataString(state); + + Response.Redirect(authorizationEndpoint); + } + + return Task.FromResult(null); + } + + public override async Task InvokeAsync() + { + return await InvokeReplyPathAsync(); + } + + private async Task InvokeReplyPathAsync() + { + if (Options.CallbackPath.HasValue && Options.CallbackPath == Request.Path) + { + // TODO: error responses + + var ticket = await AuthenticateAsync(); + if (ticket == null) + { + _logger.WriteWarning("Invalid return state, unable to redirect."); + Response.StatusCode = 500; + return true; + } + + var context = new EVEOnlineReturnEndpointContext(Context, ticket) + { + SignInAsAuthenticationType = Options.SignInAsAuthenticationType, + RedirectUri = ticket.Properties.RedirectUri + }; + + await Options.Provider.ReturnEndpoint(context); + + if (context.SignInAsAuthenticationType != null && + context.Identity != null) + { + ClaimsIdentity grantIdentity = context.Identity; + if (!string.Equals(grantIdentity.AuthenticationType, context.SignInAsAuthenticationType, StringComparison.Ordinal)) + { + grantIdentity = new ClaimsIdentity(grantIdentity.Claims, context.SignInAsAuthenticationType, grantIdentity.NameClaimType, grantIdentity.RoleClaimType); + } + Context.Authentication.SignIn(context.Properties, grantIdentity); + } + + if (!context.IsRequestCompleted && context.RedirectUri != null) + { + string redirectUri = context.RedirectUri; + if (context.Identity == null) + { + // add a redirect hint that sign-in failed in some way + redirectUri = WebUtilities.AddQueryString(redirectUri, "error", "access_denied"); + } + Response.Redirect(redirectUri); + context.RequestCompleted(); + } + + return context.IsRequestCompleted; + } + return false; + } + } +} diff --git a/Owin.Security.Providers/EVEOnline/EVEOnlineAuthenticationMiddleware.cs b/Owin.Security.Providers/EVEOnline/EVEOnlineAuthenticationMiddleware.cs new file mode 100644 index 0000000..f9702c0 --- /dev/null +++ b/Owin.Security.Providers/EVEOnline/EVEOnlineAuthenticationMiddleware.cs @@ -0,0 +1,84 @@ +using System; +using System.Globalization; +using System.Net.Http; +using Microsoft.Owin; +using Microsoft.Owin.Logging; +using Microsoft.Owin.Security; +using Microsoft.Owin.Security.DataHandler; +using Microsoft.Owin.Security.DataProtection; +using Microsoft.Owin.Security.Infrastructure; +using Owin.Security.Providers.Properties; + +namespace Owin.Security.Providers.EVEOnline +{ + public class EVEOnlineAuthenticationMiddleware : AuthenticationMiddleware + { + private readonly HttpClient _httpClient; + private readonly ILogger _logger; + + public EVEOnlineAuthenticationMiddleware(OwinMiddleware next, IAppBuilder app, EVEOnlineAuthenticationOptions options) + : base(next, options) + { + if (String.IsNullOrWhiteSpace(Options.ClientId)) + throw new ArgumentException(String.Format(CultureInfo.CurrentCulture, + Resources.Exception_OptionMustBeProvided, "ClientId")); + if (String.IsNullOrWhiteSpace(Options.ClientSecret)) + throw new ArgumentException(String.Format(CultureInfo.CurrentCulture, + Resources.Exception_OptionMustBeProvided, "ClientSecret")); + + _logger = app.CreateLogger(); + + if (Options.Provider == null) + Options.Provider = new EVEOnlineAuthenticationProvider(); + + if (Options.StateDataFormat == null) + { + var dataProtector = app.CreateDataProtector( + typeof(EVEOnlineAuthenticationMiddleware).FullName, + Options.AuthenticationType, "v1"); + Options.StateDataFormat = new PropertiesDataFormat(dataProtector); + } + + if (String.IsNullOrEmpty(Options.SignInAsAuthenticationType)) + Options.SignInAsAuthenticationType = app.GetDefaultSignInAsAuthenticationType(); + + _httpClient = new HttpClient(ResolveHttpMessageHandler(Options)) + { + Timeout = Options.BackchannelTimeout, + MaxResponseContentBufferSize = 1024 * 1024 * 10 + }; + } + + /// + /// Provides the object for processing + /// authentication-related requests. + /// + /// + /// An configured with the + /// supplied to the constructor. + /// + protected override AuthenticationHandler CreateHandler() + { + return new EVEOnlineAuthenticationHandler(_httpClient, _logger); + } + + private static HttpMessageHandler ResolveHttpMessageHandler(EVEOnlineAuthenticationOptions options) + { + HttpMessageHandler handler = options.BackchannelHttpHandler ?? new WebRequestHandler(); + + // If they provided a validator, apply it or fail. + if (options.BackchannelCertificateValidator != null) + { + // Set the cert validate callback + var webRequestHandler = handler as WebRequestHandler; + if (webRequestHandler == null) + { + throw new InvalidOperationException(Resources.Exception_ValidatorHandlerMismatch); + } + webRequestHandler.ServerCertificateValidationCallback = options.BackchannelCertificateValidator.Validate; + } + + return handler; + } + } +} diff --git a/Owin.Security.Providers/EVEOnline/EVEOnlineAuthenticationOptions.cs b/Owin.Security.Providers/EVEOnline/EVEOnlineAuthenticationOptions.cs new file mode 100644 index 0000000..d4c86e1 --- /dev/null +++ b/Owin.Security.Providers/EVEOnline/EVEOnlineAuthenticationOptions.cs @@ -0,0 +1,115 @@ +using System; +using System.Collections.Generic; +using System.Net.Http; +using Microsoft.Owin; +using Microsoft.Owin.Security; + +namespace Owin.Security.Providers.EVEOnline +{ + public enum Server + { + Tranquility, + Singularity + } + + public class EVEOnlineAuthenticationOptions : AuthenticationOptions + { + /// + /// Initializes a new . + /// By default the scope is empty, you can add ie. publicData when initializing. + /// + public EVEOnlineAuthenticationOptions() + : base("EVEOnline") + { + Caption = Constants.DefaultAuthenticationType; + CallbackPath = new PathString("/signin-eveonline"); + AuthenticationMode = AuthenticationMode.Passive; + Scope = new List + { + }; + BackchannelTimeout = TimeSpan.FromSeconds(60); + Server = EVEOnline.Server.Tranquility; + } + + /// + /// Gets or sets the a pinned certificate validator to use to validate the endpoints used + /// in back channel communications belong to EVEOnline. + /// + /// + /// The pinned certificate validator. + /// + /// + /// If this property is null then the default certificate checks are performed, + /// validating the subject name and if the signing chain is a trusted party. + /// + public ICertificateValidator BackchannelCertificateValidator { get; set; } + + /// + /// The HttpMessageHandler used to communicate with EVEOnline. + /// This cannot be set at the same time as BackchannelCertificateValidator unless the value + /// can be downcast to a WebRequestHandler. + /// + public HttpMessageHandler BackchannelHttpHandler { get; set; } + + /// + /// Gets or sets timeout value in milliseconds for back channel communications with EVEOnline. + /// + /// + /// The back channel timeout in milliseconds. + /// + public TimeSpan BackchannelTimeout { get; set; } + + /// + /// The request path within the application's base path where the user-agent will be returned. + /// The middleware will process this request when it arrives. + /// Default value is "/signin-eveonline". + /// + public PathString CallbackPath { get; set; } + + /// + /// Get or sets the text that the user can display on a sign in user interface. + /// + public string Caption + { + get { return Description.Caption; } + set { Description.Caption = value; } + } + + /// + /// Gets or sets EVEOnline supplied Client Id + /// + public string ClientId { get; set; } + + /// + /// Gets or sets EVEOnline supplied Client Secret + /// + public string ClientSecret { get; set; } + + /// + /// Gets or sets the EVEOnline Server to authenticate against. + /// + public Server Server { get; set; } + + /// + /// Gets or sets the used in the authentication events + /// + public IEVEOnlineAuthenticationProvider Provider { get; set; } + + /// + /// A list of permissions to request. + /// + public IList Scope { get; private set; } + + /// + /// Gets or sets the name of another authentication middleware which will be responsible for actually issuing a user + /// . + /// + public string SignInAsAuthenticationType { get; set; } + + /// + /// Gets or sets the type used to secure data handled by the middleware. + /// + public ISecureDataFormat StateDataFormat { get; set; } + + } +} diff --git a/Owin.Security.Providers/EVEOnline/Provider/EVEOnlineAuthenticatedContext.cs b/Owin.Security.Providers/EVEOnline/Provider/EVEOnlineAuthenticatedContext.cs new file mode 100644 index 0000000..127dea4 --- /dev/null +++ b/Owin.Security.Providers/EVEOnline/Provider/EVEOnlineAuthenticatedContext.cs @@ -0,0 +1,99 @@ +// Copyright (c) Microsoft Open Technologies, Inc. All rights reserved. See License.txt in the project root for license information. + +using System; +using System.Globalization; +using System.Security.Claims; +using Microsoft.Owin; +using Microsoft.Owin.Security; +using Microsoft.Owin.Security.Provider; +using Newtonsoft.Json.Linq; + +namespace Owin.Security.Providers.EVEOnline +{ + /// + /// Contains information about the login session as well as the user . + /// + public class EVEOnlineAuthenticatedContext : BaseContext + { + /// + /// Initializes a + /// + /// The OWIN environment + /// The JSON-serialized userId + /// + /// EVEOnline Access token + /// Seconds until expiration + public EVEOnlineAuthenticatedContext(IOwinContext context, JObject characterData, string accessToken, string refreshToken, string expires) + : base(context) + { + JsonCharacterId = characterData; + AccessToken = accessToken; + RefreshToken = refreshToken; + + int expiresValue; + if (Int32.TryParse(expires, NumberStyles.Integer, CultureInfo.InvariantCulture, out expiresValue)) + { + ExpiresIn = TimeSpan.FromSeconds(expiresValue); + } + + CharacterId = TryGetValue(characterData, "CharacterID"); + CharacterName = TryGetValue(characterData, "CharacterName"); + CharacterOwnerHash = TryGetValue(characterData, "CharacterOwnerHash"); + } + + /// + /// Gets the JSON-serialized user ID + /// + /// + /// Contains the EVEOnline user ID + /// + public JObject JsonCharacterId { get; private set; } + + /// + /// Gets EVEOnline OAuth access token + /// + public string AccessToken { get; private set; } + + /// + /// Gets EVEOnline OAuth refresh token + /// + public string RefreshToken { get; private set; } + + /// + /// Gets EVEOnline access token expiration time + /// + public TimeSpan? ExpiresIn { get; set; } + + /// + /// Gets EVEOnline character owner hash. It changes only if character is transfered + /// to other account. + /// + public string CharacterOwnerHash { get; private set; } + + /// + /// Gets EVEOnline character ID + /// + public string CharacterId { get; private set; } + + /// + /// Gets the EVEOnline character name + /// + public string CharacterName { get; private set; } + + /// + /// Gets the representing the user + /// + public ClaimsIdentity Identity { get; set; } + + /// + /// Gets or sets a property bag for common authentication properties + /// + public AuthenticationProperties Properties { get; set; } + + private static string TryGetValue(JObject user, string propertyName) + { + JToken value; + return user.TryGetValue(propertyName, out value) ? value.ToString() : null; + } + } +} \ No newline at end of file diff --git a/Owin.Security.Providers/EVEOnline/Provider/EVEOnlineAuthenticationProvider.cs b/Owin.Security.Providers/EVEOnline/Provider/EVEOnlineAuthenticationProvider.cs new file mode 100644 index 0000000..b7c7ac4 --- /dev/null +++ b/Owin.Security.Providers/EVEOnline/Provider/EVEOnlineAuthenticationProvider.cs @@ -0,0 +1,51 @@ +using System; +using System.Threading.Tasks; + + +namespace Owin.Security.Providers.EVEOnline +{ + /// + /// Default implementation. + /// + public class EVEOnlineAuthenticationProvider : IEVEOnlineAuthenticationProvider + { + /// + /// Initializes a + /// + public EVEOnlineAuthenticationProvider() + { + OnAuthenticated = context => Task.FromResult(null); + OnReturnEndpoint = context => Task.FromResult(null); + } + + /// + /// Gets or sets the function that is invoked when the Authenticated method is invoked. + /// + public Func OnAuthenticated { get; set; } + + /// + /// Gets or sets the function that is invoked when the ReturnEndpoint method is invoked. + /// + public Func OnReturnEndpoint { get; set; } + + /// + /// Invoked whenever Battle.net successfully authenticates a user + /// + /// Contains information about the login session as well as the user . + /// A representing the completed operation. + public Task Authenticated(EVEOnlineAuthenticatedContext context) + { + return OnAuthenticated(context); + } + + /// + /// Invoked prior to the being saved in a local cookie and the browser being redirected to the originally requested URL. + /// + /// + /// A representing the completed operation. + public Task ReturnEndpoint(EVEOnlineReturnEndpointContext context) + { + return OnReturnEndpoint(context); + } + } +} diff --git a/Owin.Security.Providers/EVEOnline/Provider/EVEOnlineReturnEndpointContext.cs b/Owin.Security.Providers/EVEOnline/Provider/EVEOnlineReturnEndpointContext.cs new file mode 100644 index 0000000..f0cc7f7 --- /dev/null +++ b/Owin.Security.Providers/EVEOnline/Provider/EVEOnlineReturnEndpointContext.cs @@ -0,0 +1,26 @@ +// Copyright (c) Microsoft Open Technologies, Inc. All rights reserved. See License.txt in the project root for license information. + +using Microsoft.Owin; +using Microsoft.Owin.Security; +using Microsoft.Owin.Security.Provider; + +namespace Owin.Security.Providers.EVEOnline +{ + /// + /// Provides context information to middleware providers. + /// + public class EVEOnlineReturnEndpointContext : ReturnEndpointContext + { + /// + /// + /// + /// OWIN environment + /// The authentication ticket + public EVEOnlineReturnEndpointContext( + IOwinContext context, + AuthenticationTicket ticket) + : base(context, ticket) + { + } + } +} diff --git a/Owin.Security.Providers/EVEOnline/Provider/IEVEOnlineAuthenticationProvider.cs b/Owin.Security.Providers/EVEOnline/Provider/IEVEOnlineAuthenticationProvider.cs new file mode 100644 index 0000000..e38004d --- /dev/null +++ b/Owin.Security.Providers/EVEOnline/Provider/IEVEOnlineAuthenticationProvider.cs @@ -0,0 +1,21 @@ +using System.Threading.Tasks; + +namespace Owin.Security.Providers.EVEOnline +{ + public interface IEVEOnlineAuthenticationProvider + { + /// + /// Invoked whenever Battle.net succesfully authenticates a user + /// + /// Contains information about the login session as well as the user . + /// A representing the completed operation. + Task Authenticated(EVEOnlineAuthenticatedContext context); + + /// + /// Invoked prior to the being saved in a local cookie and the browser being redirected to the originally requested URL. + /// + /// + /// A representing the completed operation. + Task ReturnEndpoint(EVEOnlineReturnEndpointContext context); + } +} diff --git a/Owin.Security.Providers/Owin.Security.Providers.csproj b/Owin.Security.Providers/Owin.Security.Providers.csproj index 188c5a6..b92be7c 100644 --- a/Owin.Security.Providers/Owin.Security.Providers.csproj +++ b/Owin.Security.Providers/Owin.Security.Providers.csproj @@ -103,6 +103,15 @@ + + + + + + + + +