From e4b60ca7ddfada2ad66e3dc706a6d4c885f5ca9a Mon Sep 17 00:00:00 2001 From: RajkumarMondal Date: Mon, 12 Oct 2015 23:51:32 +0530 Subject: [PATCH] Fixed bug. Internal redirect was hard coded, changed to match quality of other providers and remove hard coded paths. Is now able to operate with controllers not named "Account" with any view/path instead of the previous hard coded path. --- .../ArcGISOnlineAuthenticationHandler.cs | 39 ++++++++++++++---- ...-OwinOAuthProvidersDemo-20131113093838.mdf | Bin 3211264 -> 3211264 bytes ...nOAuthProvidersDemo-20131113093838_log.ldf | Bin 1048576 -> 1048576 bytes 3 files changed, 30 insertions(+), 9 deletions(-) diff --git a/Owin.Security.Providers/ArcGISOnline/ArcGISOnlineAuthenticationHandler.cs b/Owin.Security.Providers/ArcGISOnline/ArcGISOnlineAuthenticationHandler.cs index b9f9ee1..a5c71ce 100644 --- a/Owin.Security.Providers/ArcGISOnline/ArcGISOnlineAuthenticationHandler.cs +++ b/Owin.Security.Providers/ArcGISOnline/ArcGISOnlineAuthenticationHandler.cs @@ -34,6 +34,7 @@ namespace Owin.Security.Providers.ArcGISOnline try { string code = null; + string state = null; IReadableStringCollection query = Request.Query; IList values = query.GetValues("code"); @@ -41,18 +42,34 @@ namespace Owin.Security.Providers.ArcGISOnline { code = values[0]; } + values = query.GetValues("state"); + if (values != null && values.Count == 1) + { + state = values[0]; + } + properties = Options.StateDataFormat.Unprotect(state); + if (properties == null) + { + return null; + } + // OAuth2 10.12 CSRF + if (!ValidateCorrelationId(properties,logger)) + { + return new AuthenticationTicket(null, properties); + } + string requestPrefix = Request.Scheme + "://" + Request.Host; string redirectUri = requestPrefix + Request.PathBase + Options.CallbackPath; // Build up the body for the token request var body = new List>(); + body.Add(new KeyValuePair("grant_type", "authorization_code")); body.Add(new KeyValuePair("code", code)); body.Add(new KeyValuePair("redirect_uri", redirectUri)); body.Add(new KeyValuePair("client_id", Options.ClientId)); body.Add(new KeyValuePair("client_secret", Options.ClientSecret)); - body.Add(new KeyValuePair("grant_type", "authorization_code")); - + // Request the token var requestMessage = new HttpRequestMessage(HttpMethod.Post, Options.Endpoints.TokenEndpoint); requestMessage.Headers.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json")); @@ -104,12 +121,8 @@ namespace Owin.Security.Providers.ArcGISOnline Request.Host + Request.PathBase; - context.Properties = new AuthenticationProperties - { - RedirectUri = baseUri + - "/Account/ExternalLoginCallback" - }; - + context.Properties = properties; + await Options.Provider.Authenticated(context); return new AuthenticationTicket(context.Identity, context.Properties); @@ -146,7 +159,14 @@ namespace Owin.Security.Providers.ArcGISOnline string redirectUri = baseUri + Options.CallbackPath; + AuthenticationProperties properties=challenge.Properties; + if (string.IsNullOrEmpty(properties.RedirectUri)) + { + properties.RedirectUri = currentUri; + } + GenerateCorrelationId(properties); + string state = Options.StateDataFormat.Protect(properties); // comma separated string scope = string.Join(",", Options.Scope); @@ -154,7 +174,8 @@ namespace Owin.Security.Providers.ArcGISOnline Options.Endpoints.AuthorizationEndpoint + "?client_id=" + Uri.EscapeDataString(Options.ClientId) + "&response_type=" + Uri.EscapeDataString(scope) + - "&redirect_uri=" + Uri.EscapeDataString(redirectUri); + "&redirect_uri=" + Uri.EscapeDataString(redirectUri) + + "&state=" + Uri.EscapeDataString(state); Response.Redirect(authorizationEndpoint); } diff --git a/OwinOAuthProvidersDemo/App_Data/aspnet-OwinOAuthProvidersDemo-20131113093838.mdf b/OwinOAuthProvidersDemo/App_Data/aspnet-OwinOAuthProvidersDemo-20131113093838.mdf index 0961ca784a28222be15d363238a999f850c018a8..ca288e8ea4931136ba0ee11d576dfe38f966c5bb 100644 GIT binary patch delta 3597 zcmcIm4Nz3q6~6bq-R1FsWtYca*kyUZhMxr#5cx5tF2u$*?Ib7!tM%srku)YM!Dx&+ zu#R?_q^W~3cuZR}=$JNXJDnJnhfPu-)6Ot$hMFiGv)}1gO1oz;v{opiobBdp(~=N zh-qdKYy|7!C5MGBY8H+KyWx5_o%tFeFqt2p45e4aJ@%10LIU%Q8Aj^h(7j>+{(Mbz zByA7R>Iyr^r7(F-%%xjkze-DbPvutc`I#eIEJtsq!NI2YvvCy7_=Mwo9T}N^7E0nB zp`8CxDE^C9I}H5Dx)HQbtnskvQ&F+jVqmp!{HnN>2jnbcF0nmp2+{=;*F>*UNWMun zl2zmpvX(qWp1|iSnEt6FCodLxcXjb?;%6Qx>&Fm7uV9EnEX26~86vBe9AH85YC+GZ z;?`aD5|0hezi5?W*E5IMw(!85`J{%-CKY5BDMwjJX7jMT5;E@Shzg4J5~>f4iNzMZ zezUkug#KwURjzf$Cy1#B?Vl;|;k4Mux8NqES{Ogv{-HhgH?}>FY8IKs%_nonGO~y? zlhrU;t__xw<$26kuO=naV^B6`E$Z!)?5IBdLy4)j-jF2W-~FvN{x_D@f#Db& z`n8+}>IrKyqsdmZG1w`nK`9kNPYS#Pc2Y?a;wj9%U-E*sT(UvCAldX0Drug`3toUD z&35_yCAWlw;~U4E<2Clm=QT&H~T0nGv1#NfRb5R3t46>w06c^kG9}k!G9K zK>4mzv^%`u(t$Xd0K<<;MbOiT1!3m^LjvsjTrq6$n+7a+0)_e=l8>{X^SUC@M_{r6 zgH2=t*KHQ&%3Q#*M$9z<7Z_6*YQkItjhJiL(EcDA>Tf6!!$cz{`F+F3&4ax7MQUQjK%9+sq zk!%P1DH*+;k|k<^#i!&N6uS(O{g&*4SI^20C_Rmw+Xe@%Y2ZFB=OB^mO@@wxT=4Q~ z*<(0x!Kk4(KPM=A&d7PDx$X?7G@s#9tve~F>2IBpW%{L{uAY_cXsG=K&QYt&5EuLCf(M&Zr4foD^YIQ`OMP%IeQhb&FQ$j)^MvTH`2g9Q^|p? zKBWNSE0h6R4bD=f`L1Id@Yt3>D?{#RF>)WSMDDj3cL``!isQ}!ALvchN}g!hnbDLU z^eaJsa?qa=^rr^>X+b|)?g{!cf__)O-<_)Y7V+h&lQUArF}~<>M1NPVR)4Y}Tn_h= zWW09dhs)7?#QjjhUF-9J3@ZlRslu^j{h2}c5jCpwyOk*j znV656(g@nZtH623YJU6&WBR__w_#CVZdzCCvkiD_A|#&p7TU;@{CAifCVwKW_zkVV zPk1$H<9Z4Ht0HB%ADLE;zZ%qPu)h^i!r4{GtwLKBGRlxqjamy{1uF4ZjZ+s*J4(Q)q^#GX!v}`<@4duqK$sw!%>-1k$ zoiGaCF0nL*J)%ZN^y%qbTT~wA_7w1nLrABmlV(Td!B*R3Fi+#LiLV=ZsNQX`RP`oy z6_Q%=Jc1Q+0r@s*AZqjt^6Sn~W?}Kh*J?XU@`^q^&x=V$w)B4%s|Be$Jez3l9ZB*H zYxp65>08N97tl0sCoI*x_O7)gi0OSboA>`ORpfTaQ+(bdTq505U0%e!h&)6-q5x5d V@F9v2#fTEb48%-*s;g88{2N_{PV@i( delta 2376 zcmZuyeQZ-z6z_d~?QY-7Soca>*3z$Suyqw?V0;Le2Y;XvqnqnCXC^C%#4qAlz{rQQ zL}&x?V+7_=60j=F1dz{dcZ81(VgfM=B;bIKkFp>V6UdY}CL(xlU*D{T+y34;@4Rz< z_ndR@yDt*?jzl=xNziMp)9G{sp^asIcXn=^b==Puc*#8CJ#X>nD+gN*vP%5E0IWc8+PZFfy zFi}|PzEq+5dG|H~cNi$qm-kt~>&JtfN91&PJqVH@dDbmeAhl4pD z3lHG6a#@Z_9!hO|zb6KjMe>*p6(S2K_1(GbM4!G$WCL;9BtiQ_y^Wej{A%8o(`JTq z5A~r`qU(@E)EH2nR@jd`(T=bv5onwu_kz1zrtC>U3=r0&7jskA8*H9I^pn_nqlhrD z^+w}|%L5H$3R1j7esE4gspUBumCOP^tlsHVdl50d<=hxMyAoPt@)syujIYIZY%#JO zTe6xLq_UfZp_?ly-{j|ns$c=cRWkn)1&KV%BmUlkm1 zW;RyIBOyd+E(}%S#XC{6)rW9_&A7l=O-~J$9SLFCX+z^2G*k@A!-jzn*839tR)sb8 z49b2|uj==>J{K&nBg@um^kF>VX(%wqX#&GtvB(&Ja1CxQriN535v)))Bo7;Kb{?0? zq-6;C(t3QMAi}938P}!;i+HXU6P}ZDi{SzyOl*9MbZ^3NA43^^+-C44)IRn|hiy=Q zMKZyW6NW4}(;?+R<0ZW0oR^UGyhMorwdbX2C^o3Vw_kF?)`XM`Wf#!rzUqTkJGd@L zesoOfHL8w5PS|uoa;pSRIHl_ImkaWz7p1Y9dG5~xI2s2^?Q~GjxuLt6~$>?&! zWXo^nt_Xh6@dJdvLfSarcDgFvqmiAXnSWN^4v`(bGO~=s2Cj}o>?A&w)Hs zHtuccI-0kLdAsxOhYP8*#_@Ru89!lp_HF4;(3*qS>r^tYJZNXVGvu*)RswQN`}!LRYpgZ{HWsWR9v=jpfc5??b1Q(&l$7ulrzuq>bo1Kr&D&- zS$U7POHkkKvazMzu6FNmZ(hVWZ9IE=ekG5=)4=6{Z~I*mtV_C@RLyYBb(;`);+m@v z9R03ZLSl{mF2opw8{t8C5kA(~?{7Uay+74XwiLM5M2+YrDpU@^{PgvW{zo6opm$rIX;A6Ih0Xt=Kd#cp9Famq5n?Q29HJOe Wf(Rf=5kbUbi1COC%n>QO`TjpL1$(Uk diff --git a/OwinOAuthProvidersDemo/App_Data/aspnet-OwinOAuthProvidersDemo-20131113093838_log.ldf b/OwinOAuthProvidersDemo/App_Data/aspnet-OwinOAuthProvidersDemo-20131113093838_log.ldf index 75f6af2689fbacac42fabff31776a0f31844fda0..b232d0f4c70cc0fc50e09136e5dc9f942c35ec85 100644 GIT binary patch delta 15080 zcmeG@3v^UPmiN``?sSJF-Jv00AulBS44)842pHuBgW!k~`H0|$1_Tk2Bq$PpbVt^R zt`14wBn7BD(GgbN9Zw*`5p_r7s0UY9grkgtADT~;aoj!OobfY`$lhD^s{3_tW<0Qa zc4kj1r{1e~@2z`p-MV$_zUr4q#EeADrV7`|#^xKWlPSiI(C^*(5dhGD;Wb_iY(}tZ zSfib*JTJTR_hEC&50FVXKzHZNlpjU5%2S!#8JO9l;pOMrhVSz3|1M9%%CPFseV6BQ zZ5~{W!XioF)d84+?Q5};F0K1|*r{-HWiY&?YM}=K<^$6nJr%~rLygn%ib@-E2(HRS zI|~IqMrSC@wFz`xp)V&9=KIsKkT5FmJt_M`RMH2Qy@omggjItG1;ijQfPzz7Dl+${ zLO}vJiV_q98L^gVgqBJ{uXIQSltT7Eb7LdF9?88}P3^$FcMZlypt*AJOa*;)Q$Rq~ z^s2j%ftRj|mVVU!U|3vDvVfwac5~%<`ES_(rABC}v=@9mq=|;dtdo_Q;klA+&n3PfMm5qC| zSA$S+#hy=@pTJ(Jt?o+Q-h9o^q;q_~;qHq!kpfCDH4Y_6Ju3zV0v6an)jk!*m3fg> zy~-7CdRm&x-Eg;HYg5KE83Dy>OMQ+$eS5{6*q|-ub7v&B!Kd?!Mbx^Q_wqVR&eZXvCaF2~Zv# zQ_ODMu}(5n##VPl_aD7hNZ@z>CgK7a%{eJe_mi>ENg@wQs|8x*T~H(O3~jQQMP+T% z4m|)P1t@>lG8%!SghVLY_5H2FdzE4#n~&;W;phR)mnV^nr70qpZUP0?obZ9KYXuvn zj-pWZ*=;+E5~J8Fbrn6>5!&~umVQOZy!GPnX>Fd?jr*a*+w00%}O02$MczXWRrRs(AYE9obd<*Uc& zOU_EQKc*JWFhxOQY4D&!$y!^)`Y-mrg0?ECb_iAqHrNW-O7ZIpv|O#6*A?q$XQ>2r zJn)()ZnJt@oqglh6rMSCQ89H_+f#QbnZ{9~yskvQU}*2TtAWu-BK~LeIPtbEx4WuP$G|f?-UaDt~CrNHGpIL}d%6l=#aAD0r2s$zJ1Ew+U z2K>V(UQ?>)yQd;~IjND23Of~W4ojDU%5Yc)(o5Oc5Gf1|t6L1K8@dr@4{NMuT9wOQ z?C0Rg>&o=~{QPn~IdL2=!G3YM9-L?(17ffLg|V29v8>Wo(O9gpbMxJ^vEK|al<~cX zB0Y~7(+Z1 z5zu5nv094}!4}}Ew<{KiwKxU=Au#YtX@U@jcYronYrB_t6qnyHbgh+okOwOCa;v?~ z!=Ih3C%YfUDfIGRPuAZOO&@>w0=t>SudC4acns_v0e=34`kSi#t)uU(^WBhIGvpDW@|{j6W#RHOy1{H>d;`jsg$sub(t zl@dO@txCTw22ZuFyIIj^t%}p9S)*4;`2B5{=mTQ(e(My%vjqR$x5ViK*4wuz_{P<7 zc)Io2YRM$hxjx>Nme_wq6zEI@lV0M~rLEoVe`I9qkw9#^Ddni?ULzxnCf0>>`> zf@7C%$N8WMtDEpxf1I$AjUsYIY$)EaY>7oK1D_&THTaDPY#4ke2sT7%pq;e zf<)F{!0aLggl?#b3zGkJ`yU$WuED;d#KpMdVi>X3AP4B(joPIsroVOhdxnc_!e5!G z6_rlOPZN&RiZjqB z2nI!(Vvud^f7h@Xq|Ma^hg-(K?KVFr22|o&cw+})^=JXfAwM#ShlXG> zD!vC*NJIKBW`oAXXQMxo%4{*w@f%`l8`$|NnJpHI)UCPNIZSs!hZPjPKcpVkt>J!^3N@=Pb zL5OA`gfsH1|pa_J1=z(hw=?Gs)>OV;Vq zUuw#wL$*tsTV%a(<@9kVfyz30gD_9$ ztS~qdrorv74E=dEtP-bb%lLZEhJ<}ccLoZ_0$>scjqpPCjEWtzt1?gnQ7A~`OO%LS zG${ME^q{oEcV*C4`kS;owMYmt%iDtVs3@j)}0s zQx9rMVMBD6L51)XRE`PODyU?|f(or4d5qCJsGN)im8cz5x+tjh`}09Xh{gT#<{H+X zMiE7Al99^TCYe4~PyyU(-|rHUC4D$df>M|O<1t|>#Z0DD#uYD8^+Moa08Hww5!Mk^ z@a0YviYl%%qRQTvzq_ma>BPtqv!1X{Vq_s4owHXDRkBL0CDaGLw+UXeg^d&{BMuh@F-o zSqZk53*;Jv--x-+t*{7lo*HVKtHnU*B8$#;)>_3n{w z>LFIl;#pZ=Q0;pML_djO{l5&VNpOWL{toyCYD0@|`Y-Og^~_|gTLjnbwwJeyFo?u< z>89X%=^4S*UhI-HgKp8w^@G6^R~8DF!SgNt$9k4~-Em}YAdr;mMpT(-SD*bdcdl|? zcL%=x*m}PhX27)i#hRG>~D7MnV~-90_BRUVcYqAdc{IBy?yeG#3yP zuN1>-F~T8UhmrVm+yhuCkWGh6VGbA&cDz~s&&N3D;4!|dB1a+;#z6oS<4|n|E;>nj z>Yf9kne8(AD+?9a7FvP~l!Zq1vJf5U*%s0zy(WIxHn0y_2+uWSUU6Or5z61}_uOvjG! zhS(8i^@i)z^8eTQ>@b3c2YOSb#Z9JAdi@Kp(z zxDo;edcr=exL)9^XBJJvz|2d=xQ1yVYe8GCFKWl(Zhp@bY^47ppwn9eYXqy8x9(-} z-w){+O5_a(KnEcXCGk0@rQth57;9<10g2XWIpsDE7Dy2%7g5Y zfdnN^^!cT29ekJ74&ks}JpYj0k0?_3>xV?Y{fAkre}#}{Ae?Ziy!AtYLrJavn-Xwo zeA!2Yv+5pi^{-4o`FZKbqTAw+9fAVf{fU5%`@{iF=LaP8$T1XgO9G$%eB0r;_|*xx zAYU65;v2SY;>AZC#v8z=9T6D(6rk+@^Z2JGOs|g*JnEQUFAh`V4;&XW5op`XBE0<= zONmV(?OBQzd z2b-D=g3XGy7g#Z`*6qW6qH^(Ny8Z|ccy)stEMu($UIAa5gt%G6 ztJOa-0awVUc@gL5bzVL0&qGO$PyoH2=lf9ER9@+GXfjM`l4lvWcoCbP?9gU7-<2%1 zdBu+sFG!F$g5TEHm(}4N36mQG8dXep%Zu*zLi>1c#GgPlr6DQ4qjy6}rXia!ac5Tx6Jjq1KXm*%MQfcV6+CR{A`VRSBPvNhcn= zkb~e(8T+!uG!W2(mBf7b`K?36xey;)?;6>+SN^}*EAb<=yp}5#@;eW+A!7e0H~3MT zW&YN6h4S+nQ@D-u`buzgch+Z!K10y|ANKjd-=__( h*BYZqjZtr7)YlkIZjAP8jHWb3QyZgc+oOKtzX7I|Vmkl; delta 2248 zcmZo@aA;_7m|(*a**ei1JIh&Tho-OV~ej$E793dAvP zel6a_0%j4`)yyN&&LhDH#7scUyq!ma<;(o(pVu*oZWeI*z&J{bhQVk$7|jNwMZsuE sI9d{pmV~G!;cLdW2kdPRINBa?wmsl#d%)fHfT!&NZ`%XDWe@lj0NV6fE&u=k