|
1 | 1 | using Blazored.SessionStorage;
|
2 | 2 | using ITfoxtec.Identity.Discovery;
|
3 |
| -using ITfoxtec.Identity.Models; |
4 | 3 | using ITfoxtec.Identity.Messages;
|
5 | 4 | using ITfoxtec.Identity.Tokens;
|
6 | 5 | using ITfoxtec.Identity.Util;
|
@@ -162,18 +161,13 @@ public async Task LoginCallBackAsync(string responseUrl)
|
162 | 161 | if (tokenResponse.AccessToken.IsNullOrEmpty()) throw new ArgumentNullException(nameof(tokenResponse.AccessToken), tokenResponse.GetTypeName());
|
163 | 162 | if (tokenResponse.ExpiresIn <= 0) throw new ArgumentNullException(nameof(tokenResponse.ExpiresIn), tokenResponse.GetTypeName());
|
164 | 163 |
|
165 |
| - var oidcDiscoveryKeySet = await GetOidcDiscoveryKeysAsync(openidClientPkceState.OidcDiscoveryUri); |
| 164 | + //var oidcDiscoveryKeySet = await GetOidcDiscoveryKeysAsync(openidClientPkceState.OidcDiscoveryUri); |
166 | 165 |
|
167 |
| - // .NET 5.0 error, System.Security.Cryptography.RSA.Create() - System.PlatformNotSupportedException: System.Security.Cryptography.Algorithms is not supported on this platform. |
168 |
| - // https://github.com/dotnet/aspnetcore/issues/26123 |
169 |
| - // https://github.com/dotnet/runtime/issues/40074 |
| 166 | + //(var idTokenPrincipal, _) = JwtHandler.ValidateToken(tokenResponse.IdToken, oidcDiscovery.Issuer, oidcDiscoveryKeySet.Keys.ToMSJsonWebKeys(), openidClientPkceState.ClientId, |
| 167 | + // nameClaimType: globalOpenidClientPkceSettings.NameClaimType, roleClaimType: globalOpenidClientPkceSettings.RoleClaimType); |
| 168 | + // Changed to only read ID token and not do validation |
170 | 169 |
|
171 |
| - (var idTokenPrincipal, _) = JwtHandler.ValidateToken(tokenResponse.IdToken, oidcDiscovery.Issuer, oidcDiscoveryKeySet.Keys.ToMSJsonWebKeys(), openidClientPkceState.ClientId, |
172 |
| - nameClaimType: globalOpenidClientPkceSettings.NameClaimType, roleClaimType: globalOpenidClientPkceSettings.RoleClaimType |
173 |
| -#if NET50 |
174 |
| - , validateSigningKey: false |
175 |
| -#endif |
176 |
| - ); |
| 170 | + var idTokenPrincipal = JwtHandler.ReadTokenClaims(tokenResponse.IdToken); |
177 | 171 |
|
178 | 172 | var nonce = idTokenPrincipal.Claims.Where(c => c.Type == JwtClaimTypes.Nonce).Select(c => c.Value).FirstOrDefault();
|
179 | 173 | if (!openidClientPkceState.Nonce.Equals(nonce, StringComparison.Ordinal))
|
@@ -234,18 +228,13 @@ public async Task<OidcUserSession> HandleRefreshTokenAsync(OidcUserSession userS
|
234 | 228 | if (tokenResponse.AccessToken.IsNullOrEmpty()) throw new ArgumentNullException(nameof(tokenResponse.AccessToken), tokenResponse.GetTypeName());
|
235 | 229 | if (tokenResponse.ExpiresIn <= 0) throw new ArgumentNullException(nameof(tokenResponse.ExpiresIn), tokenResponse.GetTypeName());
|
236 | 230 |
|
237 |
| - var oidcDiscoveryKeySet = await GetOidcDiscoveryKeysAsync(oidcDiscoveryUri); |
| 231 | + //var oidcDiscoveryKeySet = await GetOidcDiscoveryKeysAsync(oidcDiscoveryUri); |
238 | 232 |
|
239 |
| - // .NET 5.0 error, System.Security.Cryptography.RSA.Create() - System.PlatformNotSupportedException: System.Security.Cryptography.Algorithms is not supported on this platform. |
240 |
| - // https://github.com/dotnet/aspnetcore/issues/26123 |
241 |
| - // https://github.com/dotnet/runtime/issues/40074 |
| 233 | + //(var idTokenPrincipal, _) = JwtHandler.ValidateToken(tokenResponse.IdToken, oidcDiscovery.Issuer, oidcDiscoveryKeySet.Keys, clientId, |
| 234 | + // nameClaimType: globalOpenidClientPkceSettings.NameClaimType, roleClaimType: globalOpenidClientPkceSettings.RoleClaimType); |
| 235 | + // Changed to only read ID token and not do validation |
242 | 236 |
|
243 |
| - (var idTokenPrincipal, _) = JwtHandler.ValidateToken(tokenResponse.IdToken, oidcDiscovery.Issuer, oidcDiscoveryKeySet.Keys, clientId, |
244 |
| - nameClaimType: globalOpenidClientPkceSettings.NameClaimType, roleClaimType: globalOpenidClientPkceSettings.RoleClaimType |
245 |
| -#if NET50 |
246 |
| - , validateSigningKey: false |
247 |
| -#endif |
248 |
| - ); |
| 237 | + var idTokenPrincipal = JwtHandler.ReadTokenClaims(tokenResponse.IdToken); |
249 | 238 |
|
250 | 239 | if (!subject.IsNullOrEmpty() && subject != idTokenPrincipal.Claims.Where(c => c.Type == globalOpenidClientPkceSettings.NameClaimType).Single().Value)
|
251 | 240 | {
|
@@ -364,18 +353,19 @@ private async Task<OidcDiscovery> GetOidcDiscoveryAsync(string oidcDiscoveryUri)
|
364 | 353 | }
|
365 | 354 | }
|
366 | 355 |
|
367 |
| - private async Task<JsonWebKeySet> GetOidcDiscoveryKeysAsync(string oidcDiscoveryUri) |
368 |
| - { |
369 |
| - try |
370 |
| - { |
371 |
| - var oidcDiscoveryHandler = serviceProvider.GetService<OidcDiscoveryHandler>(); |
372 |
| - return await oidcDiscoveryHandler.GetOidcDiscoveryKeysAsync(oidcDiscoveryUri); |
373 |
| - } |
374 |
| - catch (Exception ex) |
375 |
| - { |
376 |
| - throw new Exception($"Failed to fetch OIDC Discovery Keys from discovery '{oidcDiscoveryUri}'.", ex); |
377 |
| - } |
378 |
| - } |
| 356 | + // Changed to only read ID token and not do validation |
| 357 | + //private async Task<JsonWebKeySet> GetOidcDiscoveryKeysAsync(string oidcDiscoveryUri) |
| 358 | + //{ |
| 359 | + // try |
| 360 | + // { |
| 361 | + // var oidcDiscoveryHandler = serviceProvider.GetService<OidcDiscoveryHandler>(); |
| 362 | + // return await oidcDiscoveryHandler.GetOidcDiscoveryKeysAsync(oidcDiscoveryUri); |
| 363 | + // } |
| 364 | + // catch (Exception ex) |
| 365 | + // { |
| 366 | + // throw new Exception($"Failed to fetch OIDC Discovery Keys from discovery '{oidcDiscoveryUri}'.", ex); |
| 367 | + // } |
| 368 | + //} |
379 | 369 |
|
380 | 370 | private async Task<string> SaveStateAsync(OpenidConnectPkceSettings openidConnectPkceSettings, string callBackUri, string redirectUri, string codeVerifier = null, string nonce = null)
|
381 | 371 | {
|
|
0 commit comments