| | | 1 | | using Microsoft.Extensions.Options; |
| | | 2 | | using ProjectTemplate.Web.Authentication.Providers.OpenIdConnect; |
| | | 3 | | using ProjectTemplate.Web.Authentication.Providers.Saml2; |
| | | 4 | | |
| | | 5 | | namespace ProjectTemplate.Web.Authentication.Options; |
| | | 6 | | |
| | | 7 | | /// <summary> |
| | | 8 | | /// Validates application authentication configuration during application startup. |
| | | 9 | | /// </summary> |
| | | 10 | | public sealed class ApplicationAuthenticationOptionsValidator : IValidateOptions<ApplicationAuthenticationOptions> |
| | | 11 | | { |
| | | 12 | | /// <inheritdoc /> |
| | | 13 | | public ValidateOptionsResult Validate(string? name, ApplicationAuthenticationOptions options) |
| | | 14 | | { |
| | 298 | 15 | | ArgumentNullException.ThrowIfNull(options); |
| | | 16 | | |
| | 298 | 17 | | List<string> failures = []; |
| | | 18 | | |
| | 298 | 19 | | ValidateApplicationAuthentication(options, failures); |
| | 298 | 20 | | ValidateOpenIdConnectProvider(options.Providers.OpenIdConnect, failures); |
| | 298 | 21 | | ValidateSaml2Provider(options.Providers.Saml2, failures); |
| | 298 | 22 | | ValidateExternalProvider("Microsoft", options.Providers.Microsoft, failures); |
| | 298 | 23 | | ValidateExternalProvider("Google", options.Providers.Google, failures); |
| | 298 | 24 | | ValidateExternalProvider("GitHub", options.Providers.GitHub, failures); |
| | | 25 | | |
| | 298 | 26 | | return failures.Count == 0 |
| | 298 | 27 | | ? ValidateOptionsResult.Success |
| | 298 | 28 | | : ValidateOptionsResult.Fail(failures); |
| | | 29 | | } |
| | | 30 | | |
| | | 31 | | private static void ValidateApplicationAuthentication( |
| | | 32 | | ApplicationAuthenticationOptions options, |
| | | 33 | | ICollection<string> failures) |
| | | 34 | | { |
| | 298 | 35 | | Require( |
| | 298 | 36 | | !string.IsNullOrWhiteSpace(options.DefaultScheme), |
| | 298 | 37 | | "ProjectTemplate:Authentication:DefaultScheme is required.", |
| | 298 | 38 | | failures); |
| | | 39 | | |
| | 298 | 40 | | Require( |
| | 298 | 41 | | !string.IsNullOrWhiteSpace(options.DefaultChallengeScheme), |
| | 298 | 42 | | "ProjectTemplate:Authentication:DefaultChallengeScheme is required.", |
| | 298 | 43 | | failures); |
| | | 44 | | |
| | 298 | 45 | | Require( |
| | 298 | 46 | | !string.IsNullOrWhiteSpace(options.DefaultSignInScheme), |
| | 298 | 47 | | "ProjectTemplate:Authentication:DefaultSignInScheme is required.", |
| | 298 | 48 | | failures); |
| | | 49 | | |
| | 298 | 50 | | if (!options.Enabled) |
| | | 51 | | { |
| | 6 | 52 | | return; |
| | | 53 | | } |
| | | 54 | | |
| | 292 | 55 | | Require( |
| | 292 | 56 | | options.Cookie.Enabled, |
| | 292 | 57 | | "ProjectTemplate:Authentication:Cookie:Enabled must be true when application authentication is enabled.", |
| | 292 | 58 | | failures); |
| | | 59 | | |
| | 292 | 60 | | Require( |
| | 292 | 61 | | !string.IsNullOrWhiteSpace(options.Cookie.Scheme), |
| | 292 | 62 | | "ProjectTemplate:Authentication:Cookie:Scheme is required when application authentication is enabled.", |
| | 292 | 63 | | failures); |
| | | 64 | | |
| | 292 | 65 | | Require( |
| | 292 | 66 | | options.Cookie.ExpireMinutes > 0, |
| | 292 | 67 | | "ProjectTemplate:Authentication:Cookie:ExpireMinutes must be greater than zero when application authenticati |
| | 292 | 68 | | failures); |
| | 292 | 69 | | } |
| | | 70 | | |
| | | 71 | | private static void ValidateOpenIdConnectProvider( |
| | | 72 | | OpenIdConnectAuthenticationOptions options, |
| | | 73 | | ICollection<string> failures) |
| | | 74 | | { |
| | 298 | 75 | | if (!options.Enabled) |
| | | 76 | | { |
| | 288 | 77 | | return; |
| | | 78 | | } |
| | | 79 | | |
| | | 80 | | const string prefix = "ProjectTemplate:Authentication:Providers:OpenIdConnect"; |
| | | 81 | | |
| | 10 | 82 | | RequireProviderValue(prefix, nameof(options.Scheme), options.Scheme, failures); |
| | 10 | 83 | | RequireProviderValue(prefix, nameof(options.DisplayName), options.DisplayName, failures); |
| | 10 | 84 | | RequireProviderValue(prefix, nameof(options.Authority), options.Authority, failures); |
| | 10 | 85 | | RequireProviderValue(prefix, nameof(options.ClientId), options.ClientId, failures); |
| | 10 | 86 | | RequireProviderValue(prefix, nameof(options.CallbackPath), options.CallbackPath, failures); |
| | 10 | 87 | | RequireProviderValue(prefix, nameof(options.ResponseType), options.ResponseType, failures); |
| | | 88 | | |
| | 10 | 89 | | Require( |
| | 10 | 90 | | options.Scopes.Any(scope => !string.IsNullOrWhiteSpace(scope)), |
| | 10 | 91 | | $"{prefix}:Scopes must contain at least one non-empty value when the OpenID Connect provider is enabled.", |
| | 10 | 92 | | failures); |
| | 10 | 93 | | } |
| | | 94 | | |
| | | 95 | | private static void ValidateSaml2Provider( |
| | | 96 | | Saml2AuthenticationOptions options, |
| | | 97 | | ICollection<string> failures) |
| | | 98 | | { |
| | 298 | 99 | | if (!options.Enabled) |
| | | 100 | | { |
| | 288 | 101 | | return; |
| | | 102 | | } |
| | | 103 | | |
| | | 104 | | const string prefix = "ProjectTemplate:Authentication:Providers:Saml2"; |
| | | 105 | | |
| | 10 | 106 | | RequireProviderValue(prefix, nameof(options.Scheme), options.Scheme, failures); |
| | 10 | 107 | | RequireProviderValue(prefix, nameof(options.DisplayName), options.DisplayName, failures); |
| | 10 | 108 | | RequireProviderValue(prefix, nameof(options.EntityId), options.EntityId, failures); |
| | 10 | 109 | | RequireProviderValue(prefix, nameof(options.MetadataUrl), options.MetadataUrl, failures); |
| | 10 | 110 | | RequireProviderValue(prefix, nameof(options.ModulePath), options.ModulePath, failures); |
| | 10 | 111 | | } |
| | | 112 | | |
| | | 113 | | private static void ValidateExternalProvider( |
| | | 114 | | string providerName, |
| | | 115 | | ApplicationExternalAuthenticationProviderOptions options, |
| | | 116 | | ICollection<string> failures) |
| | | 117 | | { |
| | 894 | 118 | | if (!options.Enabled) |
| | | 119 | | { |
| | 860 | 120 | | return; |
| | | 121 | | } |
| | | 122 | | |
| | 34 | 123 | | string prefix = $"ProjectTemplate:Authentication:Providers:{providerName}"; |
| | | 124 | | |
| | 34 | 125 | | RequireProviderValue(prefix, nameof(options.Scheme), options.Scheme, failures); |
| | 34 | 126 | | RequireProviderValue(prefix, nameof(options.DisplayName), options.DisplayName, failures); |
| | 34 | 127 | | RequireProviderValue(prefix, nameof(options.ClientId), options.ClientId, failures); |
| | 34 | 128 | | RequireProviderValue(prefix, nameof(options.ClientSecret), options.ClientSecret, failures); |
| | 34 | 129 | | RequireProviderValue(prefix, nameof(options.CallbackPath), options.CallbackPath, failures); |
| | 34 | 130 | | } |
| | | 131 | | |
| | | 132 | | private static void RequireProviderValue( |
| | | 133 | | string prefix, |
| | | 134 | | string key, |
| | | 135 | | string? value, |
| | | 136 | | ICollection<string> failures) |
| | | 137 | | { |
| | 280 | 138 | | Require( |
| | 280 | 139 | | !string.IsNullOrWhiteSpace(value), |
| | 280 | 140 | | $"{prefix}:{key} is required when the provider is enabled.", |
| | 280 | 141 | | failures); |
| | 280 | 142 | | } |
| | | 143 | | |
| | | 144 | | private static void Require( |
| | | 145 | | bool condition, |
| | | 146 | | string failureMessage, |
| | | 147 | | ICollection<string> failures) |
| | | 148 | | { |
| | 2060 | 149 | | if (!condition) |
| | | 150 | | { |
| | 14 | 151 | | failures.Add(failureMessage); |
| | | 152 | | } |
| | 2060 | 153 | | } |
| | | 154 | | } |