| | | 1 | | using System.Security.Claims; |
| | | 2 | | using Microsoft.AspNetCore.Authentication; |
| | | 3 | | using Microsoft.Extensions.Options; |
| | | 4 | | using ProjectTemplate.Web.Authentication.Options; |
| | | 5 | | |
| | | 6 | | namespace ProjectTemplate.Web.Authentication.Claims; |
| | | 7 | | |
| | | 8 | | /// <summary> |
| | | 9 | | /// Normalizes provider-specific claims into application-owned claim names. |
| | | 10 | | /// </summary> |
| | | 11 | | /// <param name="authenticationOptionsAccessor">The application authentication options accessor.</param> |
| | 108 | 12 | | public sealed class ApplicationClaimsTransformation( |
| | 108 | 13 | | IOptions<ApplicationAuthenticationOptions> authenticationOptionsAccessor) : IClaimsTransformation |
| | | 14 | | { |
| | 108 | 15 | | private readonly IOptions<ApplicationAuthenticationOptions> _authenticationOptionsAccessor = |
| | 108 | 16 | | authenticationOptionsAccessor ?? throw new ArgumentNullException(nameof(authenticationOptionsAccessor)); |
| | | 17 | | |
| | | 18 | | /// <inheritdoc /> |
| | | 19 | | public Task<ClaimsPrincipal> TransformAsync(ClaimsPrincipal principal) |
| | | 20 | | { |
| | 28 | 21 | | ArgumentNullException.ThrowIfNull(principal); |
| | | 22 | | |
| | 28 | 23 | | ApplicationClaimsTransformationOptions options = |
| | 28 | 24 | | _authenticationOptionsAccessor.Value.ClaimsTransformation; |
| | | 25 | | |
| | 28 | 26 | | if (!options.Enabled) |
| | | 27 | | { |
| | 2 | 28 | | return Task.FromResult(principal); |
| | | 29 | | } |
| | | 30 | | |
| | 104 | 31 | | foreach (ClaimsIdentity identity in principal.Identities.OfType<ClaimsIdentity>()) |
| | | 32 | | { |
| | 26 | 33 | | ApplicationClaimMappingOptions mappings = ResolveMappings(options, identity.AuthenticationType); |
| | | 34 | | |
| | 26 | 35 | | NormalizeClaim(identity, ApplicationClaimTypes.Subject, mappings.Subject, options.RemoveOriginalClaims); |
| | 26 | 36 | | NormalizeClaim(identity, ApplicationClaimTypes.Name, mappings.Name, options.RemoveOriginalClaims); |
| | 26 | 37 | | NormalizeClaim(identity, ApplicationClaimTypes.Email, mappings.Email, options.RemoveOriginalClaims); |
| | 26 | 38 | | NormalizeClaim(identity, ApplicationClaimTypes.Role, mappings.Role, options.RemoveOriginalClaims); |
| | 26 | 39 | | NormalizeClaim(identity, ApplicationClaimTypes.Group, mappings.Group, options.RemoveOriginalClaims); |
| | 26 | 40 | | NormalizeClaim(identity, ApplicationClaimTypes.Permission, mappings.Permission, options.RemoveOriginalClaims |
| | | 41 | | } |
| | | 42 | | |
| | 26 | 43 | | return Task.FromResult(principal); |
| | | 44 | | } |
| | | 45 | | |
| | | 46 | | private static ApplicationClaimMappingOptions ResolveMappings( |
| | | 47 | | ApplicationClaimsTransformationOptions options, |
| | | 48 | | string? authenticationType) |
| | | 49 | | { |
| | 26 | 50 | | return !string.IsNullOrWhiteSpace(authenticationType) |
| | 26 | 51 | | && options.ProviderMappings.TryGetValue(authenticationType, out ApplicationClaimMappingOptions? providerMapp |
| | 26 | 52 | | ? providerMappings |
| | 26 | 53 | | : options.DefaultMappings; |
| | | 54 | | } |
| | | 55 | | |
| | | 56 | | private static void NormalizeClaim( |
| | | 57 | | ClaimsIdentity identity, |
| | | 58 | | string normalizedClaimType, |
| | | 59 | | IEnumerable<string> sourceClaimTypes, |
| | | 60 | | bool removeOriginalClaims) |
| | | 61 | | { |
| | 156 | 62 | | var sourceTypes = sourceClaimTypes |
| | 492 | 63 | | .Where(claimType => !string.IsNullOrWhiteSpace(claimType)) |
| | 156 | 64 | | .ToHashSet(StringComparer.OrdinalIgnoreCase); |
| | | 65 | | |
| | 156 | 66 | | if (sourceTypes.Count == 0) |
| | | 67 | | { |
| | 0 | 68 | | return; |
| | | 69 | | } |
| | | 70 | | |
| | 156 | 71 | | var sourceClaims = identity.Claims |
| | 686 | 72 | | .Where(claim => sourceTypes.Contains(claim.Type)) |
| | 156 | 73 | | .ToList(); |
| | | 74 | | |
| | 156 | 75 | | if (sourceClaims.Count == 0) |
| | | 76 | | { |
| | 88 | 77 | | return; |
| | | 78 | | } |
| | | 79 | | |
| | 272 | 80 | | foreach (Claim sourceClaim in sourceClaims) |
| | | 81 | | { |
| | 68 | 82 | | if (!HasClaim(identity, normalizedClaimType, sourceClaim.Value)) |
| | | 83 | | { |
| | 66 | 84 | | identity.AddClaim(new Claim( |
| | 66 | 85 | | normalizedClaimType, |
| | 66 | 86 | | sourceClaim.Value, |
| | 66 | 87 | | sourceClaim.ValueType, |
| | 66 | 88 | | sourceClaim.Issuer, |
| | 66 | 89 | | sourceClaim.OriginalIssuer)); |
| | | 90 | | } |
| | | 91 | | } |
| | | 92 | | |
| | 68 | 93 | | if (!removeOriginalClaims) |
| | | 94 | | { |
| | 66 | 95 | | return; |
| | | 96 | | } |
| | | 97 | | |
| | 8 | 98 | | foreach (Claim sourceClaim in sourceClaims) |
| | | 99 | | { |
| | 2 | 100 | | if (!string.Equals(sourceClaim.Type, normalizedClaimType, StringComparison.OrdinalIgnoreCase)) |
| | | 101 | | { |
| | 2 | 102 | | identity.RemoveClaim(sourceClaim); |
| | | 103 | | } |
| | | 104 | | } |
| | 2 | 105 | | } |
| | | 106 | | |
| | | 107 | | private static bool HasClaim( |
| | | 108 | | ClaimsIdentity identity, |
| | | 109 | | string claimType, |
| | | 110 | | string claimValue) |
| | | 111 | | { |
| | 68 | 112 | | return identity.Claims.Any(claim => |
| | 460 | 113 | | string.Equals(claim.Type, claimType, StringComparison.OrdinalIgnoreCase) |
| | 460 | 114 | | && string.Equals(claim.Value, claimValue, StringComparison.Ordinal)); |
| | | 115 | | } |
| | | 116 | | } |