|
|
@@ -13,6 +13,18 @@ using Azure.Identity;
|
|
|
using System.Net.Http;
|
|
|
using System.Collections.Concurrent;
|
|
|
using System.Diagnostics;
|
|
|
+using Newtonsoft.Json;
|
|
|
+using System.Net;
|
|
|
+using Microsoft.AspNetCore.DataProtection;
|
|
|
+using Microsoft.Extensions.Configuration;
|
|
|
+using System.Configuration;
|
|
|
+using DocumentFormat.OpenXml.Spreadsheet;
|
|
|
+using System.Text.Json;
|
|
|
+using System.Security.Cryptography;
|
|
|
+using System.Reflection;
|
|
|
+using Microsoft.IdentityModel.Protocols.OpenIdConnect;
|
|
|
+using Microsoft.IdentityModel.Protocols;
|
|
|
+using static Google.Protobuf.Reflection.SourceCodeInfo.Types;
|
|
|
|
|
|
namespace TEAMModelOS.SDK.Extension
|
|
|
{
|
|
|
@@ -44,10 +56,63 @@ namespace TEAMModelOS.SDK.Extension
|
|
|
.WithClientSecret(secret)
|
|
|
.WithAuthority(new Uri(sts.GetDescriptionText()))
|
|
|
.Build();
|
|
|
+
|
|
|
var scope = ((STSScope)sts).GetDescriptionText();
|
|
|
+
|
|
|
var result = await app.AcquireTokenForClient(new[] { scope }).ExecuteAsync();
|
|
|
+
|
|
|
+
|
|
|
return result;
|
|
|
}
|
|
|
+ //https://learn.microsoft.com/zh-cn/entra/identity-platform/access-tokens 验证的相关文档
|
|
|
+ public static async Task<JwtSecurityToken> Validate(string jwtTokenToValidate, string location,string clientId, IConfiguration configuration)
|
|
|
+ {
|
|
|
+ var tenantId = "4807e9cf-87b8-4174-aa5b-e76497d7392b";
|
|
|
+ var OpenidConfiguration = Enum.Parse<STSOpenidConfiguration>(location, true);
|
|
|
+ var openIdConnectWellKnownConfigUri = new Uri(OpenidConfiguration.GetDescriptionText());
|
|
|
+
|
|
|
+ //With the Input token to be validated...
|
|
|
+
|
|
|
+ //With the above information we can validate all key aspects of the Jwt Token...
|
|
|
+ try
|
|
|
+ {
|
|
|
+ var openIdConfigManager = new ConfigurationManager<OpenIdConnectConfiguration>(
|
|
|
+ openIdConnectWellKnownConfigUri.ToString(),
|
|
|
+ new OpenIdConnectConfigurationRetriever()
|
|
|
+ );
|
|
|
+
|
|
|
+ OpenIdConnectConfiguration openIdConfig = await openIdConfigManager.GetConfigurationAsync().ConfigureAwait(false);
|
|
|
+ TokenValidationParameters validationParams = new TokenValidationParameters
|
|
|
+ {
|
|
|
+ ValidateIssuerSigningKey = true,
|
|
|
+ ValidateAudience = true,
|
|
|
+ ValidateIssuer = true,
|
|
|
+ ValidateLifetime = false,
|
|
|
+ ValidateTokenReplay = true,
|
|
|
+ RequireExpirationTime = true,
|
|
|
+ RequireAudience= true,
|
|
|
+ RequireSignedTokens= true,
|
|
|
+ //Valid values for Validation of the JWT...
|
|
|
+ ValidAudience = configuration.GetValue<string>("Option:Audience"),
|
|
|
+ ValidIssuer = openIdConfig.Issuer.Replace("{tenantid}", tenantId),
|
|
|
+ //Set the Azure AD SigningKeys for Validation!
|
|
|
+ IssuerSigningKeys = openIdConfig.SigningKeys,
|
|
|
+ };
|
|
|
+
|
|
|
+ var jwtTokenHandler = new JwtSecurityTokenHandler();
|
|
|
+ jwtTokenHandler.ValidateToken(jwtTokenToValidate, validationParams, out SecurityToken validToken);
|
|
|
+
|
|
|
+ return validToken as JwtSecurityToken
|
|
|
+ ?? throw new SecurityTokenValidationException("Unexpected failure while parsing and validating the the JWT token specified.");
|
|
|
+ }
|
|
|
+ catch (Exception exc)
|
|
|
+ {
|
|
|
+ //Handle the Token Validation Exception (one of many types may occur)...
|
|
|
+
|
|
|
+ return null;
|
|
|
+ }
|
|
|
+ }
|
|
|
+
|
|
|
|
|
|
/// <summary>
|
|
|
/// 驗證是否為公司Azure發行金鑰，支援大陸國際
|
|
|
@@ -69,31 +134,6 @@ namespace TEAMModelOS.SDK.Extension
|
|
|
return false;
|
|
|
}
|
|
|
}
|
|
|
-
|
|
|
- public static bool ValidateIdToken(string token, string salt)
|
|
|
- {
|
|
|
- try
|
|
|
- {
|
|
|
- var handler = new JwtSecurityTokenHandler();
|
|
|
- var validationParameters = new TokenValidationParameters
|
|
|
- {
|
|
|
- RequireExpirationTime = true,
|
|
|
- ValidateIssuer = false,
|
|
|
- ValidateAudience = false,
|
|
|
- IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(salt)),
|
|
|
- ValidateLifetime = false,
|
|
|
- //LifetimeValidator = LifetimeValidator,
|
|
|
- ClockSkew = TimeSpan.Zero
|
|
|
- };
|
|
|
- ClaimsPrincipal principal = handler.ValidateToken(token, validationParameters, out SecurityToken securityToken);
|
|
|
- return true;
|
|
|
- }
|
|
|
- catch(Exception ex)
|
|
|
- {
|
|
|
- Trace.WriteLine(ex.Message);
|
|
|
- return false;
|
|
|
- }
|
|
|
- }
|
|
|
#endregion
|
|
|
|
|
|
private static async ValueTask<KeyVaultSecret> GetClientIDSecret(string clientID, string location)
|
|
|
@@ -167,5 +207,31 @@ namespace TEAMModelOS.SDK.Extension
|
|
|
[Description("73a2bcc5-fe99-4566-aa8a-07e7bb287df1,8768b06f-c5c5-4b0c-abfb-d7ded354626d,7=O./yws0L89WcEsece:9/4deJHP4E=F,https://login.microsoftonline.com/")]
|
|
|
Global
|
|
|
}
|
|
|
+ private enum STSJwtKeys
|
|
|
+ {
|
|
|
+ [Description("https://login.chinacloudapi.cn/4807e9cf-87b8-4174-aa5b-e76497d7392b/discovery/v2.0/keys")]
|
|
|
+ China,
|
|
|
+ [Description("https://login.microsoftonline.com/73a2bcc5-fe99-4566-aa8a-07e7bb287df1/discovery/v2.0/keys")]
|
|
|
+ Global
|
|
|
+ }
|
|
|
+ private enum STSOpenidConfiguration {
|
|
|
+ [Description("https://login.chinacloudapi.cn/4807e9cf-87b8-4174-aa5b-e76497d7392b/v2.0/.well-known/openid-configuration")]
|
|
|
+ China,
|
|
|
+ [Description("https://login.microsoftonline.com/73a2bcc5-fe99-4566-aa8a-07e7bb287df1/v2.0/.well-known/openid-configuration")]
|
|
|
+ Global
|
|
|
+ }
|
|
|
+ public class MSADJwtKeys {
|
|
|
+
|
|
|
+ public string kty { get;set; }
|
|
|
+ public string use { get; set; }
|
|
|
+
|
|
|
+ public string kid { get; set; }
|
|
|
+ public string x5t { get; set; }
|
|
|
+ public string n { get; set; }
|
|
|
+ public string e { get; set; }
|
|
|
+ public List<string> x5c { get; set; }
|
|
|
+ public string issuer { get; set; }
|
|
|
+
|
|
|
+ }
|
|
|
}
|
|
|
}
|
CrazyIter_Bin