|
@@ -1,14 +1,21 @@
|
|
|
using Microsoft.AspNetCore.Authentication;
|
|
|
using Microsoft.AspNetCore.Mvc;
|
|
|
using Microsoft.Extensions.Configuration;
|
|
|
+using Microsoft.IdentityModel.Tokens;
|
|
|
+using OpenXmlPowerTools;
|
|
|
using System;
|
|
|
using System.Collections.Generic;
|
|
|
+using System.IdentityModel.Tokens.Jwt;
|
|
|
using System.Linq;
|
|
|
+using System.Security.Claims;
|
|
|
+using System.Text;
|
|
|
using System.Text.Json;
|
|
|
using System.Threading.Tasks;
|
|
|
using TEAMModelOS.SDK.Context.Configuration;
|
|
|
using TEAMModelOS.SDK.Helper.Common.JsonHelper;
|
|
|
using TEAMModelOS.SDK.Helper.Network.HttpHelper;
|
|
|
+using TEAMModelOS.SDK.Helper.Security.AESCrypt;
|
|
|
+using TEAMModelOS.SDK.Helper.Security.DesCrypt;
|
|
|
|
|
|
namespace TEAMModelOS.Controllers
|
|
|
{
|
|
@@ -35,14 +42,70 @@ namespace TEAMModelOS.Controllers
|
|
|
return new { url, refresh_token= JsonApiHelper.FromApiJson<JsonElement>(token) };
|
|
|
}
|
|
|
|
|
|
- [HttpPost("idToken")]
|
|
|
- public object IdToken(string token)
|
|
|
+ [HttpPost("validateIdToken")]
|
|
|
+ public object ValidateIdToken(string token)
|
|
|
{
|
|
|
-
|
|
|
- string url = BaseConfigModel.Configuration["HaBookAuth:IES5Auth:url"];
|
|
|
- Dictionary<string, object> refresh_token = BaseConfigModel.Configuration.GetSection("HaBookAuth:IES5Auth:refresh_token").Get<Dictionary<string, object>>();
|
|
|
- token = refresh_token.ToApiJson().Replace("{access_token}", token);
|
|
|
- return new { url, refresh_token = JsonApiHelper.FromApiJson<JsonElement>(token) };
|
|
|
+
|
|
|
+ //CoreTokenExtensions.ValidateIdToken
|
|
|
+ AESCrypt crypt = new AESCrypt();
|
|
|
+ var des = DES3Crypt.EncryptString("www.teammodel.cn");
|
|
|
+ var aes = crypt.Encrypt("www.teammodel.cn");
|
|
|
+ var a = CreateToken("habook0001", des,new string[] { "admin","teacher"},new string []{"update","create" });
|
|
|
+ var b = CreateToken("habook0001", aes);
|
|
|
+ return new { des ,aes, a ,b };
|
|
|
+ }
|
|
|
+
|
|
|
+ public static string CreateToken(string userID, string salt, string[] roles = null, string[] permissions = null, int expire = 86400)
|
|
|
+ {
|
|
|
+ // 設定要加入到 JWT Token 中的聲明資訊(Claims)
|
|
|
+ var claims = new List<Claim>();
|
|
|
+ string iss = BaseConfigModel.Configuration.GetSection("JwtSetting:Issuer").Get<string>();
|
|
|
+ // 在 RFC 7519 規格中(Section#4),總共定義了 7 個預設的 Claims
|
|
|
+ claims.Add(new Claim(JwtRegisteredClaimNames.Iss, iss)); //發行者
|
|
|
+ claims.Add(new Claim(JwtRegisteredClaimNames.Sub, userID)); // 用戶ID
|
|
|
+ claims.Add(new Claim(JwtRegisteredClaimNames.Exp, DateTimeOffset.UtcNow.AddHours(expire).ToUnixTimeSeconds().ToString())); // 到期的時間,必須為數字
|
|
|
+
|
|
|
+ // 擴充 "roles" 加入登入者的角色,角色類型 (USER、HABOOK)
|
|
|
+ if (roles != null)
|
|
|
+ {
|
|
|
+ foreach (var role in roles)
|
|
|
+ {
|
|
|
+ claims.Add(new Claim("roles", role));
|
|
|
+ }
|
|
|
+ }
|
|
|
+ // 擴充 "permissions" 加入登入者的權限請求
|
|
|
+ if (permissions != null)
|
|
|
+ {
|
|
|
+ foreach (var role in permissions)
|
|
|
+ {
|
|
|
+ claims.Add(new Claim("permissions", role));
|
|
|
+ }
|
|
|
+ }
|
|
|
+
|
|
|
+ var userClaimsIdentity = new ClaimsIdentity(claims);
|
|
|
+
|
|
|
+ // 建立一組對稱式加密的金鑰,主要用於 JWT 簽章之用
|
|
|
+ var securityKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(salt));
|
|
|
+
|
|
|
+ // HmacSha256 有要求必須要大於 128 bits,所以 salt 不能太短,至少要 16 字元以上
|
|
|
+ // https://stackoverflow.com/questions/47279947/idx10603-the-algorithm-hs256-requires-the-securitykey-keysize-to-be-greater
|
|
|
+ var signingCredentials = new SigningCredentials(securityKey, SecurityAlgorithms.HmacSha256Signature);
|
|
|
+
|
|
|
+ // 建立 SecurityTokenDescriptor
|
|
|
+ var tokenDescriptor = new SecurityTokenDescriptor
|
|
|
+ {
|
|
|
+ Issuer = iss,
|
|
|
+ Subject = userClaimsIdentity,
|
|
|
+ Expires = DateTime.Now.AddSeconds(expire),
|
|
|
+ SigningCredentials = signingCredentials
|
|
|
+ };
|
|
|
+
|
|
|
+ // 產出所需要的 JWT securityToken 物件,並取得序列化後的 Token 結果(字串格式)
|
|
|
+ var tokenHandler = new JwtSecurityTokenHandler();
|
|
|
+ var securityToken = tokenHandler.CreateToken(tokenDescriptor);
|
|
|
+ var serializeToken = tokenHandler.WriteToken(securityToken);
|
|
|
+
|
|
|
+ return serializeToken;
|
|
|
}
|
|
|
}
|
|
|
}
|