.NET Framework C# OIDC将PKCE添加到亚马逊AWS认知

ilmyapht 于 2023-01-14 发布在 .NET

关注(0)|答案(1)|浏览(226)

我有三个应用程序，它们都使用不同的.NET方法（我不知道一个更好的词）。我有一个.NET核心3.1 Web应用程序，一个.NET框架4.8 MVC Web应用程序，和一个.NET框架4.6 Web窗体应用程序。
这三款应用都要求我使用PKCE（Proof Key for Code Exchange，用于代码交换的验证密钥）。这三款应用都使用Amazon AWS Cognito进行身份验证和授权。除了两款非.NET Core应用不使用PKCE之外，其他一切都运行良好，我需要它们使用PKCE。

好的，我在这里的主要想法是，可能有一些“轻松”的方法，我可以通过Startup.Auth.cs文件或定义OIDC Auth* 之类的文件向.NET Framework应用程序添加PKCE支持。
我的所作所为

我已经能够找到一些关于如何向站点添加PKCE的在线文章，但是它们都是向查询字符串添加必要位的手动机制。

NET Core这篇文章对我了解.NET Core应用程序的工作方式特别有用，但对其他两个应用程序没有帮助。总的来说，这个过程似乎分为以下步骤：
1.创建一个代码验证器，称之为验证器。
1.代码验证器和base64编码SHA 256。称之为挑战。
1.将其添加到我们发送到“authorize”端点的查询字符串中，沿着添加code_challenge_method，对于Cognito，该方法必须设置为S256。
1.将值为VERIFIER的Code_Verifier添加到我们发送到“token”端点的查询字符串中。
本质上，我们可以手动将以下内容添加到调用“authorize”端点的查询字符串中：“&代码挑战=挑战&代码挑战方法=S256”。
以及调用“token”端点的查询字符串：“&代码验证器=验证器”.（I'm pretty sure this token endpoint is a POST.）
我想就是这样。所以，我可以手动地将这些东西添加到这些调用中。然而，我更愿意让.NET框架神奇地为我做这些工作。

因此，我的总问题是：是否有办法修改.NET代码？我必须通过修改代码而不是手动添加来添加PKCE。

我已经搜索了Web、Microsoft站点，并且我已经摆弄了实际的代码，但是我没有找到任何在这些方法中添加PKCE的机制。

我的代码示例：

.NET框架Web窗体应用程序：

public void ConfigureAuth(IAppBuilder app)
    {
        app.SetDefaultSignInAsAuthenticationType(DefaultAuthenticationTypes.ApplicationCookie);
        app.UseCookieAuthentication(new CookieAuthenticationOptions
        {
            AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
            CookieManager = new SystemWebCookieManager()
        });

        ConfigureIdentityProviders(app, DefaultAuthenticationTypes.ApplicationCookie);
    }

    private void ConfigureIdentityProviders(IAppBuilder app, string signInAsType)
    {
        var saveTokens = true;
        var validateIssuer = true;
        var saveTokensValue = ConfigurationManager.AppSettings["Cognito.SaveTokens"];
        if (!string.IsNullOrEmpty(saveTokensValue))
        {
            saveTokens = bool.TryParse(saveTokensValue, out var outResult) && outResult;
        }
        var validateIssuerValue = ConfigurationManager.AppSettings["Cognito.TokenValidationParameters.ValidateIssuer"];
        if (!string.IsNullOrEmpty(validateIssuerValue))
        {
            validateIssuer = bool.TryParse(validateIssuerValue, out var outResult) && outResult;
        }

        app.UseCustomOidcAuthentication(
            new OpenIdConnectAuthenticationOptions
            {
                ClientId = ConfigurationManager.AppSettings["Cognito.ClientId"],
                ResponseType = ConfigurationManager.AppSettings["Cognito.ResponseType"],
                Authority = ConfigurationManager.AppSettings["Cognito.Authority"],
                MetadataAddress = ConfigurationManager.AppSettings["Cognito.MetadataAddress"],
                ClientSecret = ConfigurationManager.AppSettings["Cognito.ClientSecret"],
                RedirectUri = ConfigurationManager.AppSettings["Cognito.RedirectUri"],
                SaveTokens = saveTokens,
                TokenValidationParameters = new TokenValidationParameters
                {
                    NameClaimType = ConfigurationManager.AppSettings["Cognito.TokenValidationParameters.NameClaimType"],
                    RoleClaimType = ConfigurationManager.AppSettings["Cognito.TokenValidationParameters.RoleClaimType"],
                    ValidateIssuer = validateIssuer
                },
                Notifications = new OpenIdConnectAuthenticationNotifications
                {
                    RedirectToIdentityProvider = async (context) =>
                    {
                        var removePortOnRedirectIdentifierValue = ConfigurationManager.AppSettings["Cognito.RemovePortOnRedirectToIdentityProvider"];
                        var convertResult = bool.TryParse(removePortOnRedirectIdentifierValue, out var removePortOnRedirectIdentifier);
                        if (removePortOnRedirectIdentifier && convertResult)
                        {
                            var builder = new UriBuilder(context.ProtocolMessage.RedirectUri)
                            {
                                Scheme = "https",
                                Port = -1
                            };

                            context.ProtocolMessage.RedirectUri = builder.ToString();
                        }
                    }
                },
                Scope = ConfigurationManager.AppSettings["Cognito.Scope"],
                SignInAsAuthenticationType = signInAsType
            }
        );
    }

我的.NET框架MVC应用程序：

public void ConfigureAuth(IAppBuilder app)
{
    var loginPath = AuthorizationSettings.Instance.LoginPath;
    if (string.IsNullOrEmpty(loginPath))
        throw new ArgumentNullException("No value specified for EiHubSettings LoginPath");

    // Configure the db context, user manager and signin manager to use a single instance per request
    app.CreatePerOwinContext(SecurityDbContext.Create);
    app.CreatePerOwinContext<SecurityUserManager>(SecurityUserManager.Create);
    app.CreatePerOwinContext<SecurityRoleManager>(SecurityRoleManager.Create);
    app.CreatePerOwinContext<SecuritySignInManager>(SecuritySignInManager.Create);
    
    // Enable the application to use a cookie to store information for the signed in user
    // and to use a cookie to temporarily store information about a user logging in with a third party login provider
    // Configure the sign in cookie
    app.UseCookieAuthentication(new CookieAuthenticationOptions
    {
        AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
        LoginPath = new PathString(loginPath),
        CookieManager = new SystemWebCookieManager(),
        ExpireTimeSpan = TimeSpan.FromSeconds(
            Convert.ToInt32(ConfigurationManager.AppSettings["Cognito.CookieLifetimeInSeconds"])),
        Provider = new CookieAuthenticationProvider
        {
            // Enables the application to validate the security stamp when the user logs in.
            // This is a security feature which is used when you change a password or add an external login to your account.  
            OnValidateIdentity = SecurityStampValidator.OnValidateIdentity<SecurityUserManager, SecurityUser, int>(
                validateInterval: TimeSpan.FromMinutes(30),
                regenerateIdentityCallback: (manager, user) => user.CreateIdentityAsync(manager),
                getUserIdCallback: (user) => user.GetUserId<int>())
        }
    });            
    app.UseExternalSignInCookie(DefaultAuthenticationTypes.ExternalCookie);

    // Enables the application to temporarily store user information when they are verifying the second factor in the two-factor authentication process.
    app.UseTwoFactorSignInCookie(DefaultAuthenticationTypes.TwoFactorCookie, TimeSpan.FromMinutes(5));

    // Enables the application to remember the second login verification factor such as phone or email.
    // Once you check this option, your second step of verification during the login process will be remembered on the device where you logged in from.
    // This is similar to the RememberMe option when you log in.
    app.UseTwoFactorRememberBrowserCookie(DefaultAuthenticationTypes.TwoFactorRememberBrowserCookie);

    if(AppSettingsConfigSingleton.UsesCognito)
    {
        ConfigureIdentityProviders(app, DefaultAuthenticationTypes.ApplicationCookie);
    }
}

private void ConfigureIdentityProviders(IAppBuilder app, string signInAsType)
{
    var saveTokens = true;
    var validateIssuer = true;
    var saveTokensValue = ConfigurationManager.AppSettings["Cognito.SaveTokens"];
    if (!string.IsNullOrEmpty(saveTokensValue))
    {
        saveTokens = bool.TryParse(saveTokensValue, out var outResult) && outResult;
    }
    var validateIssuerValue = ConfigurationManager.AppSettings["Cognito.TokenValidationParameters.ValidateIssuer"];
    if (!string.IsNullOrEmpty(validateIssuerValue))
    {
        validateIssuer = bool.TryParse(validateIssuerValue, out var outResult) && outResult;
    }
    
    app.UseCustomOidcAuthentication(
        new OpenIdConnectAuthenticationOptions
        {
            ClientId = ConfigurationManager.AppSettings["Cognito.ClientId"],
            ResponseType = ConfigurationManager.AppSettings["Cognito.ResponseType"],
            Authority = ConfigurationManager.AppSettings["Cognito.Authority"],
            MetadataAddress = ConfigurationManager.AppSettings["Cognito.MetadataAddress"],
            ClientSecret = ConfigurationManager.AppSettings["Cognito.ClientSecret"],
            RedirectUri = ConfigurationManager.AppSettings["Cognito.RedirectUri"],
            SaveTokens = saveTokens,
            Notifications = new OpenIdConnectAuthenticationNotifications
            {
                SecurityTokenValidated = context =>
                {
                    var redirectUri = "/account/openidlogincallback";
                    if (!string.IsNullOrEmpty(context.AuthenticationTicket.Properties.RedirectUri))
                    {
                        redirectUri += $"?returnUrl={context.AuthenticationTicket.Properties.RedirectUri}";
                    }
                    context.AuthenticationTicket.Properties.RedirectUri = redirectUri;

                    return Task.FromResult(0);
                },
                RedirectToIdentityProvider = context =>
                {
                    var removePortOnRedirectIdentifierValue = ConfigurationManager.AppSettings["Cognito.RemovePortOnRedirectToIdentityProvider"];
                    var convertResult = bool.TryParse(removePortOnRedirectIdentifierValue, out var removePortOnRedirectIdentifier);
                    if (removePortOnRedirectIdentifier && convertResult)
                    {
                        var builder = new UriBuilder(context.ProtocolMessage.RedirectUri)
                        {
                            Scheme = "https", Port = -1
                        };

                        context.ProtocolMessage.RedirectUri = builder.ToString();
                    }

                    return Task.FromResult(0);
                }
            },
            TokenValidationParameters = new TokenValidationParameters
            {
                NameClaimType = ConfigurationManager.AppSettings["Cognito.TokenValidationParameters.NameClaimType"],
                RoleClaimType = ConfigurationManager.AppSettings["Cognito.TokenValidationParameters.RoleClaimType"],
                ValidateIssuer = validateIssuer
            },
            Scope = ConfigurationManager.AppSettings["Cognito.Scope"],
            SignInAsAuthenticationType = signInAsType
        }
    );
}

NET Core 3.1应用程序（是的，我知道我们需要升级到.NET 6）有一个“内置”的机制来添加PKCE（这让我困惑了很长一段时间，直到我看到这个--这个选项在我的代码中没有显式设置，但正如您所看到的，它在默认情况下是打开的）：

因此，我希望. NETFramework中也有类似的东西

.net

来源：https://stackoverflow.com/questions/75086276/net-framework-c-sharp-oidc-add-pkce-to-amazon-aws-cognito

1条答案

按热度按时间

s4n0splo1#

在StartUp类中：

//  Referred to in CustomOidcHandler
public const string CODE_VERIFIER = "code_verifier";

private const string _CODE_CHALLENGE = "code_challenge";
private const string _CODE_CHALLENGE_METHOD = "code_challenge_method";
private const string _CODE_CHALLENGE_METHOD_S256 = "S256";

在ConfigureIdentityProviders中在Startup中

RedirectToIdentityProvider = (context) =>
                {
                    var removePortOnRedirectIdentifierValue = ConfigurationManager.AppSettings["Cognito.RemovePortOnRedirectToIdentityProvider"];
                    var convertResult = bool.TryParse(removePortOnRedirectIdentifierValue, out var removePortOnRedirectIdentifier);
                    if (removePortOnRedirectIdentifier && convertResult)
                    {
                        var builder = new UriBuilder(context.ProtocolMessage.RedirectUri)
                        {
                            Scheme = "https",
                            Port = -1
                        };

                        context.ProtocolMessage.RedirectUri = builder.ToString();
                    }

                    //
                    //  We need the code_verifier value passed to the CustomOidcHandler
                    //  so that it can be added to the POST to the /token endpoint
                    //
                    string codeVerifier = GenerateCodeVerifier();
                    HttpCookie cookie = new HttpCookie(CODE_VERIFIER);
                    cookie.Value = codeVerifier;
                    HttpContext.Current.Response.Cookies.Add(cookie);

                    //
                    //  Add the code_challenge to the GET request to Cognito
                    //
                    //  Methodology found here: https://github.com/IdentityServer/IdentityServer4/issues/4874
                    //
                    string codeChallenge = GenerateCodeChallenge(codeVerifier);
                    context.ProtocolMessage.SetParameter(_CODE_CHALLENGE, codeChallenge);
                    context.ProtocolMessage.SetParameter(_CODE_CHALLENGE_METHOD, _CODE_CHALLENGE_METHOD_S256);

                    return Task.CompletedTask;
                }

在我的CustomOidcHandler文件中，GetTokens方法：

string codeVerifier = Request != null && Request.Cookies != null && Request.Cookies[Startup.CODE_VERIFIER] != null ? Request.Cookies[Startup.CODE_VERIFIER] : string.Empty;
    Dictionary<string, string> post = new Dictionary<string, string>
    {
        {"client_id", options.ClientId},
        {"client_secret", options.ClientSecret},
        {"grant_type", "authorization_code"},
        {"code", authorizationCode},
        {"redirect_uri", options.RedirectUri},
        {Startup.CODE_VERIFIER, codeVerifier}
    };

因此，唯一的方法是“手动”添加它。

赞(0）回复(0）举报 2023-01-14

我来回答

.NET Framework C# OIDC将PKCE添加到亚马逊AWS认知

1条答案

相关问题

热门标签

最新问答