Merge pull request #224 from DuendeSoftware/beh/allow-client-assertions-for-atmopenidconnect

Allow client assertions for ATM OpenIdConnect

Author: bhazen

access-token-management/samples/WebJarJwt/Startup.cs

@@ -3,6 +3,7 @@
 
 using Duende.AccessTokenManagement;
 using Duende.AccessTokenManagement.OpenIdConnect;
+using Microsoft.AspNetCore.Authentication.OpenIdConnect;
 using Microsoft.IdentityModel.Tokens;
 using Serilog;
 using Serilog.Events;
@@ -53,6 +54,9 @@ internal static WebApplication ConfigureServices(this WebApplicationBuilder buil
                     NameClaimType = "name",
                     RoleClaimType = "role"
                 };
+
+                // Disable PAR because it is incompatible with currently wired up OidcEvents
+                options.PushedAuthorizationBehavior = PushedAuthorizationBehavior.Disable;
             });
 
         builder.Services.AddOpenIdConnectAccessTokenManagement();

access-token-management/samples/WebJarJwt/Views/Home/Secure.cshtml

@@ -16,7 +16,7 @@
 |
 <a href="./CallApiAsClientFactory">HTTP client factory</a>
 |
-<a href="./CallApiAsClientFactoryTypes">HTTP client factory (typed)</a>
+<a href="./CallApiAsClientFactoryTyped">HTTP client factory (typed)</a>
 
 
 <h2>Claims</h2>
@@ -37,4 +37,4 @@
         <dt>@prop.Key</dt>
         <dd>@prop.Value</dd>
     }
-</dl>
+</dl>

access-token-management/src/AccessTokenManagement.OpenIdConnect/Internal/OpenIdConnectConfigurationService.cs

@@ -60,7 +60,7 @@ public async Task<OpenIdConnectClientConfiguration> GetOpenIdConnectConfiguratio
             TokenEndpoint = new Uri(configuration.TokenEndpoint),
             RevocationEndpoint = configuration.RevocationEndpoint == null ? null : new Uri(configuration.RevocationEndpoint),
             ClientId = ClientId.Parse(options.ClientId ?? throw new InvalidOperationException("ClientId is null")),
-            ClientSecret = ClientSecret.Parse(options.ClientSecret ?? throw new InvalidOperationException("ClientSecret is null")),
+            ClientSecret = options.ClientSecret == null ? null : ClientSecret.Parse(options.ClientSecret),
             HttpClient = options.Backchannel,
         };
     }

access-token-management/src/AccessTokenManagement.OpenIdConnect/OpenIdConnectClientConfiguration.cs

@@ -33,7 +33,7 @@ public sealed class OpenIdConnectClientConfiguration
     /// <summary>
     /// The client secret
     /// </summary>
-    public required ClientSecret ClientSecret { get; set; }
+    public ClientSecret? ClientSecret { get; set; }
 
     /// <summary>
     /// The HTTP client associated with the OIDC handler (if based on scheme configuration)

access-token-management/test/AccessTokenManagement.Tests/Framework/AppHost.cs

@@ -18,6 +18,7 @@ namespace Duende.AccessTokenManagement.Tests;
 public class AppHost : GenericHost
 {
     public string ClientId;
+    public string? ClientSecret;
 
     private readonly IdentityServerHost _identityServerHost;
     private readonly ApiHost _apiHost;
@@ -35,6 +36,7 @@ public AppHost(
         _identityServerHost = identityServerHost;
         _apiHost = apiHost;
         ClientId = clientId;
+        ClientSecret = "secret";
         _configureUserTokenManagementOptions = configureUserTokenManagementOptions;
         OnConfigureServices += ConfigureServices;
         OnConfigure += Configure;
@@ -68,7 +70,7 @@ private void ConfigureServices(IServiceCollection services)
                 options.Authority = _identityServerHost.Url();
 
                 options.ClientId = ClientId;
-                options.ClientSecret = "secret";
+                options.ClientSecret = ClientSecret;
                 options.ResponseType = "code";
                 options.ResponseMode = "query";
 

access-token-management/test/AccessTokenManagement.Tests/PublicApiVerificationTests.VerifyPublicApi_OpenIdConnect.verified.txt

@@ -50,8 +50,7 @@
         public OpenIdConnectClientConfiguration() { }
         [System.Runtime.CompilerServices.RequiredMember]
         public Duende.AccessTokenManagement.ClientId ClientId { get; set; }
-        [System.Runtime.CompilerServices.RequiredMember]
-        public Duende.AccessTokenManagement.ClientSecret ClientSecret { get; set; }
+        public Duende.AccessTokenManagement.ClientSecret? ClientSecret { get; set; }
         public System.Net.Http.HttpClient? HttpClient { get; set; }
         public System.Uri? RevocationEndpoint { get; set; }
         public Duende.AccessTokenManagement.Scheme Scheme { get; set; }
@@ -137,4 +136,4 @@
         public Duende.AccessTokenManagement.Scheme? ChallengeScheme { get; set; }
         public Duende.AccessTokenManagement.Scheme? SignInScheme { get; set; }
     }
-}
+}

access-token-management/test/AccessTokenManagement.Tests/UserTokenManagementTests.cs

@@ -8,6 +8,7 @@
 
 using Duende.IdentityModel;
 using Duende.IdentityModel.Client;
+using Microsoft.AspNetCore.Authentication.OpenIdConnect;
 using Microsoft.Extensions.DependencyInjection;
 using RichardSzalay.MockHttp;
 using OidcConstants = Duende.IdentityModel.OidcConstants;
@@ -78,10 +79,10 @@ Task<ClaimsPrincipal> LocalTransformPrincipalAsync(ClaimsPrincipal principal, Ca
         // the custom token transform
         await AppHost.BrowserClient!.GetAsync(AppHost.Url("/user_token"));
 
-        // Verify that the transform is used. 
+        // Verify that the transform is used.
         transformed.ShouldBeTrue();
 
-        // The transformed principal should now be used. 
+        // The transformed principal should now be used.
         var claims = await AppHost.BrowserClient!.GetFromJsonAsync<Dictionary<string, string>>(AppHost.Url("/user"));
         claims![JwtClaimTypes.Name].ShouldBe("transformed");
     }
@@ -235,7 +236,7 @@ public async Task Short_token_lifetime_should_trigger_refresh()
         // We mock the expiration of the first few token responses to be short
         // enough that we will automatically refresh immediately when attempting
         // to use the tokens, while the final response gets a long refresh time,
-        // allowing us to verify that the token is not refreshed. 
+        // allowing us to verify that the token is not refreshed.
 
         var mockHttp = new MockHttpMessageHandler();
         AppHost.IdentityServerHttpHandler = mockHttp;
@@ -337,7 +338,7 @@ public async Task Resources_get_distinct_tokens()
             .WithFormData("grant_type", "authorization_code")
             .Respond("application/json", JsonSerializer.Serialize(initialTokenResponse));
 
-        // resource 1 specified 
+        // resource 1 specified
         var resource1TokenResponse = new
         {
             access_token = "urn:api1_access_token",
@@ -350,7 +351,7 @@ public async Task Resources_get_distinct_tokens()
             .WithFormData("resource", "urn:api1")
             .Respond("application/json", JsonSerializer.Serialize(resource1TokenResponse));
 
-        // resource 2 specified 
+        // resource 2 specified
         var resource2TokenResponse = new
         {
             access_token = "urn:api2_access_token",
@@ -500,4 +501,54 @@ public async Task Logout_should_revoke_refresh_tokens()
         postLogoutIntrospectionResponse.IsActive.ShouldBeFalse();
 
     }
+
+    [Fact]
+    public async Task Can_request_user_token_using_client_assertions()
+    {
+        var mockHttp = new MockHttpMessageHandler();
+        AppHost.IdentityServerHttpHandler = mockHttp;
+        AppHost.ClientSecret = null;
+        AppHost.OnConfigureServices += services =>
+        {
+            services.AddSingleton<IClientAssertionService>(new TestClientAssertionService("test", "service_type", "service_value"));
+            services.PostConfigure<OpenIdConnectOptions>("oidc", options =>
+            {
+                options.Events.OnAuthorizationCodeReceived = async context =>
+                {
+                    var clientAssertionService =
+                        context.HttpContext.RequestServices.GetRequiredService<IClientAssertionService>();
+                    var assertion = await clientAssertionService.GetClientAssertionAsync(ClientCredentialsClientName.Parse("test")) ?? throw new InvalidOperationException("Client assertion is null");
+
+                    context.TokenEndpointRequest!.ClientAssertionType = assertion.Type;
+                    context.TokenEndpointRequest.ClientAssertion = assertion.Value;
+                };
+            });
+        };
+        var expectedRequestFormData = new Dictionary<string, string>
+        {
+            { OidcConstants.TokenRequest.ClientAssertionType, "service_type" },
+            { OidcConstants.TokenRequest.ClientAssertion, "service_value" },
+        };
+        var initialTokenResponse = new
+        {
+            id_token = IdentityServerHost.CreateIdToken("1", "web"),
+            access_token = "initial_access_token",
+            token_type = "clientAssertionsWork",
+            expires_in = 3600,
+            refresh_token = "initial_refresh_token",
+        };
+
+        // response for re-deeming code
+        mockHttp.When("/connect/token")
+            .WithFormData(expectedRequestFormData)
+            .Respond("application/json", JsonSerializer.Serialize(initialTokenResponse));
+        await InitializeAsync();
+        await AppHost.LoginAsync("alice");
+
+        var response = await AppHost.BrowserClient.GetAsync(AppHost.Url("/user_token"));
+        var token = await response.Content.ReadFromJsonAsync<UserTokenModel>();
+
+        token.ShouldNotBeNull();
+        token.AccessTokenType.ShouldBe("clientAssertionsWork");
+    }
 }