Fix validazione response su attributo AuthnContextClassRef e gestione Log

#10

Author: Daniele Giallonardo

CIE.AspNetCore.Authentication/CIE.AspNetCore.Authentication/CIE.AspNetCore.Authentication.csproj

@@ -12,11 +12,11 @@
     <PackageProjectUrl>https://github.com/italia/cie-aspnetcore</PackageProjectUrl>
     <PackageIcon>cie-nuget.png</PackageIcon>
     <PackageLicenseExpression>MIT</PackageLicenseExpression>
-    <PackageVersion>2.0.0</PackageVersion>
-    <Version>2.0.0</Version>
-    <AssemblyVersion>2.0.0</AssemblyVersion>
-    <FileVersion>2.0.0</FileVersion>
-    <InformationalVersion>2.0.0</InformationalVersion>
+    <PackageVersion>2.0.1-prerelease</PackageVersion>
+    <Version>2.0.1</Version>
+    <AssemblyVersion>2.0.1</AssemblyVersion>
+    <FileVersion>2.0.1</FileVersion>
+    <InformationalVersion>2.0.1</InformationalVersion>
     <PackageRequireLicenseAcceptance>true</PackageRequireLicenseAcceptance>
     <PackageReadmeFile>README.md</PackageReadmeFile>
     <RepositoryUrl>https://github.com/italia/cie-aspnetcore</RepositoryUrl>

CIE.AspNetCore.Authentication/CIE.AspNetCore.Authentication/CieHandler.cs

@@ -6,6 +6,7 @@
 using CIE.AspNetCore.Authentication.Saml;
 using Microsoft.AspNetCore.Authentication;
 using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Http.Extensions;
 using Microsoft.Extensions.Logging;
 using Microsoft.Extensions.Options;
 using Microsoft.Extensions.Primitives;
@@ -389,6 +390,18 @@ private string RemoveFiscalNumberPrefix(string fiscalNumber)
                 var form = await Request.ReadFormAsync();
 
                 var serializedResponse = Encoding.UTF8.GetString(Convert.FromBase64String(form["SAMLResponse"][0]));
+
+                await _logHandler.LogPostResponse(new PostResponse()
+                {
+                    SignedMessage = serializedResponse,
+                    SAMLResponse = form["SAMLResponse"].FirstOrDefault(),
+                    RelayState = form["RelayState"].ToString(),
+                    ContentType = Request.ContentType,
+                    Url = Request.GetEncodedUrl(),
+                    Headers = Request.Headers.ToDictionary(t => t.Key, t => t.Value),
+                    Cookies = Request.Cookies.ToDictionary(t => t.Key, t => t.Value)
+                });
+
                 return (
                     form["RelayState"].ToString(),
                     SamlHandler.GetAuthnResponse(form["SAMLResponse"][0]),
@@ -400,6 +413,17 @@ private string RemoveFiscalNumberPrefix(string fiscalNumber)
                 && Request.Query.ContainsKey("RelayState"))
             {
                 var serializedResponse = DecompressString(Request.Query["SAMLResponse"].FirstOrDefault());
+
+                await _logHandler.LogRedirectResponse(new RedirectResponse()
+                {
+                    SignedMessage = serializedResponse,
+                    SAMLResponse = Request.Query["SAMLResponse"].FirstOrDefault(),
+                    RelayState = Request.Query["RelayState"].FirstOrDefault(),
+                    Url = Request.GetEncodedUrl(),
+                    Headers = Request.Headers.ToDictionary(t => t.Key, t => t.Value),
+                    Cookies = Request.Cookies.ToDictionary(t => t.Key, t => t.Value)
+                });
+
                 return (
                     Request.Query["RelayState"].FirstOrDefault(),
                     SamlHandler.GetAuthnResponse(serializedResponse),
@@ -419,9 +443,21 @@ private string RemoveFiscalNumberPrefix(string fiscalNumber)
                 var form = await Request.ReadFormAsync();
 
                 var serializedResponse = Encoding.UTF8.GetString(Convert.FromBase64String(form["SAMLResponse"][0]));
+
+                await _logHandler.LogPostResponse(new PostResponse()
+                {
+                    SignedMessage = serializedResponse,
+                    SAMLResponse = form["SAMLResponse"].FirstOrDefault(),
+                    RelayState = form["RelayState"].ToString(),
+                    ContentType = Request.ContentType,
+                    Url = Request.GetEncodedUrl(),
+                    Headers = Request.Headers.ToDictionary(t => t.Key, t => t.Value),
+                    Cookies = Request.Cookies.ToDictionary(t => t.Key, t => t.Value)
+                });
+
                 return (
                     form["RelayState"].ToString(),
-                    SamlHandler.GetLogoutResponse(form["SAMLResponse"][0]),
+                    SamlHandler.GetLogoutResponse(serializedResponse),
                     serializedResponse
                 );
             }
@@ -430,6 +466,17 @@ private string RemoveFiscalNumberPrefix(string fiscalNumber)
                 && Request.Query.ContainsKey("RelayState"))
             {
                 var serializedResponse = DecompressString(Request.Query["SAMLResponse"].FirstOrDefault());
+
+                await _logHandler.LogRedirectResponse(new RedirectResponse()
+                {
+                    SignedMessage = serializedResponse,
+                    SAMLResponse = Request.Query["SAMLResponse"].FirstOrDefault(),
+                    RelayState = Request.Query["RelayState"].FirstOrDefault(),
+                    Url = Request.GetEncodedUrl(),
+                    Headers = Request.Headers.ToDictionary(t => t.Key, t => t.Value),
+                    Cookies = Request.Cookies.ToDictionary(t => t.Key, t => t.Value)
+                });
+
                 return (
                     Request.Query["RelayState"].FirstOrDefault(),
                     SamlHandler.GetLogoutResponse(serializedResponse),

CIE.AspNetCore.Authentication/CIE.AspNetCore.Authentication/Helpers/OptionsHelper.cs

@@ -42,7 +42,7 @@ internal static CieConfiguration CreateFromConfiguration(IConfiguration configur
             options.UseTokenLifetime = section.GetValue<bool?>("UseTokenLifetime") ?? false;
             options.SkipUnrecognizedRequests = section.GetValue<bool?>("SkipUnrecognizedRequests") ?? true;
             options.CacheIdpMetadata = section.GetValue<bool?>("CacheIdpMetadata") ?? false;
-            options.SecurityLevel = section.GetValue<int?>("SecurityLevel") ?? 2;
+            options.SecurityLevel = section.GetValue<int?>("SecurityLevel") ?? 3;
             var requestMethodParsed = Enum.TryParse<RequestMethod>(section.GetValue<string?>("RequestMethod"), out var requestMethod);
             options.RequestMethod = requestMethodParsed ? requestMethod : RequestMethod.Post;
             var certificateSection = section.GetSection("Certificate");

CIE.AspNetCore.Authentication/CIE.AspNetCore.Authentication/Saml/SamlHandler.cs

@@ -77,8 +77,8 @@ public static AuthnRequestType GetAuthnRequest(string requestId,
                 Version = SamlConst.Version,
                 IssueInstant = now.AddMinutes(nowDelta).ToString(dateTimeFormat),
                 Destination = identityProvider.GetSingleSignOnServiceUrl(requestMethod),
-                ForceAuthn = securityLevel > 1,
-                ForceAuthnSpecified = securityLevel > 1,
+                ForceAuthn = true,
+                ForceAuthnSpecified = true,
                 Issuer = new NameIDType
                 {
                     Value = entityId.Trim(),
@@ -356,10 +356,9 @@ public static void ValidateAuthnResponse(this ResponseType response, AuthnReques
             BusinessValidation.ValidationNotNull(response.GetAssertion().GetAuthnStatement().AuthnContext, ErrorFields.AuthnContext);
             BusinessValidation.ValidationNotNull(response.GetAssertion().GetAuthnStatement().AuthnContext.Items, ErrorFields.AuthnContext);
             BusinessValidation.ValidationNotNull(response.GetAssertion().GetAuthnStatement().AuthnContext.ItemsElementName, ErrorFields.AuthnContext);
+
             BusinessValidation.ValidationCondition(() => response.GetAssertion().GetAuthnStatement().AuthnContext.GetAuthnContextClassRef() == null, string.Format(ErrorLocalization.NotSpecified, "AuthnStatement.AuthnContext.AuthnContextClassRef"));
             BusinessValidation.ValidationCondition(() => string.IsNullOrWhiteSpace(response.GetAssertion().GetAuthnStatement().AuthnContext.GetAuthnContextClassRef()), string.Format(ErrorLocalization.Missing, "AuthnStatement.AuthnContext.AuthnContextClassRef"));
-            BusinessValidation.ValidationCondition(() => !response.GetAssertion().GetAuthnStatement().AuthnContext.GetAuthnContextClassRef().Equals(request.RequestedAuthnContext.Items[0]), string.Format(ErrorLocalization.ParameterNotValid, ErrorFields.AuthnContextClassRef));
-
             BusinessValidation.ValidationCondition(() => !listAuthRefValid.Contains(response.GetAssertion().GetAuthnStatement().AuthnContext.GetAuthnContextClassRef()), string.Format(ErrorLocalization.ParameterNotValid, ErrorFields.AuthnContextClassRef));
 
             var responseAuthnContextClassRefLevel = int.Parse(response.GetAssertion().GetAuthnStatement().AuthnContext.GetAuthnContextClassRef().Last().ToString());

CIE.AspNetCore.Authentication/CIE.AspNetCore.WebApp/appsettings.json

@@ -42,7 +42,7 @@
     "AssertionConsumerServiceIndex": 0,
     "AttributeConsumingServiceIndex": 0,
     "Method": "Post",
-    "SecurityLevel": 3
+    "SecurityLevel": 2
   },
   "AllowedHosts": "*"
 }