-
Notifications
You must be signed in to change notification settings - Fork 16
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat: Add ImpersonationGrantValidator
- Loading branch information
Showing
19 changed files
with
235 additions
and
14 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
9 changes: 9 additions & 0 deletions
9
src/Contracts/Masa.Auth.Contracts.Admin/Subjects/ImpersonateInput.cs
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,9 @@ | ||
| // Copyright (c) MASA Stack All rights reserved. | ||
| // Licensed under the Apache License. See LICENSE.txt in the project root for license information. | ||
|
|
||
| namespace Masa.Auth.Contracts.Admin.Subjects; | ||
|
|
||
| public class ImpersonateInput | ||
| { | ||
| public Guid UserId { get; set; } | ||
| } |
9 changes: 9 additions & 0 deletions
9
src/Contracts/Masa.Auth.Contracts.Admin/Subjects/ImpersonateOutput.cs
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,9 @@ | ||
| // Copyright (c) MASA Stack All rights reserved. | ||
| // Licensed under the Apache License. See LICENSE.txt in the project root for license information. | ||
|
|
||
| namespace Masa.Auth.Contracts.Admin.Subjects; | ||
|
|
||
| public class ImpersonateOutput | ||
| { | ||
| public string ImpersonationToken { get; set; } = string.Empty; | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
9 changes: 9 additions & 0 deletions
9
src/Services/Masa.Auth.Service.Admin/Application/Subjects/Commands/ImpersonateUserCommand.cs
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,9 @@ | ||
| // Copyright (c) MASA Stack All rights reserved. | ||
| // Licensed under the Apache License. See LICENSE.txt in the project root for license information. | ||
|
|
||
| namespace Masa.Auth.Service.Admin.Application.Subjects.Commands; | ||
|
|
||
| public record ImpersonateUserCommand(Guid UserId, bool IsBackToImpersonator) : Command | ||
| { | ||
| public ImpersonateOutput Result { get; set; } = new(); | ||
| } |
9 changes: 9 additions & 0 deletions
9
src/Services/Masa.Auth.Service.Admin/Application/Subjects/Queries/ImpersonatedUserQuery.cs
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,9 @@ | ||
| // Copyright (c) MASA Stack All rights reserved. | ||
| // Licensed under the Apache License. See LICENSE.txt in the project root for license information. | ||
|
|
||
| namespace Masa.Auth.Service.Admin.Application.Subjects.Queries; | ||
|
|
||
| public record ImpersonatedUserQuery(string ImpersonationToken) : Query<ImpersonationCacheItem> | ||
| { | ||
| public override ImpersonationCacheItem Result { get; set; } = new(); | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
25 changes: 25 additions & 0 deletions
25
src/Services/Masa.Auth.Service.Admin/Infrastructure/CacheModels/ImpersonationCacheItem.cs
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,25 @@ | ||
| // Copyright (c) MASA Stack All rights reserved. | ||
| // Licensed under the Apache License. See LICENSE.txt in the project root for license information. | ||
|
|
||
| namespace Masa.Auth.Service.Admin.Infrastructure.CacheModels; | ||
|
|
||
| [Serializable] | ||
| public class ImpersonationCacheItem | ||
| { | ||
| public Guid ImpersonatorUserId { get; set; } | ||
|
|
||
| public Guid TargetUserId { get; set; } | ||
|
|
||
| public bool IsBackToImpersonator { get; set; } | ||
|
|
||
| public ImpersonationCacheItem() | ||
| { | ||
|
|
||
| } | ||
|
|
||
| public ImpersonationCacheItem(Guid targetUserId, bool isBackToImpersonator) | ||
| { | ||
| TargetUserId = targetUserId; | ||
| IsBackToImpersonator = isBackToImpersonator; | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
32 changes: 32 additions & 0 deletions
32
src/Web/Masa.Auth.Web.Sso/Infrastructure/Validations/ImpersonationCacheItem.cs
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,32 @@ | ||
| // Copyright (c) MASA Stack All rights reserved. | ||
| // Licensed under the Apache License. See LICENSE.txt in the project root for license information. | ||
|
|
||
| namespace Masa.Auth.Web.Sso.Infrastructure.Validations; | ||
|
|
||
| [Serializable] | ||
| public class ImpersonationCacheItem | ||
| { | ||
| public const string CACHE_NAME = "AppImpersonationCache"; | ||
|
|
||
| public int? ImpersonatorTenantId { get; set; } | ||
|
|
||
| public long ImpersonatorUserId { get; set; } | ||
|
|
||
| public int? TargetTenantId { get; set; } | ||
|
|
||
| public long TargetUserId { get; set; } | ||
|
|
||
| public bool IsBackToImpersonator { get; set; } | ||
|
|
||
| public ImpersonationCacheItem() | ||
| { | ||
|
|
||
| } | ||
|
|
||
| public ImpersonationCacheItem(int? targetTenantId, long targetUserId, bool isBackToImpersonator) | ||
| { | ||
| TargetTenantId = targetTenantId; | ||
| TargetUserId = targetUserId; | ||
| IsBackToImpersonator = isBackToImpersonator; | ||
| } | ||
| } |
53 changes: 53 additions & 0 deletions
53
src/Web/Masa.Auth.Web.Sso/Infrastructure/Validations/ImpersonationGrantValidator.cs
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,53 @@ | ||
| // Copyright (c) MASA Stack All rights reserved. | ||
| // Licensed under the Apache License. See LICENSE.txt in the project root for license information. | ||
|
|
||
| namespace Masa.Auth.Web.Sso.Infrastructure.Validations; | ||
|
|
||
| public class ImpersonationGrantValidator : IExtensionGrantValidator | ||
| { | ||
| IAuthClient _authClient; | ||
| public string GrantType { get; } = "impersonation"; | ||
|
|
||
| const string IMPERSONATOR_USER_ID = "http://Lonsid.org/identity/claims/impersonatorUserId"; | ||
|
|
||
| public ImpersonationGrantValidator(IAuthClient authClient) | ||
| { | ||
| _authClient = authClient; | ||
| } | ||
|
|
||
| public async Task ValidateAsync(ExtensionGrantValidationContext context) | ||
| { | ||
| var impersonationToken = context.Request.Raw["impersonationToken"]; | ||
| if (string.IsNullOrEmpty(impersonationToken)) | ||
| { | ||
| context.Result = new GrantValidationResult | ||
| { | ||
| IsError = true, | ||
| Error = "Must provide impersonationToken", | ||
| ErrorDescription = "Must provide impersonationToken" | ||
| }; | ||
| return; | ||
| } | ||
|
|
||
| var cacheItem = await _authClient.UserService.GetImpersonatedUserAsync(impersonationToken); | ||
| if (cacheItem is null) | ||
| { | ||
| context.Result = new GrantValidationResult | ||
| { | ||
| IsError = true, | ||
| Error = "Impersonated user does not exist", | ||
| ErrorDescription = "Impersonated user does not exist", | ||
| }; | ||
| return; | ||
| } | ||
|
|
||
| var claims = new List<Claim>(); | ||
|
|
||
| if (!cacheItem.IsBackToImpersonator) | ||
| { | ||
| claims.Add(new Claim(IMPERSONATOR_USER_ID, cacheItem.ImpersonatorUserId.ToString())); | ||
| } | ||
|
|
||
| context.Result = new GrantValidationResult(cacheItem.TargetUserId.ToString(), "impersonation", claims); | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters