Skip to content

Commit 83c492c

Browse files
CeredronCeredron
authored
Changed from Maskinporten token to Altinn token (#304)
* Changed from Maskinporten token to Altinn token * Remove Maskinporten Options * Updated to use Altinn.Common.PEP for scope handling
1 parent bd2b79a commit 83c492c

9 files changed

+61
-61
lines changed

‎src/Altinn.Broker.API/Altinn.Broker.API.csproj

+3-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
<Project Sdk="Microsoft.NET.Sdk.Web">
1+
<Project Sdk="Microsoft.NET.Sdk.Web">
22

33
<PropertyGroup>
44
<TargetFramework>net8.0</TargetFramework>
@@ -7,6 +7,7 @@
77
</PropertyGroup>
88

99
<ItemGroup>
10+
<PackageReference Include="Altinn.Common.PEP" Version="1.3.0" />
1011
<PackageReference Include="Azure.Extensions.AspNetCore.Configuration.Secrets" Version="1.3.0" />
1112
<PackageReference Include="Hangfire.AspNetCore" Version="1.8.9" />
1213
<PackageReference Include="Hangfire.MemoryStorage" Version="1.8.0" />
@@ -24,6 +25,7 @@
2425
<PackageReference Include="Swashbuckle.AspNetCore" Version="6.5.0" />
2526
<PackageReference Include="Newtonsoft.Json" Version="13.0.3" />
2627
<PackageReference Include="Azure.Messaging.EventGrid" Version="4.21.0" />
28+
<PackageReference Include="System.IdentityModel.Tokens.Jwt" Version="7.3.1" />
2729
</ItemGroup>
2830

2931
<ItemGroup>

‎src/Altinn.Broker.API/Configuration/AuthorizationConstants.cs

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
namespace Altinn.Broker.API.Configuration;
2+
3+
public static class AuthorizationConstants
4+
{
5+
public const string Sender = "Sender";
6+
public const string Recipient = "Recipient";
7+
public const string SenderOrRecipient = "SenderOrRecipient";
8+
public const string Legacy = "Legacy";
9+
public const string ResourceOwner = "ResourceOwner";
10+
11+
public const string SenderScope = "altinn:broker.write";
12+
public const string RecipientScope = "altinn:broker.read";
13+
public const string AdminScope = "altinn:broker.admin";
14+
public const string LegacyScope = "altinn:broker.legacy";
15+
}

‎src/Altinn.Broker.API/Controllers/FileController.cs

+9-8
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
using Altinn.Broker.API.Configuration;
12
using Altinn.Broker.Application;
23
using Altinn.Broker.Application.ConfirmDownloadCommand;
34
using Altinn.Broker.Application.DownloadFileQuery;
@@ -38,7 +39,7 @@ public FileController(ILogger<FileController> logger)
3839
/// </summary>
3940
/// <returns></returns>
4041
[HttpPost]
41-
[Authorize(Policy = "Sender")]
42+
[Authorize(Policy = AuthorizationConstants.Sender)]
4243
public async Task<ActionResult<Guid>> InitializeFile(FileInitalizeExt initializeExt, [ModelBinder(typeof(MaskinportenModelBinder))] CallerIdentity token, [FromServices] InitializeFileCommandHandler handler)
4344
{
4445
LogContextHelpers.EnrichLogsWithInitializeFile(initializeExt);
@@ -59,7 +60,7 @@ public async Task<ActionResult<Guid>> InitializeFile(FileInitalizeExt initialize
5960
[HttpPost]
6061
[Route("{fileId}/upload")]
6162
[Consumes("application/octet-stream")]
62-
[Authorize(Policy = "Sender")]
63+
[Authorize(Policy = AuthorizationConstants.Sender)]
6364
public async Task<ActionResult> UploadFileStreamed(
6465
Guid fileId,
6566
[ModelBinder(typeof(MaskinportenModelBinder))] CallerIdentity token,
@@ -88,7 +89,7 @@ [FromServices] UploadFileCommandHandler handler
8889
[HttpPost]
8990
[Route("upload")]
9091
[RequestFormLimits(MultipartBodyLengthLimit = long.MaxValue)]
91-
[Authorize(Policy = "Sender")]
92+
[Authorize(Policy = AuthorizationConstants.Sender)]
9293
public async Task<ActionResult> InitializeAndUpload(
9394
[FromForm] FileInitializeAndUploadExt form,
9495
[ModelBinder(typeof(MaskinportenModelBinder))] CallerIdentity token,
@@ -126,7 +127,7 @@ [FromServices] UploadFileCommandHandler uploadFileCommandHandler
126127
/// <returns></returns>
127128
[HttpGet]
128129
[Route("{fileId}")]
129-
[Authorize(Policy = "SenderOrRecipient")]
130+
[Authorize(Policy = AuthorizationConstants.SenderOrRecipient)]
130131
public async Task<ActionResult<FileOverviewExt>> GetFileOverview(
131132
Guid fileId,
132133
[ModelBinder(typeof(MaskinportenModelBinder))] CallerIdentity token,
@@ -151,7 +152,7 @@ public async Task<ActionResult<FileOverviewExt>> GetFileOverview(
151152
/// <returns></returns>
152153
[HttpGet]
153154
[Route("{fileId}/details")]
154-
[Authorize(Policy = "SenderOrRecipient")]
155+
[Authorize(Policy = AuthorizationConstants.SenderOrRecipient)]
155156
public async Task<ActionResult<FileStatusDetailsExt>> GetFileDetails(
156157
Guid fileId,
157158
[ModelBinder(typeof(MaskinportenModelBinder))] CallerIdentity token,
@@ -175,7 +176,7 @@ public async Task<ActionResult<FileStatusDetailsExt>> GetFileDetails(
175176
/// </summary>
176177
/// <returns></returns>
177178
[HttpGet]
178-
[Authorize(Policy = "SenderOrRecipient")]
179+
[Authorize(Policy = AuthorizationConstants.SenderOrRecipient)]
179180
public async Task<ActionResult<List<Guid>>> GetFiles(
180181
[FromQuery] string resourceId,
181182
[FromQuery] FileStatusExt? status,
@@ -208,7 +209,7 @@ public async Task<ActionResult<List<Guid>>> GetFiles(
208209
/// <returns></returns>
209210
[HttpGet]
210211
[Route("{fileId}/download")]
211-
[Authorize(Policy = "Recipient")]
212+
[Authorize(Policy = AuthorizationConstants.Recipient)]
212213
public async Task<ActionResult> DownloadFile(
213214
Guid fileId,
214215
[ModelBinder(typeof(MaskinportenModelBinder))] CallerIdentity token,
@@ -233,7 +234,7 @@ public async Task<ActionResult> DownloadFile(
233234
/// <returns></returns>
234235
[HttpPost]
235236
[Route("{fileId}/confirmdownload")]
236-
[Authorize(Policy = "Recipient")]
237+
[Authorize(Policy = AuthorizationConstants.Recipient)]
237238
public async Task<ActionResult> ConfirmDownload(
238239
Guid fileId,
239240
[ModelBinder(typeof(MaskinportenModelBinder))] CallerIdentity token,

‎src/Altinn.Broker.API/Controllers/LegacyFileController.cs

+2-1
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
using Altinn.Broker.API.Configuration;
12
using Altinn.Broker.Application;
23
using Altinn.Broker.Application.ConfirmDownloadCommand;
34
using Altinn.Broker.Application.DownloadFileQuery;
@@ -27,7 +28,7 @@ namespace Altinn.Broker.Controllers
2728
[ApiController]
2829
[Route("broker/api/legacy/v1/file")]
2930
[Authorize(AuthenticationSchemes = JwtBearerDefaults.AuthenticationScheme)]
30-
[Authorize(Policy = "Legacy")]
31+
[Authorize(Policy = AuthorizationConstants.Legacy)]
3132
public class LegacyFileController : Controller
3233
{
3334
private readonly ILogger<LegacyFileController> _logger;

‎src/Altinn.Broker.API/Controllers/ResourceController.cs

+2-4
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
using System.Net;
22

3+
using Altinn.Broker.API.Configuration;
34
using Altinn.Broker.Core.Domain;
45
using Altinn.Broker.Core.Repositories;
56
using Altinn.Broker.Middlewares;
67
using Altinn.Broker.Models.Service;
7-
using Altinn.Broker.Persistence.Repositories;
88

99
using Microsoft.AspNetCore.Authentication.JwtBearer;
1010
using Microsoft.AspNetCore.Authorization;
@@ -15,6 +15,7 @@ namespace Altinn.Broker.Controllers;
1515
[ApiController]
1616
[Route("broker/api/v1/resource")]
1717
[Authorize(AuthenticationSchemes = JwtBearerDefaults.AuthenticationScheme)]
18+
[Authorize(Policy = AuthorizationConstants.ResourceOwner)]
1819
public class ResourceController : Controller
1920
{
2021
private readonly IResourceRepository _resourceRepository;
@@ -29,7 +30,6 @@ public ResourceController(IResourceRepository resourceRepository, IResourceOwner
2930
}
3031

3132
[HttpPost]
32-
[Authorize(Policy = "ResourceOwner")]
3333
public async Task<ActionResult> RegisterResource([ModelBinder(typeof(MaskinportenModelBinder))] CallerIdentity token, ResourceInitializeExt resourceInitializeExt)
3434
{
3535
var resourceOwner = await _resourceOwnerRepository.GetResourceOwner(token.Consumer);
@@ -54,7 +54,6 @@ public async Task<ActionResult> RegisterResource([ModelBinder(typeof(Maskinporte
5454

5555
[HttpGet]
5656
[Route("{resourceId}")]
57-
[Authorize(Policy = "ResourceOwner")]
5857
public async Task<ActionResult<ResourceOverviewExt>> GetResourceConfiguration(string resourceId)
5958
{
6059
var resource = await _resourceRepository.GetResource(resourceId);
@@ -72,7 +71,6 @@ public async Task<ActionResult<ResourceOverviewExt>> GetResourceConfiguration(st
7271
}
7372

7473
[HttpGet]
75-
[Authorize(Policy = "ResourceOwner")]
7674
public async Task<ActionResult<List<string>>> GetAllResources([ModelBinder(typeof(MaskinportenModelBinder))] CallerIdentity token)
7775
{
7876
var resources = await _resourceRepository.SearchResources(token.Consumer);

‎src/Altinn.Broker.API/Models/AltinnOptions.cs

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
namespace Altinn.Broker.API.Models;
2+
3+
public class AltinnOptions
4+
{
5+
public string OpenIdWellKnown { get; set; }
6+
}

‎src/Altinn.Broker.API/Models/Maskinporten/MaskinportenOptions.cs

-6
This file was deleted.

‎src/Altinn.Broker.API/Program.cs

+22-39
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,23 @@
11
using System.Text.Json.Serialization;
22

3+
using Altinn.Broker.API.Configuration;
4+
using Altinn.Broker.API.Models;
35
using Altinn.Broker.Application;
4-
using Altinn.Broker.Helpers;
56
using Altinn.Broker.Integrations;
67
using Altinn.Broker.Integrations.Azure;
78
using Altinn.Broker.Integrations.Hangfire;
89
using Altinn.Broker.Middlewares;
9-
using Altinn.Broker.Models.Maskinporten;
1010
using Altinn.Broker.Persistence;
1111
using Altinn.Broker.Persistence.Options;
12+
using Altinn.Common.PEP.Authorization;
1213

1314
using Hangfire;
1415

1516
using Microsoft.ApplicationInsights.Extensibility;
1617
using Microsoft.AspNetCore.Authentication.JwtBearer;
18+
using Microsoft.AspNetCore.Authorization;
1719
using Microsoft.AspNetCore.Http.Features;
1820
using Microsoft.AspNetCore.Server.Kestrel.Core;
19-
using Microsoft.IdentityModel.JsonWebTokens;
2021
using Microsoft.IdentityModel.Tokens;
2122

2223
using Serilog;
@@ -97,7 +98,7 @@ static void ConfigureServices(IServiceCollection services, IConfiguration config
9798

9899
services.Configure<DatabaseOptions>(config.GetSection(key: nameof(DatabaseOptions)));
99100
services.Configure<AzureResourceManagerOptions>(config.GetSection(key: nameof(AzureResourceManagerOptions)));
100-
services.Configure<MaskinportenOptions>(config.GetSection(key: nameof(MaskinportenOptions)));
101+
services.Configure<AltinnOptions>(config.GetSection(key: nameof(AltinnOptions)));
101102

102103
services.AddHttpClient();
103104
services.AddProblemDetails();
@@ -106,47 +107,29 @@ static void ConfigureServices(IServiceCollection services, IConfiguration config
106107

107108
services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme).AddJwtBearer(options =>
108109
{
109-
var maskinportenOptions = new MaskinportenOptions();
110-
config.GetSection(nameof(MaskinportenOptions)).Bind(maskinportenOptions);
110+
var altinnOptions = new AltinnOptions();
111+
config.GetSection(nameof(AltinnOptions)).Bind(altinnOptions);
111112
options.SaveToken = true;
112-
options.MetadataAddress = $"{maskinportenOptions.Issuer}.well-known/oauth-authorization-server";
113-
if (hostEnvironment.IsDevelopment())
113+
options.MetadataAddress = altinnOptions.OpenIdWellKnown;
114+
options.TokenValidationParameters = new TokenValidationParameters
114115
{
115-
options.TokenValidationParameters = new TokenValidationParameters
116-
{
117-
ValidateIssuer = false,
118-
ValidateAudience = false,
119-
ValidateLifetime = false,
120-
RequireExpirationTime = false,
121-
RequireSignedTokens = false,
122-
SignatureValidator = delegate (string token, TokenValidationParameters parameters)
123-
{
124-
var jwt = new JsonWebToken(token);
125-
return jwt;
126-
}
127-
};
128-
}
129-
else
130-
{
131-
options.TokenValidationParameters = new TokenValidationParameters
132-
{
133-
ValidIssuer = maskinportenOptions.Issuer,
134-
ValidateIssuer = true,
135-
ValidateAudience = false,
136-
ValidateLifetime = true,
137-
RequireExpirationTime = true,
138-
RequireSignedTokens = true
139-
};
140-
}
116+
ValidateIssuerSigningKey = true,
117+
ValidateIssuer = false,
118+
ValidateAudience = false,
119+
RequireExpirationTime = true,
120+
ValidateLifetime = true,
121+
ClockSkew = TimeSpan.Zero
122+
};
141123
});
142124

125+
services.AddTransient<IAuthorizationHandler, ScopeAccessHandler>();
143126
services.AddAuthorization(options =>
144127
{
145-
options.AddPolicy("ResourceOwner", policy => policy.RequireClaim("scope", ["altinn:broker.admin"]));
146-
options.AddPolicy("Sender", policy => policy.RequireClaim("scope", ["altinn:broker.write", "altinn:broker.write altinn:broker.read"]));
147-
options.AddPolicy("Recipient", policy => policy.RequireClaim("scope", ["altinn:broker.read", "altinn:broker.write altinn:broker.read"]));
148-
options.AddPolicy("SenderOrRecipient", policy => policy.RequireClaim("scope", ["altinn:broker.read", "altinn:broker.write", "altinn:broker.write altinn:broker.read"]));
149-
options.AddPolicy("Legacy", policy => policy.RequireClaim("scope", ["altinn:broker.legacy"]));
128+
options.AddPolicy(AuthorizationConstants.Sender, policy => policy.AddRequirements(new ScopeAccessRequirement(AuthorizationConstants.SenderScope)));
129+
options.AddPolicy(AuthorizationConstants.ResourceOwner, policy => policy.AddRequirements(new ScopeAccessRequirement(AuthorizationConstants.AdminScope)));
130+
options.AddPolicy(AuthorizationConstants.Recipient, policy => policy.AddRequirements(new ScopeAccessRequirement(AuthorizationConstants.RecipientScope)));
131+
options.AddPolicy(AuthorizationConstants.SenderOrRecipient, policy => policy.AddRequirements(new ScopeAccessRequirement([AuthorizationConstants.SenderScope, AuthorizationConstants.RecipientScope])));
132+
options.AddPolicy(AuthorizationConstants.Legacy, policy => policy.AddRequirements(new ScopeAccessRequirement(AuthorizationConstants.LegacyScope)));
150133
});
151134

152135
services.Configure<KestrelServerOptions>(options =>

‎src/Altinn.Broker.API/appsettings.Development.json

+2-2
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@
1616
"ClientSecret": "",
1717
"SubscriptionId": ""
1818
},
19-
"MaskinportenOptions": {
20-
"Issuer": "https://test.maskinporten.no/"
19+
"AltinnOptions": {
20+
"OpenIdWellKnown": "https://platform.at21.altinn.cloud/authentication/api/v1/openid/.well-known/openid-configuration"
2121
}
2222
}

0 commit comments

Comments
 (0)