Skip to content

Commit cc5bc6b

Browse files
satma0745satma0745
authored
Populate the ValidIssuer and the ValidAudience properties of the JwtBearerOptions.TokenValidationParameters. (#52821)
1 parent f26b79e commit cc5bc6b

File tree

4 files changed

+36
-83
lines changed

4 files changed

+36
-83
lines changed

‎src/Security/Authentication/JwtBearer/src/JwtBearerConfigureOptions.cs

Lines changed: 2 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -42,16 +42,8 @@ public void Configure(string? name, JwtBearerOptions options)
4242

4343
var issuer = configSection[nameof(TokenValidationParameters.ValidIssuer)];
4444
var issuers = configSection.GetSection(nameof(TokenValidationParameters.ValidIssuers)).GetChildren().Select(iss => iss.Value).ToList();
45-
if (issuer is not null)
46-
{
47-
issuers.Add(issuer);
48-
}
4945
var audience = configSection[nameof(TokenValidationParameters.ValidAudience)];
5046
var audiences = configSection.GetSection(nameof(TokenValidationParameters.ValidAudiences)).GetChildren().Select(aud => aud.Value).ToList();
51-
if (audience is not null)
52-
{
53-
audiences.Add(audience);
54-
}
5547

5648
options.Authority = configSection[nameof(options.Authority)] ?? options.Authority;
5749
options.BackchannelTimeout = StringHelpers.ParseValueOrDefault(configSection[nameof(options.BackchannelTimeout)], _invariantTimeSpanParse, options.BackchannelTimeout);
@@ -73,8 +65,10 @@ public void Configure(string? name, JwtBearerOptions options)
7365
{
7466
ValidateIssuer = issuers.Count > 0,
7567
ValidIssuers = issuers,
68+
ValidIssuer = issuer,
7669
ValidateAudience = audiences.Count > 0,
7770
ValidAudiences = audiences,
71+
ValidAudience = audience,
7872
ValidateIssuerSigningKey = true,
7973
IssuerSigningKeys = GetIssuerSigningKeys(configSection, issuers),
8074
};

‎src/Security/Authentication/test/AuthenticationMiddlewareTests.cs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -177,7 +177,7 @@ public async Task WebApplicationBuilder_RegistersAuthenticationAndAuthorizationM
177177
Assert.True(app.Properties.ContainsKey("__AuthorizationMiddlewareSet"));
178178

179179
var options = app.Services.GetService<IOptionsMonitor<JwtBearerOptions>>().Get(JwtBearerDefaults.AuthenticationScheme);
180-
Assert.Equal(new[] { "SomeIssuer" }, options.TokenValidationParameters.ValidIssuers);
180+
Assert.Equal("SomeIssuer", options.TokenValidationParameters.ValidIssuer);
181181
Assert.Equal(new[] { "https://localhost:5001" }, options.TokenValidationParameters.ValidAudiences);
182182
}
183183

‎src/Security/Authentication/test/JwtBearerTests.cs

Lines changed: 0 additions & 69 deletions
Original file line numberDiff line numberDiff line change
@@ -1010,75 +1010,6 @@ public async Task ExpirationAndIssuedWhenMinOrMaxValue()
10101010
Assert.Equal(max, elementValueUtc);
10111011
}
10121012

1013-
[Fact]
1014-
public void CanReadJwtBearerOptionsFromConfig()
1015-
{
1016-
var services = new ServiceCollection().AddLogging();
1017-
var config = new ConfigurationBuilder().AddInMemoryCollection(new[]
1018-
{
1019-
new KeyValuePair<string, string>("Authentication:Schemes:Bearer:ValidIssuer", "dotnet-user-jwts"),
1020-
new KeyValuePair<string, string>("Authentication:Schemes:Bearer:ValidAudiences:0", "http://localhost:5000"),
1021-
new KeyValuePair<string, string>("Authentication:Schemes:Bearer:ValidAudiences:1", "https://localhost:5001"),
1022-
new KeyValuePair<string, string>("Authentication:Schemes:Bearer:BackchannelTimeout", "00:01:00"),
1023-
new KeyValuePair<string, string>("Authentication:Schemes:Bearer:RequireHttpsMetadata", "false"),
1024-
new KeyValuePair<string, string>("Authentication:Schemes:Bearer:SaveToken", "True"),
1025-
}).Build();
1026-
services.AddSingleton<IConfiguration>(config);
1027-
1028-
// Act
1029-
var builder = services.AddAuthentication(o =>
1030-
{
1031-
o.AddScheme<TestHandler>("Bearer", "Bearer");
1032-
});
1033-
builder.AddJwtBearer("Bearer", o => o.UseSecurityTokenValidators = true);
1034-
RegisterAuth(builder, _ => { });
1035-
var sp = services.BuildServiceProvider();
1036-
1037-
// Assert
1038-
var jwtBearerOptions = sp.GetRequiredService<IOptionsMonitor<JwtBearerOptions>>().Get(JwtBearerDefaults.AuthenticationScheme);
1039-
Assert.Equal(jwtBearerOptions.TokenValidationParameters.ValidIssuers, new[] { "dotnet-user-jwts" });
1040-
Assert.Equal(jwtBearerOptions.TokenValidationParameters.ValidAudiences, new[] { "http://localhost:5000", "https://localhost:5001" });
1041-
Assert.Equal(jwtBearerOptions.BackchannelTimeout, TimeSpan.FromSeconds(60));
1042-
Assert.False(jwtBearerOptions.RequireHttpsMetadata);
1043-
Assert.True(jwtBearerOptions.SaveToken);
1044-
Assert.True(jwtBearerOptions.MapInboundClaims); // Assert default values are respected
1045-
}
1046-
1047-
[Fact]
1048-
public void CanReadMultipleIssuersFromConfig()
1049-
{
1050-
var services = new ServiceCollection().AddLogging();
1051-
var firstKey = "qPG6tDtfxFYZifHW3sEueQ==";
1052-
var secondKey = "6JPzXj6aOPdojlZdeLshaA==";
1053-
var config = new ConfigurationBuilder().AddInMemoryCollection(new[]
1054-
{
1055-
new KeyValuePair<string, string>("Authentication:Schemes:Bearer:ValidIssuers:0", "dotnet-user-jwts"),
1056-
new KeyValuePair<string, string>("Authentication:Schemes:Bearer:ValidIssuers:1", "dotnet-user-jwts-2"),
1057-
new KeyValuePair<string, string>("Authentication:Schemes:Bearer:SigningKeys:0:Issuer", "dotnet-user-jwts"),
1058-
new KeyValuePair<string, string>("Authentication:Schemes:Bearer:SigningKeys:0:Value", firstKey),
1059-
new KeyValuePair<string, string>("Authentication:Schemes:Bearer:SigningKeys:0:Length", "32"),
1060-
new KeyValuePair<string, string>("Authentication:Schemes:Bearer:SigningKeys:1:Issuer", "dotnet-user-jwts-2"),
1061-
new KeyValuePair<string, string>("Authentication:Schemes:Bearer:SigningKeys:1:Value", secondKey),
1062-
new KeyValuePair<string, string>("Authentication:Schemes:Bearer:SigningKeys:1:Length", "32"),
1063-
}).Build();
1064-
services.AddSingleton<IConfiguration>(config);
1065-
1066-
// Act
1067-
var builder = services.AddAuthentication(o =>
1068-
{
1069-
o.AddScheme<TestHandler>("Bearer", "Bearer");
1070-
});
1071-
builder.AddJwtBearer("Bearer", o => o.UseSecurityTokenValidators = true);
1072-
RegisterAuth(builder, _ => { });
1073-
var sp = services.BuildServiceProvider();
1074-
1075-
// Assert
1076-
var jwtBearerOptions = sp.GetRequiredService<IOptionsMonitor<JwtBearerOptions>>().Get(JwtBearerDefaults.AuthenticationScheme);
1077-
Assert.Equal(2, jwtBearerOptions.TokenValidationParameters.IssuerSigningKeys.Count());
1078-
Assert.Equal(firstKey, Convert.ToBase64String(jwtBearerOptions.TokenValidationParameters.IssuerSigningKeys.OfType<SymmetricSecurityKey>().FirstOrDefault()?.Key));
1079-
Assert.Equal(secondKey, Convert.ToBase64String(jwtBearerOptions.TokenValidationParameters.IssuerSigningKeys.OfType<SymmetricSecurityKey>().LastOrDefault()?.Key));
1080-
}
1081-
10821013
class InvalidTokenValidator : ISecurityTokenValidator
10831014
{
10841015
public InvalidTokenValidator()

‎src/Security/Authentication/test/JwtBearerTests_Handler.cs

Lines changed: 33 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -968,8 +968,9 @@ public void CanReadJwtBearerOptionsFromConfig()
968968
var config = new ConfigurationBuilder().AddInMemoryCollection(new[]
969969
{
970970
new KeyValuePair<string, string>("Authentication:Schemes:Bearer:ValidIssuer", "dotnet-user-jwts"),
971-
new KeyValuePair<string, string>("Authentication:Schemes:Bearer:ValidAudiences:0", "http://localhost:5000"),
972-
new KeyValuePair<string, string>("Authentication:Schemes:Bearer:ValidAudiences:1", "https://localhost:5001"),
971+
new KeyValuePair<string, string>("Authentication:Schemes:Bearer:ValidIssuers:0", "dotnet-user-jwts-2"),
972+
new KeyValuePair<string, string>("Authentication:Schemes:Bearer:ValidAudience", "http://localhost:5000"),
973+
new KeyValuePair<string, string>("Authentication:Schemes:Bearer:ValidAudiences:0", "http://localhost:5001"),
973974
new KeyValuePair<string, string>("Authentication:Schemes:Bearer:BackchannelTimeout", "00:01:00"),
974975
new KeyValuePair<string, string>("Authentication:Schemes:Bearer:RequireHttpsMetadata", "false"),
975976
new KeyValuePair<string, string>("Authentication:Schemes:Bearer:SaveToken", "True"),
@@ -987,14 +988,41 @@ public void CanReadJwtBearerOptionsFromConfig()
987988

988989
// Assert
989990
var jwtBearerOptions = sp.GetRequiredService<IOptionsMonitor<JwtBearerOptions>>().Get(JwtBearerDefaults.AuthenticationScheme);
990-
Assert.Equal(jwtBearerOptions.TokenValidationParameters.ValidIssuers, new[] { "dotnet-user-jwts" });
991-
Assert.Equal(jwtBearerOptions.TokenValidationParameters.ValidAudiences, new[] { "http://localhost:5000", "https://localhost:5001" });
992-
Assert.Equal(jwtBearerOptions.BackchannelTimeout, TimeSpan.FromSeconds(60));
991+
Assert.Equal("dotnet-user-jwts", jwtBearerOptions.TokenValidationParameters.ValidIssuer);
992+
Assert.Equal(["dotnet-user-jwts-2"], jwtBearerOptions.TokenValidationParameters.ValidIssuers);
993+
Assert.Equal("http://localhost:5000", jwtBearerOptions.TokenValidationParameters.ValidAudience);
994+
Assert.Equal(["http://localhost:5001"], jwtBearerOptions.TokenValidationParameters.ValidAudiences);
995+
Assert.Equal(TimeSpan.FromSeconds(60), jwtBearerOptions.BackchannelTimeout);
993996
Assert.False(jwtBearerOptions.RequireHttpsMetadata);
994997
Assert.True(jwtBearerOptions.SaveToken);
995998
Assert.True(jwtBearerOptions.MapInboundClaims); // Assert default values are respected
996999
}
9971000

1001+
[Fact]
1002+
public void CanReadMultipleAudiencesFromConfig()
1003+
{
1004+
var services = new ServiceCollection().AddLogging();
1005+
var config = new ConfigurationBuilder().AddInMemoryCollection(new[]
1006+
{
1007+
new KeyValuePair<string, string>("Authentication:Schemes:Bearer:ValidAudiences:0", "http://localhost:5000"),
1008+
new KeyValuePair<string, string>("Authentication:Schemes:Bearer:ValidAudiences:1", "https://localhost:5001")
1009+
}).Build();
1010+
services.AddSingleton<IConfiguration>(config);
1011+
1012+
// Act
1013+
var builder = services.AddAuthentication(o =>
1014+
{
1015+
o.AddScheme<TestHandler>("Bearer", "Bearer");
1016+
});
1017+
builder.AddJwtBearer("Bearer");
1018+
RegisterAuth(builder, _ => { });
1019+
var sp = services.BuildServiceProvider();
1020+
1021+
// Assert
1022+
var jwtBearerOptions = sp.GetRequiredService<IOptionsMonitor<JwtBearerOptions>>().Get(JwtBearerDefaults.AuthenticationScheme);
1023+
Assert.Equal(["http://localhost:5000", "https://localhost:5001"], jwtBearerOptions.TokenValidationParameters.ValidAudiences);
1024+
}
1025+
9981026
[Fact]
9991027
public void CanReadMultipleIssuersFromConfig()
10001028
{

0 commit comments

Comments
 (0)