Add triple token exchange choice

Author: whamm86

examples/TokenTool/TokenTool.Core/TokenTool.cs

@@ -62,7 +62,7 @@ public async Task RunAsync(MyApp.IOConsole ioConsole)
         input = (ioConsole.ReadLine() ?? "").ToLower();
 
         var exchange = "0";
-        if (input.EndsWith("x") || input.EndsWith("1") || input.EndsWith("2"))
+        if (input.EndsWith("x") || input.EndsWith("1") || input.EndsWith("2") || input.EndsWith("3"))
         {
             exchange = input.Substring(1, 1);
             input = input.Substring(0, 1);
@@ -320,7 +320,160 @@ public async Task RunAsync(MyApp.IOConsole ioConsole)
             }
         }
 
-        if (exchange == "2")
+        if (exchange == "2" || exchange == "3")
+        {
+            handler = new HttpClientHandler { DefaultProxyCredentials = CredentialCache.DefaultCredentials };
+            client = new HttpClient(handler);
+
+            ioConsole.WriteLine("Token Exchange");
+            configUrlList = [
+                "https://iam-security-training.com/provider/sts"
+            ];
+            for (var i = 0; i < configUrlList.Count; i++)
+            {
+                ioConsole.WriteLine(i + ": " + configUrlList[i]);
+            }
+            input = "0";
+            if (configUrlList.Count > 1)
+            {
+                ioConsole.WriteLine("Enter index: ");
+                input = ioConsole.ReadLine();
+            }
+            configUrl = configUrlList[Convert.ToInt32(input ?? "0")];
+
+            configUrlList = [
+                "",
+                "basyx",
+                "assetfox",
+                "factory-x"
+            ];
+            for (var i = 0; i < configUrlList.Count; i++)
+            {
+                ioConsole.WriteLine(i + ": " + configUrlList[i]);
+            }
+            input = "0";
+            if (configUrlList.Count > 1)
+            {
+                ioConsole.WriteLine("Enter index: ");
+                input = ioConsole.ReadLine();
+            }
+            target = configUrlList[Convert.ToInt32(input ?? "0")];
+
+            var d = new Dictionary<string, string>
+            {
+                { "grant_type", "urn:ietf:params:oauth:grant-type:token-exchange" },
+                { "subject_token_type", "urn:ietf:params:oauth:token-type:jwt" },
+                { "requested_token_type", "urn:ietf:params:oauth:token-type:access_token" },
+                { "subject_token", accessToken },
+            };
+            if (target != "")
+            {
+                d.Add("audience", target);
+            }
+            var request = new HttpRequestMessage(HttpMethod.Post, $"{configUrl}/token")
+            {
+                Content = new FormUrlEncodedContent(d)
+            };
+            request.Content.Headers.ContentType = new MediaTypeHeaderValue("application/x-www-form-urlencoded");
+
+            var response = await client.SendAsync(request);
+            var content = await response.Content.ReadAsStringAsync();
+
+            accessToken = "";
+            doc = JsonDocument.Parse(content);
+            if (doc.RootElement.TryGetProperty("access_token", out var tokenElement))
+            {
+                accessToken = tokenElement.GetString();
+                ioConsole.WriteLine("Access Token: " + accessToken);
+
+                using var httpClient = new HttpClient(handler);
+                var jwksJson = await httpClient.GetStringAsync($"{configUrl}/jwks");
+                var jwks = JObject.Parse(jwksJson)["keys"];
+
+                /*
+                var handler2 = new JwtSecurityTokenHandler();
+                var jwt2 = handler2.ReadJwtToken(accessToken);
+                var kid = jwt2.Header["kid"].ToString();
+
+                // 3. Find matching key
+                var key = jwks.First(k => k["kid"].ToString() == kid);
+
+                // 4. Build RSA key
+                var e = Base64UrlEncoder.DecodeBytes(key["e"].ToString());
+                var n = Base64UrlEncoder.DecodeBytes(key["n"].ToString());
+                var rsa = new RSAParameters { Exponent = e, Modulus = n };
+                var rsaKey = new RsaSecurityKey(rsa);
+
+                // 5. Validate token
+                var validationParams = new TokenValidationParameters
+                {
+                    ValidateIssuer = false,
+                    ValidateAudience = false,
+                    ValidateLifetime = true,
+                    ValidateIssuerSigningKey = true,
+                    IssuerSigningKey = rsaKey,
+                    ClockSkew = TimeSpan.FromMinutes(5)
+                };
+
+                try
+                {
+                    handler2.ValidateToken(accessToken, validationParams, out _);
+                    ioConsole.WriteLine("Token is valid");
+                }
+                catch (Exception ex)
+                {
+                    ioConsole.WriteLine($"Validation failed: {ex.Message}");
+                }
+                */
+
+                // 1) Handler
+                var handler2 = new JsonWebTokenHandler();
+
+                // 2) JWK aus JWKS direkt verwenden (hier exemplarisch LINQ auf Dein jwks-Array)
+                var jwtHeaderKid = new JsonWebToken(accessToken).Kid; // liest 'kid' robust
+                var jwkJson = jwks.First(k => k["kid"].ToString() == jwtHeaderKid).ToString(); // k ist i. d. R. ein JObject
+                var jwk = new JsonWebKey(jwkJson);
+
+                // 3) Validierungsparameter
+                var validationParams = new TokenValidationParameters
+                {
+                    // Signaturprüfung
+                    IssuerSigningKey = jwk,            // kein manuelles RSAParameters nötig
+                    ValidateIssuerSigningKey = true,
+
+                    // Lebenszeit
+                    ValidateLifetime = true,
+                    RequireExpirationTime = true,
+                    ClockSkew = TimeSpan.FromMinutes(5),   // bei UTC+0 gut, ggf. 2–5 Minuten
+
+                    // Issuer/Audience je nach Bedarf (bei Tests oft aus)
+                    ValidateIssuer = false,                // später auf true + ValidIssuer setzen
+                    ValidateAudience = false,              // später auf true + ValidAudience setzen
+
+                    // Keine Legacy-Claim-Mappings
+                    // MapInboundClaims = false,
+
+                    // Optional: Name-/Rollen-Claims aus dem JWT
+                    NameClaimType = "name",
+                    RoleClaimType = "role"
+                };
+
+                try
+                {
+                    var result = handler2.ValidateToken(accessToken, validationParams);
+                    if (!result.IsValid)
+                        ioConsole.WriteLine($"Validation failed: {result.Exception?.Message}");
+                    else
+                        ioConsole.WriteLine("Token is valid");
+                }
+                catch (Exception ex)
+                {
+                    ioConsole.WriteLine($"Validation failed: {ex.Message}");
+                }
+            }
+        }
+
+        if (exchange == "3")
         {
             handler = new HttpClientHandler { DefaultProxyCredentials = CredentialCache.DefaultCredentials };
             client = new HttpClient(handler);