Log user claims

Signed-off-by: Victor Chang <[email protected]>

Author: mocsharp

src/Authentication/Configurations/AuthenticationOptions.cs

@@ -24,10 +24,10 @@ namespace Monai.Deploy.Security.Authentication.Configurations
 {
     public class AuthenticationOptions
     {
-        [ConfigurationKeyName("BypassAuthentication")]
+        [ConfigurationKeyName("bypassAuthentication")]
         public bool? BypassAuthentication { get; set; }
 
-        [ConfigurationKeyName("OpenId")]
+        [ConfigurationKeyName("openId")]
         public OpenIdOptions? OpenId { get; set; }
 
         public bool BypassAuth(ILogger logger)

src/Authentication/Configurations/ClaimMappings.cs

@@ -20,10 +20,10 @@ namespace Monai.Deploy.Security.Authentication.Configurations
 {
     public class ClaimMappings
     {
-        [ConfigurationKeyName("UserClaims")]
+        [ConfigurationKeyName("userClaims")]
         public List<ClaimMapping>? UserClaims { get; set; }
 
-        [ConfigurationKeyName("AdminClaims")]
+        [ConfigurationKeyName("adminClaims")]
         public List<ClaimMapping>? AdminClaims { get; set; }
     }
 
@@ -32,8 +32,8 @@ public class ClaimMapping
         [ConfigurationKeyName("claim")]
         public string Claim { get; set; } = string.Empty;
 
-        [ConfigurationKeyName("role")]
-        public string Role { get; set; } = string.Empty;
+        [ConfigurationKeyName("roles")]
+        public List<string> Roles { get; set; } = new List<string>();
 
         [ConfigurationKeyName("endpoints")]
         public List<string>? Endpoints { get; set; } = default;

src/Authentication/Configurations/OpenIdOptions.cs

@@ -20,19 +20,19 @@ namespace Monai.Deploy.Security.Authentication.Configurations
 {
     public class OpenIdOptions
     {
-        [ConfigurationKeyName("ServerRealm")]
+        [ConfigurationKeyName("realm")]
         public string? ServerRealm { get; set; }
 
-        [ConfigurationKeyName("ServerRealmKey")]
+        [ConfigurationKeyName("realmKey")]
         public string? ServerRealmKey { get; set; }
 
-        [ConfigurationKeyName("ClientId")]
+        [ConfigurationKeyName("clientId")]
         public string? ClientId { get; set; }
 
-        [ConfigurationKeyName("ClaimMappings")]
+        [ConfigurationKeyName("claimMappings")]
         public ClaimMappings? Claims { get; set; }
 
-        [ConfigurationKeyName("Audiences")]
+        [ConfigurationKeyName("audiences")]
         public IList<string>? Audiences { get; set; }
     }
 }

src/Authentication/Extensions/HttpContextExtension.cs

@@ -27,33 +27,46 @@ public static class HttpContextExtension
         /// <summary>
         /// Gets endpoints specified in config for roles in claims.
         /// </summary>
-        /// <param name="httpcontext"></param>
+        /// <param name="httpContext"></param>
         /// <param name="requiredClaims"></param>
         /// <returns></returns>
-        public static List<string> GetValidEndpoints(this HttpContext httpcontext, ILogger<EndpointAuthorizationMiddleware> logger, List<Configurations.ClaimMapping> adminClaims, List<Configurations.ClaimMapping> userClaims)
+        public static List<string> GetValidEndpoints(this HttpContext httpContext, ILogger<EndpointAuthorizationMiddleware> logger, List<Configurations.ClaimMapping> adminClaims, List<Configurations.ClaimMapping> userClaims)
         {
             Guard.Against.Null(adminClaims);
             Guard.Against.Null(userClaims);
 
+            foreach (var claim in httpContext.User.Claims)
+            {
+                logger.UserClaimFound(claim.Type, claim.Value);
+
+            }
+
             foreach (var claim in adminClaims!)
             {
-                if (httpcontext.User.HasClaim(claim.Claim, claim.Role))
+                foreach (var role in claim.Roles)
                 {
-                    logger.UserClaimFound(claim.Claim, claim.Role);
-                    return new List<string> { "all" };
+                    logger.CheckingUserClaim(claim.Claim, role);
+                    if (httpContext.User.HasClaim(claim.Claim, role))
+                    {
+                        return new List<string> { "*" };
+                    }
                 }
             }
 
+            var endpoints = new List<string>();
             foreach (var claim in userClaims!)
             {
-                if (httpcontext.User.HasClaim(claim.Claim, claim.Role))
+                foreach (var role in claim.Roles)
                 {
-                    logger.UserClaimFound(claim.Claim, claim.Role);
-                    return claim.Endpoints!;
+                    logger.CheckingUserClaim(claim.Claim, role);
+                    if (httpContext.User.HasClaim(claim.Claim, role))
+                    {
+                        endpoints.AddRange(claim.Endpoints!);
+                    }
                 }
             }
 
-            return new List<string>();
+            return endpoints.Distinct().ToList();
         }
     }
 }

src/Authentication/Logging.cs

@@ -29,7 +29,10 @@ public static partial class Log
         [LoggerMessage(EventId = 500002, Level = LogLevel.Debug, Message = "User '{user}' access denied due to limited permissions: '{permissions}'.")]
         public static partial void UserAccessDenied(this ILogger logger, string? user, string? permissions);
 
-        [LoggerMessage(EventId = 500003, Level = LogLevel.Debug, Message = "User claim {claim}={value}.")]
+        [LoggerMessage(EventId = 500003, Level = LogLevel.Trace, Message = "User claim {claim}={value}.")]
         public static partial void UserClaimFound(this ILogger logger, string? claim, string? value);
+
+        [LoggerMessage(EventId = 500004, Level = LogLevel.Trace, Message = "Checking user claim {claim}={value}.")]
+        public static partial void CheckingUserClaim(this ILogger logger, string? claim, string? value);
     }
 }

src/Authentication/Middleware/EndpointAuthorizationMiddleware.cs

@@ -57,7 +57,7 @@ public async Task InvokeAsync(HttpContext httpContext)
                 {
                     _logger.UserAccessingController(httpContext.User.Identity.Name, controller);
                     var validEndpoints = httpContext.GetValidEndpoints(_logger, _options.Value.OpenId!.Claims!.AdminClaims!, _options.Value.OpenId!.Claims!.UserClaims!);
-                    var result = validEndpoints.Any(e => e.Equals(controller, StringComparison.InvariantCultureIgnoreCase)) || validEndpoints.Contains("all");
+                    var result = validEndpoints.Any(e => e.Equals(controller, StringComparison.InvariantCultureIgnoreCase)) || validEndpoints.Contains("*");
 
                     if (result is false)
                     {

src/Authentication/Tests/test.auth.json

@@ -1,28 +1,28 @@
 {
   "MonaiDeployAuthentication": {
-    "BypassAuthentication": false,
-    "OpenId": {
-      "ServerRealm": "TEST-REALM",
-      "ServerRealmKey": "l9ZRlbMQBt9k1klUUrlWFuke8WbqnEde",
-      "Audiences": [ "monai-app" ],
-      "ClientId": "monai-app-test",
-      "ClaimMappings": {
-        "UserClaims": [
+    "bypassAuthentication": false,
+    "openId": {
+      "realm": "TEST-REALM",
+      "realmKey": "l9ZRlbMQBt9k1klUUrlWFuke8WbqnEde",
+      "audiences": [ "monai-app" ],
+      "clientId": "monai-app-test",
+      "claimMappings": {
+        "userClaims": [
           {
             "claim": "user_roles",
-            "role": "role-with-test",
+            "roles": [ "role-with-test" ],
             "endpoints": [ "test" ]
           },
           {
             "claim": "user_roles",
-            "roles": "role-without-test",
+            "roles": [ "role-without-test" ],
             "endpoints": [ "no-test" ]
           }
         ],
-        "AdminClaims": [
+        "adminClaims": [
           {
             "claim": "user_roles",
-            "role": "monai-role-admin"
+            "roles": [ "monai-role-admin" ]
           }
         ]
       }

src/Authentication/example.json

@@ -10,18 +10,19 @@
         "UserClaims": [
           {
             "claim": "user_roles",
-            "role": "monai-deploy-user",
+            "roles": [ "monai-deploy-user" ],
             "endpoints": [ "test" ]
           },
           {
-            "user_roles": "pacs-admins",
+            "user_roles": "user_roles",
+            "roles": [ "pacs-admins" ],
             "endpoints": [ "config" ]
           }
         ],
         "AdminClaims": [
           {
             "claim": "user_roles",
-            "role": "monai-role-admin"
+            "role": [ "monai-role-admin" ]
           }
         ]
       }