Set RoleClaimType override

mocsharp · mocsharp · commit afaca8842925 · 2022-12-01T16:07:58.000-08:00
Signed-off-by: Victor Chang &lt;vicchang@nvidia.com&gt;
diff --git a/src/Authentication/Configurations/AuthenticationOptions.cs b/src/Authentication/Configurations/AuthenticationOptions.cs
@@ -42,23 +42,23 @@ public bool BypassAuth(ILogger logger)
 
             if (OpenId is null)
             {
-                throw new InvalidOperationException("OpenId configuration is invalid.");
+                throw new InvalidOperationException("openId configuration is invalid.");
             }
             if (OpenId.Claims is null || OpenId.Claims.UserClaims!.IsNullOrEmpty() || OpenId.Claims.AdminClaims!.IsNullOrEmpty())
             {
-                throw new InvalidOperationException("No claims defined for OpenId.");
+                throw new InvalidOperationException("No claimMappings defined for OpenId.");
             }
             if (string.IsNullOrWhiteSpace(OpenId.ClientId))
             {
-                throw new InvalidOperationException("No ClientId defined for OpenId.");
+                throw new InvalidOperationException("No clientId defined for OpenId.");
             }
-            if (string.IsNullOrWhiteSpace(OpenId.ServerRealmKey))
+            if (string.IsNullOrWhiteSpace(OpenId.RealmKey))
             {
-                throw new InvalidOperationException("No ServerRealmKey defined for OpenId.");
+                throw new InvalidOperationException("No realmKey defined for OpenId.");
             }
-            if (string.IsNullOrWhiteSpace(OpenId.ServerRealm))
+            if (string.IsNullOrWhiteSpace(OpenId.Realm))
             {
-                throw new InvalidOperationException("No ServerRealm defined for OpenId.");
+                throw new InvalidOperationException("No realm defined for OpenId.");
             }
 
             return false;
diff --git a/src/Authentication/Configurations/ClaimMappings.cs b/src/Authentication/Configurations/ClaimMappings.cs
@@ -29,11 +29,11 @@ public class ClaimMappings
 
     public class ClaimMapping
     {
-        [ConfigurationKeyName("claim")]
-        public string Claim { get; set; } = string.Empty;
+        [ConfigurationKeyName("claimType")]
+        public string ClaimType { get; set; } = string.Empty;
 
-        [ConfigurationKeyName("roles")]
-        public List<string> Roles { get; set; } = new List<string>();
+        [ConfigurationKeyName("claimValues")]
+        public List<string> ClaimValues { get; set; } = new List<string>();
 
         [ConfigurationKeyName("endpoints")]
         public List<string>? Endpoints { get; set; } = default;
diff --git a/src/Authentication/Configurations/OpenIdOptions.cs b/src/Authentication/Configurations/OpenIdOptions.cs
@@ -21,10 +21,10 @@ namespace Monai.Deploy.Security.Authentication.Configurations
     public class OpenIdOptions
     {
         [ConfigurationKeyName("realm")]
-        public string? ServerRealm { get; set; }
+        public string? Realm { get; set; }
 
         [ConfigurationKeyName("realmKey")]
-        public string? ServerRealmKey { get; set; }
+        public string? RealmKey { get; set; }
 
         [ConfigurationKeyName("clientId")]
         public string? ClientId { get; set; }
@@ -34,5 +34,8 @@ public class OpenIdOptions
 
         [ConfigurationKeyName("audiences")]
         public IList<string>? Audiences { get; set; }
+
+        [ConfigurationKeyName("roleClaimType")]
+        public string RoleClaimType { get; set; } = "roles";
     }
 }
diff --git a/src/Authentication/Extensions/HttpContextExtension.cs b/src/Authentication/Extensions/HttpContextExtension.cs
@@ -43,10 +43,10 @@ public static List<string> GetValidEndpoints(this HttpContext httpContext, ILogg
 
             foreach (var claim in adminClaims!)
             {
-                foreach (var role in claim.Roles)
+                foreach (var role in claim.ClaimValues)
                 {
-                    logger.CheckingUserClaim(claim.Claim, role);
-                    if (httpContext.User.HasClaim(claim.Claim, role))
+                    logger.CheckingUserClaim(claim.ClaimType, role);
+                    if (httpContext.User.HasClaim(claim.ClaimType, role))
                     {
                         return new List<string> { "*" };
                     }
@@ -56,10 +56,10 @@ public static List<string> GetValidEndpoints(this HttpContext httpContext, ILogg
             var endpoints = new List<string>();
             foreach (var claim in userClaims!)
             {
-                foreach (var role in claim.Roles)
+                foreach (var role in claim.ClaimValues)
                 {
-                    logger.CheckingUserClaim(claim.Claim, role);
-                    if (httpContext.User.HasClaim(claim.Claim, role))
+                    logger.CheckingUserClaim(claim.ClaimType, role);
+                    if (httpContext.User.HasClaim(claim.ClaimType, role))
                     {
                         endpoints.AddRange(claim.Endpoints!);
                     }
diff --git a/src/Authentication/Extensions/MonaiAuthenticationExtensions.cs b/src/Authentication/Extensions/MonaiAuthenticationExtensions.cs
@@ -55,14 +55,15 @@ public static IServiceCollection AddMonaiAuthentication(
             })
             .AddJwtBearer(JwtBearerDefaults.AuthenticationScheme, AuthKeys.OpenId, options =>
             {
-                options.Authority = configurations.Value.OpenId!.ServerRealm;
-                options.Audience = configurations.Value.OpenId!.ServerRealm;
+                options.Authority = configurations.Value.OpenId!.Realm;
+                options.Audience = configurations.Value.OpenId!.Realm;
                 options.RequireHttpsMetadata = false;
 
                 options.TokenValidationParameters = new TokenValidationParameters
                 {
-                    IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(configurations.Value.OpenId!.ServerRealmKey!)),
-                    ValidIssuer = configurations.Value.OpenId.ServerRealm,
+                    IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(configurations.Value.OpenId!.RealmKey!)),
+                    RoleClaimType = configurations.Value.OpenId.RoleClaimType,
+                    ValidIssuer = configurations.Value.OpenId.Realm,
                     ValidAudiences = configurations.Value.OpenId.Audiences,
                     ValidateIssuerSigningKey = true,
                     ValidateIssuer = true,
diff --git a/src/Authentication/Tests/EndpointAuthorizationMiddlewareTest.cs b/src/Authentication/Tests/EndpointAuthorizationMiddlewareTest.cs
@@ -28,6 +28,10 @@ public partial class EndpointAuthorizationMiddlewareTest
         [Theory]
         [InlineData("test.noauth.json")]
         [InlineData("test.emptyopenid.json")]
+        [InlineData("test.auth-noclaims.json")]
+        [InlineData("test.auth-noclientid.json")]
+        [InlineData("test.auth-norealm.json")]
+        [InlineData("test.auth-norealmkey.json")]
         public async Task GivenConfigurationFilesIsBad_ExpectExceptionToBeThrown(string configFile)
         {
             await Assert.ThrowsAsync<InvalidOperationException>(async () =>
diff --git a/src/Authentication/Tests/test.auth-noclaims.json b/src/Authentication/Tests/test.auth-noclaims.json
@@ -0,0 +1,12 @@
+﻿{
+  "MonaiDeployAuthentication": {
+    "bypassAuthentication": false,
+    "openId": {
+      "realm": "TEST-REALM",
+      "realmKey": "l9ZRlbMQBt9k1klUUrlWFuke8WbqnEde",
+      "audiences": [ "monai-app" ],
+      "roleClaimType": "roles",
+      "clientId": "monai-app-test"
+    }
+  }
+}
diff --git a/src/Authentication/Tests/test.auth-noclientid.json b/src/Authentication/Tests/test.auth-noclientid.json
@@ -0,0 +1,31 @@
+﻿{
+  "MonaiDeployAuthentication": {
+    "bypassAuthentication": false,
+    "openId": {
+      "realm": "TEST-REALM",
+      "realmKey": "l9ZRlbMQBt9k1klUUrlWFuke8WbqnEde",
+      "audiences": [ "monai-app" ],
+      "roleClaimType": "roles",
+      "claimMappings": {
+        "userClaims": [
+          {
+            "claimType": "user_roles",
+            "claimValues": [ "role-with-test" ],
+            "endpoints": [ "test" ]
+          },
+          {
+            "claimType": "user_roles",
+            "claimValues": [ "role-without-test" ],
+            "endpoints": [ "no-test" ]
+          }
+        ],
+        "adminClaims": [
+          {
+            "claimType": "user_roles",
+            "claimValues": [ "monai-role-admin" ]
+          }
+        ]
+      }
+    }
+  }
+}
diff --git a/src/Authentication/Tests/test.auth-norealm.json b/src/Authentication/Tests/test.auth-norealm.json
@@ -0,0 +1,31 @@
+﻿{
+  "MonaiDeployAuthentication": {
+    "bypassAuthentication": false,
+    "openId": {
+      "realmKey": "l9ZRlbMQBt9k1klUUrlWFuke8WbqnEde",
+      "audiences": [ "monai-app" ],
+      "roleClaimType": "roles",
+      "clientId": "monai-app-test",
+      "claimMappings": {
+        "userClaims": [
+          {
+            "claimType": "user_roles",
+            "claimValues": [ "role-with-test" ],
+            "endpoints": [ "test" ]
+          },
+          {
+            "claimType": "user_roles",
+            "claimValues": [ "role-without-test" ],
+            "endpoints": [ "no-test" ]
+          }
+        ],
+        "adminClaims": [
+          {
+            "claimType": "user_roles",
+            "claimValues": [ "monai-role-admin" ]
+          }
+        ]
+      }
+    }
+  }
+}
diff --git a/src/Authentication/Tests/test.auth-norealmkey.json b/src/Authentication/Tests/test.auth-norealmkey.json
@@ -0,0 +1,31 @@
+﻿{
+  "MonaiDeployAuthentication": {
+    "bypassAuthentication": false,
+    "openId": {
+      "realm": "TEST-REALM",
+      "audiences": [ "monai-app" ],
+      "roleClaimType": "roles",
+      "clientId": "monai-app-test",
+      "claimMappings": {
+        "userClaims": [
+          {
+            "claimType": "user_roles",
+            "claimValues": [ "role-with-test" ],
+            "endpoints": [ "test" ]
+          },
+          {
+            "claimType": "user_roles",
+            "claimValues": [ "role-without-test" ],
+            "endpoints": [ "no-test" ]
+          }
+        ],
+        "adminClaims": [
+          {
+            "claimType": "user_roles",
+            "claimValues": [ "monai-role-admin" ]
+          }
+        ]
+      }
+    }
+  }
+}
diff --git a/src/Authentication/Tests/test.auth.json b/src/Authentication/Tests/test.auth.json
@@ -5,24 +5,25 @@
       "realm": "TEST-REALM",
       "realmKey": "l9ZRlbMQBt9k1klUUrlWFuke8WbqnEde",
       "audiences": [ "monai-app" ],
+      "roleClaimType": "roles",
       "clientId": "monai-app-test",
       "claimMappings": {
         "userClaims": [
           {
-            "claim": "user_roles",
-            "roles": [ "role-with-test" ],
+            "claimType": "user_roles",
+            "claimValues": [ "role-with-test" ],
             "endpoints": [ "test" ]
           },
           {
-            "claim": "user_roles",
-            "roles": [ "role-without-test" ],
+            "claimType": "user_roles",
+            "claimValues": [ "role-without-test" ],
             "endpoints": [ "no-test" ]
           }
         ],
         "adminClaims": [
           {
-            "claim": "user_roles",
-            "roles": [ "monai-role-admin" ]
+            "claimType": "user_roles",
+            "claimValues": [ "monai-role-admin" ]
           }
         ]
       }
diff --git a/src/Authentication/example.json b/src/Authentication/example.json
@@ -9,20 +9,20 @@
       "ClaimMappings": {
         "UserClaims": [
           {
-            "claim": "user_roles",
-            "roles": [ "monai-deploy-user" ],
+            "claimType": "user_roles",
+            "claimValues": [ "monai-deploy-user" ],
             "endpoints": [ "test" ]
           },
           {
-            "user_roles": "user_roles",
-            "roles": [ "pacs-admins" ],
+            "claimType": "user_roles",
+            "claimValues": [ "pacs-admins" ],
             "endpoints": [ "config" ]
           }
         ],
         "AdminClaims": [
           {
-            "claim": "user_roles",
-            "role": [ "monai-role-admin" ]
+            "claimType": "user_roles",
+            "claimValues": [ "monai-role-admin" ]
           }
         ]
       }

Original file line number	Diff line number	Diff line change
`@@ -42,23 +42,23 @@ public bool BypassAuth(ILogger logger)`
`42`	`42`
`43`	`43`	`if (OpenId is null)`
`44`	`44`	`{`
`45`		`- throw new InvalidOperationException("OpenId configuration is invalid.");`
	`45`	`+ throw new InvalidOperationException("openId configuration is invalid.");`
`46`	`46`	`}`
`47`	`47`	`if (OpenId.Claims is null \|\| OpenId.Claims.UserClaims!.IsNullOrEmpty() \|\| OpenId.Claims.AdminClaims!.IsNullOrEmpty())`
`48`	`48`	`{`
`49`		`- throw new InvalidOperationException("No claims defined for OpenId.");`
	`49`	`+ throw new InvalidOperationException("No claimMappings defined for OpenId.");`
`50`	`50`	`}`
`51`	`51`	`if (string.IsNullOrWhiteSpace(OpenId.ClientId))`
`52`	`52`	`{`
`53`		`- throw new InvalidOperationException("No ClientId defined for OpenId.");`
	`53`	`+ throw new InvalidOperationException("No clientId defined for OpenId.");`
`54`	`54`	`}`
`55`		`- if (string.IsNullOrWhiteSpace(OpenId.ServerRealmKey))`
	`55`	`+ if (string.IsNullOrWhiteSpace(OpenId.RealmKey))`
`56`	`56`	`{`
`57`		`- throw new InvalidOperationException("No ServerRealmKey defined for OpenId.");`
	`57`	`+ throw new InvalidOperationException("No realmKey defined for OpenId.");`
`58`	`58`	`}`
`59`		`- if (string.IsNullOrWhiteSpace(OpenId.ServerRealm))`
	`59`	`+ if (string.IsNullOrWhiteSpace(OpenId.Realm))`
`60`	`60`	`{`
`61`		`- throw new InvalidOperationException("No ServerRealm defined for OpenId.");`
	`61`	`+ throw new InvalidOperationException("No realm defined for OpenId.");`
`62`	`62`	`}`
`63`	`63`
`64`	`64`	`return false;`
Original file line number	Diff line number	Diff line change
`@@ -21,10 +21,10 @@ namespace Monai.Deploy.Security.Authentication.Configurations`
`21`	`21`	`public class OpenIdOptions`
`22`	`22`	`{`
`23`	`23`	`[ConfigurationKeyName("realm")]`
`24`		`- public string? ServerRealm { get; set; }`
	`24`	`+ public string? Realm { get; set; }`
`25`	`25`
`26`	`26`	`[ConfigurationKeyName("realmKey")]`
`27`		`- public string? ServerRealmKey { get; set; }`
	`27`	`+ public string? RealmKey { get; set; }`
`28`	`28`
`29`	`29`	`[ConfigurationKeyName("clientId")]`
`30`	`30`	`public string? ClientId { get; set; }`
`@@ -34,5 +34,8 @@ public class OpenIdOptions`
`34`	`34`
`35`	`35`	`[ConfigurationKeyName("audiences")]`
`36`	`36`	`public IList<string>? Audiences { get; set; }`
	`37`	`+`
	`38`	`+ [ConfigurationKeyName("roleClaimType")]`
	`39`	`+ public string RoleClaimType { get; set; } = "roles";`
`37`	`40`	`}`
`38`	`41`	`}`
Original file line number	Diff line number	Diff line change
`@@ -43,10 +43,10 @@ public static List<string> GetValidEndpoints(this HttpContext httpContext, ILogg`
`43`	`43`
`44`	`44`	`foreach (var claim in adminClaims!)`
`45`	`45`	`{`
`46`		`- foreach (var role in claim.Roles)`
	`46`	`+ foreach (var role in claim.ClaimValues)`
`47`	`47`	`{`
`48`		`- logger.CheckingUserClaim(claim.Claim, role);`
`49`		`- if (httpContext.User.HasClaim(claim.Claim, role))`
	`48`	`+ logger.CheckingUserClaim(claim.ClaimType, role);`
	`49`	`+ if (httpContext.User.HasClaim(claim.ClaimType, role))`
`50`	`50`	`{`
`51`	`51`	`return new List<string> { "*" };`
`52`	`52`	`}`
`@@ -56,10 +56,10 @@ public static List<string> GetValidEndpoints(this HttpContext httpContext, ILogg`
`56`	`56`	`var endpoints = new List<string>();`
`57`	`57`	`foreach (var claim in userClaims!)`
`58`	`58`	`{`
`59`		`- foreach (var role in claim.Roles)`
	`59`	`+ foreach (var role in claim.ClaimValues)`
`60`	`60`	`{`
`61`		`- logger.CheckingUserClaim(claim.Claim, role);`
`62`		`- if (httpContext.User.HasClaim(claim.Claim, role))`
	`61`	`+ logger.CheckingUserClaim(claim.ClaimType, role);`
	`62`	`+ if (httpContext.User.HasClaim(claim.ClaimType, role))`
`63`	`63`	`{`
`64`	`64`	`endpoints.AddRange(claim.Endpoints!);`
`65`	`65`	`}`