Skip to content

Commit 2eade9b

Browse files
dgmjrdgmjr
committed
Checking this in so i can obliterate a secret
1 parent 8a48020 commit 2eade9b

30 files changed

+1971
-148
lines changed

‎.frontmatter/database/taxonomyDb.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
{}

‎frontmatter.json

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
{
2+
"$schema": "https://beta.frontmatter.codes/frontmatter.schema.json"
3+
}

‎src/OpenIdConnect.Server/Configuration/Logging.json

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
2-
"LogLevel": {
3-
"Default": "Debug",
4-
"Microsoft.AspNetCore": "Debug"
5-
}
2+
"LogLevel": {
3+
"Default": "Trace",
4+
"Microsoft.AspNetCore": "Trace"
5+
}
66
}

‎src/OpenIdConnect.Server/Configuration/TelegramOpenIdConnectServer.json

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -32,15 +32,20 @@
3232
}
3333
],
3434
"ClientUri": "https://jsonschema.xyz",
35-
"GrantType": [
36-
"authorization_code",
37-
"refresh_token"
35+
"AllowedGrantTypes": [
36+
// "authorization_code",
37+
// "refresh_token",
38+
"implicit"
3839
],
3940
"IsActive": true,
4041
"RedirectUris": [
42+
"https://jsonschema.b2clogin.com/jsonschema.onmicrosoft.com/oauth2/authresp",
43+
"https://jsonschema.b2clogin.com/jsonschema.xyz/oauth2/authresp",
4144
"https://jsonschema.xyz/signin-oidc",
42-
"https://valid-seahorse-separately.ngrok-free.app/signin-oidc",
43-
"https://localhost:7003/signin-oidc"
45+
"https://localhost:7003/signin-oidc",
46+
"https://login.jsonschema.xyz/jsonschema.onmicrosoft.com/oauth2/authresp",
47+
"https://login.jsonschema.xyz/jsonschema.xyz/oauth2/authresp",
48+
"https://valid-seahorse-separately.ngrok-free.app/signin-oidc"
4449
]
4550
}
4651
]

‎src/OpenIdConnect.Server/Constants/IdentityServer4Constants.cs

Lines changed: 311 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,311 @@
1+
namespace Telegram.OpenIdConnect;
2+
3+
using Duende.IdentityServer;
4+
using Duende.IdentityServer.Models;
5+
6+
using IdentityModel;
7+
8+
internal static class IdentityServer4Constants
9+
{
10+
public const string IdentityServerName = "IdentityServer4";
11+
public const string IdentityServerAuthenticationType = IdentityServerName;
12+
public const string ExternalAuthenticationMethod = "external";
13+
public const string AccessTokenAudience = "{0}resources";
14+
public const string DefaultHashAlgorithm = "SHA256";
15+
16+
public static readonly TimeSpan DefaultCookieTimeSpan = TimeSpan.FromHours(10);
17+
public static readonly TimeSpan DefaultCacheDuration = TimeSpan.FromMinutes(5);
18+
19+
public static readonly List<string> SupportedResponseTypes =
20+
new()
21+
{
22+
OidcConstants.ResponseTypes.Code,
23+
OidcConstants.ResponseTypes.Token,
24+
OidcConstants.ResponseTypes.IdToken,
25+
OidcConstants.ResponseTypes.IdTokenToken,
26+
OidcConstants.ResponseTypes.CodeIdToken,
27+
OidcConstants.ResponseTypes.CodeToken,
28+
OidcConstants.ResponseTypes.CodeIdTokenToken
29+
};
30+
31+
public static readonly Dictionary<string, string> ResponseTypeToGrantTypeMapping =
32+
new()
33+
{
34+
{ OidcConstants.ResponseTypes.Code, GrantType.AuthorizationCode },
35+
{ OidcConstants.ResponseTypes.Token, GrantType.Implicit },
36+
{ OidcConstants.ResponseTypes.IdToken, GrantType.Implicit },
37+
{ OidcConstants.ResponseTypes.IdTokenToken, GrantType.Implicit },
38+
{ OidcConstants.ResponseTypes.CodeIdToken, GrantType.Hybrid },
39+
{ OidcConstants.ResponseTypes.CodeToken, GrantType.Hybrid },
40+
{ OidcConstants.ResponseTypes.CodeIdTokenToken, GrantType.Hybrid }
41+
};
42+
43+
public static readonly List<string> AllowedGrantTypesForAuthorizeEndpoint =
44+
new() { GrantType.AuthorizationCode, GrantType.Implicit, GrantType.Hybrid };
45+
46+
public static readonly List<string> SupportedCodeChallengeMethods = new List<string>
47+
{
48+
OidcConstants.CodeChallengeMethods.Plain,
49+
OidcConstants.CodeChallengeMethods.Sha256
50+
};
51+
52+
public enum ScopeRequirement
53+
{
54+
None,
55+
ResourceOnly,
56+
IdentityOnly,
57+
Identity
58+
}
59+
60+
public static readonly Dictionary<string, ScopeRequirement> ResponseTypeToScopeRequirement =
61+
new()
62+
{
63+
{ OidcConstants.ResponseTypes.Code, ScopeRequirement.None },
64+
{ OidcConstants.ResponseTypes.Token, ScopeRequirement.ResourceOnly },
65+
{ OidcConstants.ResponseTypes.IdToken, ScopeRequirement.IdentityOnly },
66+
{ OidcConstants.ResponseTypes.IdTokenToken, ScopeRequirement.Identity },
67+
{ OidcConstants.ResponseTypes.CodeIdToken, ScopeRequirement.Identity },
68+
{ OidcConstants.ResponseTypes.CodeToken, ScopeRequirement.Identity },
69+
{ OidcConstants.ResponseTypes.CodeIdTokenToken, ScopeRequirement.Identity }
70+
};
71+
72+
public static readonly Dictionary<
73+
string,
74+
IEnumerable<string>
75+
> AllowedResponseModesForGrantType = new Dictionary<string, IEnumerable<string>>
76+
{
77+
{
78+
GrantType.AuthorizationCode,
79+
new[] { OidcConstants.ResponseModes.Query, OidcConstants.ResponseModes.FormPost }
80+
},
81+
{
82+
GrantType.Hybrid,
83+
new[] { OidcConstants.ResponseModes.Fragment, OidcConstants.ResponseModes.FormPost }
84+
},
85+
{
86+
GrantType.Implicit,
87+
new[] { OidcConstants.ResponseModes.Fragment, OidcConstants.ResponseModes.FormPost }
88+
}
89+
};
90+
91+
public static readonly List<string> SupportedResponseModes =
92+
new()
93+
{
94+
OidcConstants.ResponseModes.FormPost,
95+
OidcConstants.ResponseModes.Query,
96+
OidcConstants.ResponseModes.Fragment
97+
};
98+
99+
public static string[] SupportedSubjectTypes = { "pairwise", "public" };
100+
101+
public static class SigningAlgorithms
102+
{
103+
public const string RSA_SHA_256 = "RS256";
104+
}
105+
106+
public static readonly List<string> SupportedDisplayModes =
107+
new()
108+
{
109+
OidcConstants.DisplayModes.Page,
110+
OidcConstants.DisplayModes.Popup,
111+
OidcConstants.DisplayModes.Touch,
112+
OidcConstants.DisplayModes.Wap
113+
};
114+
115+
public static readonly List<string> SupportedPromptModes =
116+
new()
117+
{
118+
OidcConstants.PromptModes.None,
119+
OidcConstants.PromptModes.Login,
120+
OidcConstants.PromptModes.Consent,
121+
OidcConstants.PromptModes.SelectAccount
122+
};
123+
124+
public static class KnownAcrValues
125+
{
126+
public const string HomeRealm = "idp:";
127+
public const string Tenant = "tenant:";
128+
129+
public static readonly string[] All = { HomeRealm, Tenant };
130+
}
131+
132+
public static Dictionary<string, int> ProtectedResourceErrorStatusCodes =
133+
new()
134+
{
135+
{ OidcConstants.ProtectedResourceErrors.InvalidToken, 401 },
136+
{ OidcConstants.ProtectedResourceErrors.ExpiredToken, 401 },
137+
{ OidcConstants.ProtectedResourceErrors.InvalidRequest, 400 },
138+
{ OidcConstants.ProtectedResourceErrors.InsufficientScope, 403 }
139+
};
140+
141+
public static readonly Dictionary<string, IEnumerable<string>> ScopeToClaimsMapping =
142+
new()
143+
{
144+
{
145+
IdentityServerConstants.StandardScopes.Profile,
146+
new[]
147+
{
148+
JwtClaimTypes.Name,
149+
JwtClaimTypes.FamilyName,
150+
JwtClaimTypes.GivenName,
151+
JwtClaimTypes.MiddleName,
152+
JwtClaimTypes.NickName,
153+
JwtClaimTypes.PreferredUserName,
154+
JwtClaimTypes.Profile,
155+
JwtClaimTypes.Picture,
156+
JwtClaimTypes.WebSite,
157+
JwtClaimTypes.Gender,
158+
JwtClaimTypes.BirthDate,
159+
JwtClaimTypes.ZoneInfo,
160+
JwtClaimTypes.Locale,
161+
JwtClaimTypes.UpdatedAt
162+
}
163+
},
164+
{
165+
IdentityServerConstants.StandardScopes.Email,
166+
new[] { JwtClaimTypes.Email, JwtClaimTypes.EmailVerified }
167+
},
168+
{ IdentityServerConstants.StandardScopes.Address, new[] { JwtClaimTypes.Address } },
169+
{
170+
IdentityServerConstants.StandardScopes.Phone,
171+
new[] { JwtClaimTypes.PhoneNumber, JwtClaimTypes.PhoneNumberVerified }
172+
},
173+
{ IdentityServerConstants.StandardScopes.OpenId, new[] { JwtClaimTypes.Subject } }
174+
};
175+
176+
public static class UIConstants
177+
{
178+
// the limit after which old messages are purged
179+
public const int CookieMessageThreshold = 2;
180+
181+
public static class DefaultRoutePathParams
182+
{
183+
public const string Error = "errorId";
184+
public const string Login = "returnUrl";
185+
public const string Consent = "returnUrl";
186+
public const string Logout = "logoutId";
187+
public const string EndSessionCallback = "endSessionId";
188+
public const string Custom = "returnUrl";
189+
}
190+
191+
public static class DefaultRoutePaths
192+
{
193+
public const string Login = "/account/login";
194+
public const string Logout = "/account/logout";
195+
public const string Consent = "/consent";
196+
public const string Error = "/home/error";
197+
}
198+
}
199+
200+
public static class EndpointNames
201+
{
202+
public const string Authorize = "Authorize";
203+
public const string Token = "Token";
204+
public const string Discovery = "Discovery";
205+
public const string Introspection = "Introspection";
206+
public const string Revocation = "Revocation";
207+
public const string EndSession = "Endsession";
208+
public const string CheckSession = "Checksession";
209+
public const string UserInfo = "Userinfo";
210+
}
211+
212+
public static class ProtocolRoutePaths
213+
{
214+
public const string Authorize = "connect/authorize";
215+
public const string AuthorizeCallback = Authorize + "/callback";
216+
public const string DiscoveryConfiguration = ".well-known/openid-configuration";
217+
public const string DiscoveryWebKeys = DiscoveryConfiguration + "/jwks";
218+
public const string Token = "connect/token";
219+
public const string Revocation = "connect/revocation";
220+
public const string UserInfo = "connect/userinfo";
221+
public const string Introspection = "connect/introspect";
222+
public const string EndSession = "connect/endsession";
223+
public const string EndSessionCallback = EndSession + "/callback";
224+
public const string CheckSession = "connect/checksession";
225+
226+
public static readonly string[] CorsPaths =
227+
{
228+
DiscoveryConfiguration,
229+
DiscoveryWebKeys,
230+
Token,
231+
UserInfo,
232+
Revocation
233+
};
234+
}
235+
236+
public static class EnvironmentKeys
237+
{
238+
public const string IdentityServerBasePath = "idsvr:IdentityServerBasePath";
239+
240+
[Obsolete("The IdentityServerOrigin constant is obsolete.")]
241+
public const string IdentityServerOrigin = "idsvr:IdentityServerOrigin"; // todo: deprecate
242+
public const string SignOutCalled = "idsvr:IdentityServerSignOutCalled";
243+
}
244+
245+
public static class TokenTypeHints
246+
{
247+
public const string RefreshToken = "refresh_token";
248+
public const string AccessToken = "access_token";
249+
}
250+
251+
public static List<string> SupportedTokenTypeHints =
252+
new() { TokenTypeHints.RefreshToken, TokenTypeHints.AccessToken };
253+
254+
public static class RevocationErrors
255+
{
256+
public const string UnsupportedTokenType = "unsupported_token_type";
257+
}
258+
259+
public static class Filters
260+
{
261+
// filter for claims from an incoming access token (e.g. used at the user profile endpoint)
262+
public static readonly string[] ProtocolClaimsFilter =
263+
{
264+
JwtClaimTypes.AccessTokenHash,
265+
JwtClaimTypes.Audience,
266+
JwtClaimTypes.AuthorizedParty,
267+
JwtClaimTypes.AuthorizationCodeHash,
268+
JwtClaimTypes.ClientId,
269+
JwtClaimTypes.Expiration,
270+
JwtClaimTypes.IssuedAt,
271+
JwtClaimTypes.Issuer,
272+
JwtClaimTypes.JwtId,
273+
JwtClaimTypes.Nonce,
274+
JwtClaimTypes.NotBefore,
275+
JwtClaimTypes.ReferenceTokenId,
276+
JwtClaimTypes.SessionId,
277+
JwtClaimTypes.Scope
278+
};
279+
280+
// filter list for claims returned from profile service prior to creating tokens
281+
public static readonly string[] ClaimsServiceFilterClaimTypes =
282+
{
283+
// TODO: consider JwtClaimTypes.AuthenticationContextClassReference,
284+
JwtClaimTypes.AccessTokenHash,
285+
JwtClaimTypes.Audience,
286+
JwtClaimTypes.AuthenticationMethod,
287+
JwtClaimTypes.AuthenticationTime,
288+
JwtClaimTypes.AuthorizedParty,
289+
JwtClaimTypes.AuthorizationCodeHash,
290+
JwtClaimTypes.ClientId,
291+
JwtClaimTypes.Expiration,
292+
JwtClaimTypes.IdentityProvider,
293+
JwtClaimTypes.IssuedAt,
294+
JwtClaimTypes.Issuer,
295+
JwtClaimTypes.JwtId,
296+
JwtClaimTypes.Nonce,
297+
JwtClaimTypes.NotBefore,
298+
JwtClaimTypes.ReferenceTokenId,
299+
JwtClaimTypes.SessionId,
300+
JwtClaimTypes.Subject,
301+
JwtClaimTypes.Scope,
302+
JwtClaimTypes.Confirmation
303+
};
304+
}
305+
306+
public static class WsFedSignOut
307+
{
308+
public const string LogoutUriParameterName = "wa";
309+
public const string LogoutUriParameterValue = "wsignoutcleanup1.0";
310+
}
311+
}

0 commit comments

Comments
 (0)