Skip to content

Commit 4e4f0bd

Browse files
jonkjetiloyejonkjetiloye
authored
Merge pull request #36 from Altinn/feature/am-827_AddTtdOrgIssuerSupportForPlatformAccessTokens
Added TTD org issuer support for PlatformAccessTokens
2 parents 21d9f56 + 6b18e3e commit 4e4f0bd

10 files changed

Lines changed: 59 additions & 16 deletions

‎TokenGenerator/GetPlatformAccessToken.cs‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,14 +34,15 @@ public async Task<ActionResult> Run([HttpTrigger(AuthorizationLevel.Anonymous, "
3434

3535
requestValidator.ValidateQueryParam("env", true, tokenHelper.IsValidEnvironment, out string env);
3636
requestValidator.ValidateQueryParam("app", true, tokenHelper.IsValidDottedIdentifier, out string appClaim);
37+
requestValidator.ValidateQueryParam("org", false, tokenHelper.IsValidIdentifier, out string issuerOrg);
3738
requestValidator.ValidateQueryParam<uint>("ttl", false, uint.TryParse, out uint ttl, 1800);
3839

3940
if (requestValidator.GetErrors().Count > 0)
4041
{
4142
return new BadRequestObjectResult(requestValidator.GetErrors());
4243
}
4344

44-
string token = await tokenHelper.GetPlatformAccessToken(env, appClaim, ttl);
45+
string token = await tokenHelper.GetPlatformAccessToken(env, appClaim, ttl, issuerOrg ?? settings.PlatformAccessTokenIssuerName);
4546

4647
if (!string.IsNullOrEmpty(req.Query["dump"]))
4748
{

‎TokenGenerator/Services/CertificateKeyVault.cs‎

Lines changed: 21 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -56,14 +56,31 @@ public async Task<X509Certificate2> GetConsentTokenSigningCertificate(string env
5656
return GetLatestCertificateWithRolloverDelay(certificates, 1);
5757
}
5858

59-
public async Task<X509Certificate2> GetPlatformAccessTokenSigningCertificate(string environment)
59+
public async Task<X509Certificate2> GetPlatformAccessTokenSigningCertificate(string environment, string issuer)
6060
{
61-
if (string.IsNullOrEmpty(environment) || settings.EnvironmentsApiTokenDict[environment] == null || settings.PlatformAccessTokenSigningCertNamesDict[environment] == null)
61+
List<X509Certificate2> certificates = null;
62+
if (issuer == settings.PlatformAccessTokenIssuerName)
6263
{
63-
throw new ArgumentException("Invalid environment");
64+
if (string.IsNullOrEmpty(environment) || settings.EnvironmentsApiTokenDict[environment] == null || settings.PlatformAccessTokenSigningCertNamesDict[environment] == null)
65+
{
66+
throw new ArgumentException("Invalid environment");
67+
}
68+
69+
certificates = await GetCertificates(settings.EnvironmentsApiTokenDict[environment], settings.PlatformAccessTokenSigningCertNamesDict[environment]);
6470
}
71+
else if (issuer == settings.TtdAccessTokenIssuerName)
72+
{
73+
if (string.IsNullOrEmpty(issuer) || settings.EnvironmentsApiTokenDict[environment] == null || settings.TtdAccessTokenSigningCertNamesDict[environment] == null)
74+
{
75+
throw new ArgumentException("Invalid environment or org issuer");
76+
}
6577

66-
var certificates = await GetCertificates(settings.EnvironmentsApiTokenDict[environment], settings.PlatformAccessTokenSigningCertNamesDict[environment]);
78+
certificates = await GetCertificates(settings.EnvironmentsApiTokenDict[environment], settings.TtdAccessTokenSigningCertNamesDict[environment]);
79+
}
80+
else
81+
{
82+
throw new ArgumentException("Invalid issuer");
83+
}
6784

6885
return GetLatestCertificateWithRolloverDelay(certificates, 1);
6986
}

‎TokenGenerator/Services/CertificatePfx.cs‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,5 +57,10 @@ public Task<X509Certificate2> GetPlatformAccessTokenSigningCertificate(string en
5757
{
5858
throw new NotImplementedException();
5959
}
60+
61+
public Task<X509Certificate2> GetPlatformAccessTokenSigningCertificate(string environment, string issuer)
62+
{
63+
throw new NotImplementedException();
64+
}
6065
}
6166
}

‎TokenGenerator/Services/Interfaces/ICertificateService.cs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,6 @@ public interface ICertificateService
77
{
88
Task<X509Certificate2> GetApiTokenSigningCertificate(string environment);
99
Task<X509Certificate2> GetConsentTokenSigningCertificate(string environment);
10-
Task<X509Certificate2> GetPlatformAccessTokenSigningCertificate(string environment);
10+
Task<X509Certificate2> GetPlatformAccessTokenSigningCertificate(string environment, string issuer);
1111
}
1212
}

‎TokenGenerator/Services/Interfaces/IToken.cs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ public interface IToken
1212
Task<string> GetPersonalToken(string env, string[] scopes, uint userId, uint partyId, string pid, string authLvl, string consumerOrgNo, string userName, string clientAmr, uint ttl, string delegationSource);
1313
Task<string> GetConsentToken(string env, string[] serviceCodes, IQueryCollection queryParameters, Guid authorizationCode, string offeredBy, string coveredBy, string handledBy, uint ttl);
1414
Task<string> GetPlatformToken(string env, string appClaim, uint ttl);
15-
Task<string> GetPlatformAccessToken(string env, string appClaim, uint ttl);
15+
Task<string> GetPlatformAccessToken(string env, string appClaim, uint ttl, string iss = "platform");
1616

1717
string Dump(string token);
1818
bool IsValidAuthLvl(string authLvl);

‎TokenGenerator/Services/SelfSignedCertificate.cs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ public Task<X509Certificate2> GetConsentTokenSigningCertificate(string environme
2525
return Task.FromResult(lazyCertificate.Value);
2626
}
2727

28-
public Task<X509Certificate2> GetPlatformAccessTokenSigningCertificate(string environment)
28+
public Task<X509Certificate2> GetPlatformAccessTokenSigningCertificate(string environment, string issuer)
2929
{
3030
return Task.FromResult(lazyCertificate.Value);
3131
}

‎TokenGenerator/Services/Token.cs‎

Lines changed: 16 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -301,10 +301,23 @@ public async Task<string> GetPlatformToken(string env, string appClaim, uint ttl
301301
/// <param name="env">The environment id.</param>
302302
/// <param name="appClaim">The name of the platform application.</param>
303303
/// <param name="ttl">Time to live.</param>
304-
public async Task<string> GetPlatformAccessToken(string env, string appClaim, uint ttl)
304+
/// <param name="issuer">The issuer of the token. Default is <c>platform</c>.</param>
305+
public async Task<string> GetPlatformAccessToken(string env, string appClaim, uint ttl, string issuer)
305306
{
306-
var signingCertificate = await certificateHelper.GetPlatformAccessTokenSigningCertificate(env);
307-
return CreateAccessToken(appClaim, ttl, "platform", signingCertificate);
307+
if (issuer == settings.PlatformAccessTokenIssuerName)
308+
{
309+
var signingCertificate = await certificateHelper.GetPlatformAccessTokenSigningCertificate(env, settings.PlatformAccessTokenIssuerName);
310+
return CreateAccessToken(appClaim, ttl, settings.PlatformAccessTokenIssuerName, signingCertificate);
311+
}
312+
else if (issuer == settings.TtdAccessTokenIssuerName)
313+
{
314+
var signingCertificate = await certificateHelper.GetPlatformAccessTokenSigningCertificate(env, settings.TtdAccessTokenIssuerName);
315+
return CreateAccessToken(appClaim, ttl, settings.TtdAccessTokenIssuerName, signingCertificate);
316+
}
317+
else
318+
{
319+
throw new ArgumentException("Invalid issuer");
320+
}
308321
}
309322

310323
public bool TryParseScopes(string input, out string[] scopes)

‎TokenGenerator/Settings.cs‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,12 @@ public class Settings
88
{
99
public string ApiTokenSigningCertNames { get; set; }
1010
public Dictionary<string, string> ApiTokenSigningCertNamesDict => GetKeyValuePairs(ApiTokenSigningCertNames);
11+
public string PlatformAccessTokenIssuerName { get; set; }
1112
public string PlatformAccessTokenSigningCertNames { get; set; }
1213
public Dictionary<string, string> PlatformAccessTokenSigningCertNamesDict => GetKeyValuePairs(PlatformAccessTokenSigningCertNames);
14+
public string TtdAccessTokenIssuerName { get; set; }
15+
public string TtdAccessTokenSigningCertNames { get; set; }
16+
public Dictionary<string, string> TtdAccessTokenSigningCertNamesDict => GetKeyValuePairs(TtdAccessTokenSigningCertNames);
1317
public string ConsentTokenSigningCertNames { get; set; }
1418
public Dictionary<string, string> ConsentTokenSigningCertNamesDict => GetKeyValuePairs(ConsentTokenSigningCertNames);
1519
public string BasicAuthorizationUsers { get; set; }

‎TokenGenerator/TokenGenerator.csproj‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -5,15 +5,15 @@
55
<_FunctionsSkipCleanOutput>true</_FunctionsSkipCleanOutput>
66
</PropertyGroup>
77
<ItemGroup>
8-
<PackageReference Include="Azure.Identity" Version="1.11.3" />
8+
<PackageReference Include="Azure.Identity" Version="1.12.0" />
99
<PackageReference Include="Azure.Security.KeyVault.Certificates" Version="4.6.0" />
1010
<PackageReference Include="Azure.Security.KeyVault.Secrets" Version="4.6.0" />
1111
<PackageReference Include="Microsoft.AspNetCore.Mvc.Core" Version="2.2.5" />
1212
<PackageReference Include="Microsoft.Azure.Functions.Extensions" Version="1.1.0" />
13-
<PackageReference Include="Microsoft.IdentityModel.Protocols.OpenIdConnect" Version="7.5.1" />
14-
<PackageReference Include="Microsoft.IdentityModel.Tokens" Version="7.5.1" />
15-
<PackageReference Include="Microsoft.NET.Sdk.Functions" Version="4.3.0" />
16-
<PackageReference Include="System.IdentityModel.Tokens.Jwt" Version="7.5.1" />
13+
<PackageReference Include="Microsoft.IdentityModel.Protocols.OpenIdConnect" Version="8.1.0" />
14+
<PackageReference Include="Microsoft.IdentityModel.Tokens" Version="8.1.0" />
15+
<PackageReference Include="Microsoft.NET.Sdk.Functions" Version="4.4.1" />
16+
<PackageReference Include="System.IdentityModel.Tokens.Jwt" Version="8.1.0" />
1717
</ItemGroup>
1818
<ItemGroup>
1919
<None Update="Certificates\apitoken.pfx">

‎TokenGenerator/local.settings.json.COPYME‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,10 @@
66
},
77
"Settings": {
88
"ApiTokenSigningCertNames": "dev:altinn-testtools-api-token-signing-cert",
9+
"PlatformAccessTokenIssuerName": "platform",
910
"PlatformAccessTokenSigningCertNames": "dev:altinn-testtools-api-token-signing-cert",
11+
"TtdAccessTokenIssuerName": "ttd",
12+
"TtdAccessTokenSigningCertNames": "dev:altinn-testtools-ttd-accesstoken-signing-cert",
1013
"AuthorizedScope": "altinn:testtools/tokengenerator",
1114
"AuthorizedScopeEnterprise": "altinn:testtools/tokengenerator/enterprise",
1215
"AuthorizedScopeEnterpriseUser": "altinn:testtools/tokengenerator/enterpriseuser",

0 commit comments

Comments
 (0)