feat: jwt-token allowed audiences guard

lsipii · lsipii · commit 49e53f2772c4 · 2023-09-14T19:03:18.000+03:00
diff --git a/VirtualFinland.UserAPI/src/VirtualFinland.UsersAPI/Security/ApplicationSecurity.cs b/VirtualFinland.UserAPI/src/VirtualFinland.UsersAPI/Security/ApplicationSecurity.cs
@@ -30,8 +30,12 @@ public JwtTokenResult ParseJwtToken(string token)
         var tokenIssuer = parsedToken.Issuer;
         var securityFeature = _features.Find(o => o.Issuer == tokenIssuer) ?? throw new NotAuthorizedException("The given token issuer is not valid");
 
+        // Resolve and validate the token audience
+        var tokenAudience = parsedToken.Audiences.FirstOrDefault() ?? throw new NotAuthorizedException("The given token audience is not valid");
+        securityFeature.ValidateSecurityTokenAudience(tokenAudience);
+
         // Resolve user id
         var userId = securityFeature.ResolveTokenUserId(parsedToken) ?? throw new NotAuthorizedException("The given token claim is not valid");
-        return new JwtTokenResult { UserId = userId, Issuer = securityFeature.Issuer };
+        return new JwtTokenResult { UserId = userId, Issuer = securityFeature.Issuer, Audience = tokenAudience };
     }
 }
diff --git a/VirtualFinland.UserAPI/src/VirtualFinland.UsersAPI/Security/Features/ISecurityFeature.cs b/VirtualFinland.UserAPI/src/VirtualFinland.UsersAPI/Security/Features/ISecurityFeature.cs
@@ -10,6 +10,7 @@ public interface ISecurityFeature
     void BuildAuthorization(AuthorizationOptions options);
     string GetSecurityPolicySchemeName();
     string? ResolveTokenUserId(JwtSecurityToken jwtSecurityToken);
+    void ValidateSecurityTokenAudience(string audience);
 
-    public string? Issuer { get; }
+    public string Issuer { get; }
 }
diff --git a/VirtualFinland.UserAPI/src/VirtualFinland.UsersAPI/Security/Features/SecurityFeature.cs b/VirtualFinland.UserAPI/src/VirtualFinland.UsersAPI/Security/Features/SecurityFeature.cs
@@ -4,6 +4,8 @@
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.IdentityModel.Tokens;
 using NetDevPack.Security.JwtExtensions;
+using VirtualFinland.UserAPI.Exceptions;
+using VirtualFinland.UserAPI.Security.Models;
 using JwksExtension = VirtualFinland.UserAPI.Helpers.Extensions.JwksExtension;
 
 namespace VirtualFinland.UserAPI.Security.Features;
@@ -13,7 +15,13 @@ public class SecurityFeature : ISecurityFeature
     ///
     /// The issuer of the JWT token
     ///
-    public string? Issuer { get; set; }
+    public string Issuer => _issuer ?? throw new ArgumentNullException("Issuer is not set");
+    protected string? _issuer;
+
+    /// <summary>
+    /// Security feature options
+    /// </summary>
+    protected SecurityFeatureOptions _options { get; set; }
 
     /// <summary>
     /// The URL to the OpenID configuration
@@ -35,15 +43,16 @@ public class SecurityFeature : ISecurityFeature
     /// </summary>
     protected const int _configUrlRetryWaitTime = 3000;
 
-    public SecurityFeature(SecurityFeatureOptions configuration)
+    public SecurityFeature(SecurityFeatureOptions options)
     {
-        Issuer = configuration.Issuer;
-        _openIDConfigurationURL = configuration.OpenIdConfigurationUrl;
-        _jwksOptionsUrl = configuration.AuthorizationJwksJsonUrl;
+        _options = options;
+        _issuer = options.Issuer;
+        _openIDConfigurationURL = options.OpenIdConfigurationUrl;
+        _jwksOptionsUrl = options.AuthorizationJwksJsonUrl;
 
         if (string.IsNullOrEmpty(_openIDConfigurationURL) && string.IsNullOrEmpty(_jwksOptionsUrl))
         {
-            throw new ArgumentNullException("Invalid security feature configuration");
+            throw new ArgumentException("Invalid security feature configuration");
         }
     }
 
@@ -84,6 +93,17 @@ public string GetSecurityPolicySchemeName()
         return jwtSecurityToken.Subject; // the "sub" claim
     }
 
+    /// <summary>
+    /// Validates the token audience
+    /// </summary>
+    /// <param name="audience"></param>
+    /// <exception cref="NotAuthorizedException"></exception>
+    public virtual void ValidateSecurityTokenAudience(string audience)
+    {
+        if (!_options.AudienceGuardEnabled) return;
+        if (!_options.AllowedAudiences.Contains(audience)) throw new NotAuthorizedException("The given token audience is not allowed");
+    }
+
     /// <summary>
     /// Configures the OpenID Connect authentication
     /// </summary>
@@ -118,10 +138,10 @@ protected virtual async void LoadOpenIdConfigUrl()
             if (httpResponse.IsSuccessStatusCode)
             {
                 var jsonData = JsonNode.Parse(await httpResponse.Content.ReadAsStringAsync());
-                Issuer = jsonData?["issuer"]?.ToString();
+                _issuer = jsonData?["issuer"]?.ToString();
                 _jwksOptionsUrl = jsonData?["jwks_uri"]?.ToString();
 
-                if (!string.IsNullOrEmpty(Issuer) && !string.IsNullOrEmpty(_jwksOptionsUrl))
+                if (!string.IsNullOrEmpty(_issuer) && !string.IsNullOrEmpty(_jwksOptionsUrl))
                 {
                     break;
                 }
@@ -130,7 +150,7 @@ protected virtual async void LoadOpenIdConfigUrl()
         }
 
         // If all retries fail, then send an exception since the security information is critical to the functionality of the backend
-        if (string.IsNullOrEmpty(Issuer) || string.IsNullOrEmpty(_jwksOptionsUrl))
+        if (string.IsNullOrEmpty(_issuer) || string.IsNullOrEmpty(_jwksOptionsUrl))
         {
             throw new ArgumentNullException("Failed to retrieve OpenID configurations");
         }
diff --git a/VirtualFinland.UserAPI/src/VirtualFinland.UsersAPI/Security/Features/SinunaSecurityFeature.cs b/VirtualFinland.UserAPI/src/VirtualFinland.UsersAPI/Security/Features/SinunaSecurityFeature.cs
@@ -1,4 +1,6 @@
 using System.IdentityModel.Tokens.Jwt;
+using VirtualFinland.UserAPI.Exceptions;
+using VirtualFinland.UserAPI.Security.Models;
 
 namespace VirtualFinland.UserAPI.Security.Features;
 
diff --git a/VirtualFinland.UserAPI/src/VirtualFinland.UsersAPI/Security/Features/SuomiFiSecurityFeature.cs b/VirtualFinland.UserAPI/src/VirtualFinland.UsersAPI/Security/Features/SuomiFiSecurityFeature.cs
@@ -1,6 +1,7 @@
 using Microsoft.AspNetCore.Authentication;
 using Microsoft.IdentityModel.Tokens;
 using NetDevPack.Security.JwtExtensions;
+using VirtualFinland.UserAPI.Security.Models;
 using JwksExtension = VirtualFinland.UserAPI.Helpers.Extensions.JwksExtension;
 
 namespace VirtualFinland.UserAPI.Security.Features;
diff --git a/VirtualFinland.UserAPI/src/VirtualFinland.UsersAPI/Security/Features/TestbedSecurityFeature.cs b/VirtualFinland.UserAPI/src/VirtualFinland.UsersAPI/Security/Features/TestbedSecurityFeature.cs
@@ -1,3 +1,5 @@
+using VirtualFinland.UserAPI.Security.Models;
+
 namespace VirtualFinland.UserAPI.Security.Features;
 
 public class TestbedSecurityFeature : SecurityFeature
diff --git a/VirtualFinland.UserAPI/src/VirtualFinland.UsersAPI/Security/Models/JwtTokenResult.cs b/VirtualFinland.UserAPI/src/VirtualFinland.UsersAPI/Security/Models/JwtTokenResult.cs
@@ -2,6 +2,7 @@ namespace VirtualFinland.UserAPI.Security.Models;
 
 public class JwtTokenResult
 {
-    public string? UserId { get; set; }
-    public string? Issuer { get; set; }
+    public string UserId { get; set; } = default!;
+    public string Issuer { get; set; } = default!;
+    public string Audience { get; set; } = default!;
 }
diff --git a/VirtualFinland.UserAPI/src/VirtualFinland.UsersAPI/Security/Models/SecurityFeatureOptions.cs b/VirtualFinland.UserAPI/src/VirtualFinland.UsersAPI/Security/Models/SecurityFeatureOptions.cs
@@ -1,7 +1,11 @@
+namespace VirtualFinland.UserAPI.Security.Models;
+
 public class SecurityFeatureOptions
 {
     public string? OpenIdConfigurationUrl { get; set; }
     public string? AuthorizationJwksJsonUrl { get; set; }
-    public string? Issuer { get; set; }
+    public string? Issuer { get; set; } = default!;
     public bool IsEnabled { get; set; }
+    public List<string> AllowedAudiences { get; set; } = new List<string>();
+    public bool AudienceGuardEnabled { get; set; } = false;
 }
diff --git a/VirtualFinland.UserAPI/src/VirtualFinland.UsersAPI/appsettings.json b/VirtualFinland.UserAPI/src/VirtualFinland.UsersAPI/appsettings.json
@@ -33,16 +33,22 @@
         "ConsentJwksJsonUrl": "https://consent.testbed.fi/.well-known/jwks.json",
         "ConsentIssuer": "https://consent.testbed.fi",
         "ConsentVerifyUrl": "https://consent.testbed.fi/Consent/Verify",
-        "IsEnabled": false
+        "IsEnabled": false,
+        "AllowedAudiences": [],
+        "AudienceGuardEnabled": false
       },
       "Sinuna": {
         "OpenIDConfigurationURL": "https://login.iam.qa.sinuna.fi/oxauth/.well-known/openid-configuration",
-        "IsEnabled": false
+        "IsEnabled": false,
+        "AllowedAudiences": [],
+        "AudienceGuardEnabled": false
       },
       "SuomiFi": {
         "AuthorizationJwksJsonUrl": "http://localhost:4078/auth/saml2/suomifi/.well-known/jwks.json",
         "Issuer": "virtual-finland/authentication-gw/suomifi",
-        "IsEnabled": false
+        "IsEnabled": false,
+        "AllowedAudiences": [],
+        "AudienceGuardEnabled": false
       }
     }
   },
diff --git a/VirtualFinland.UserAPI/src/VirtualFinland.UsersAPI/appsettings.local.json b/VirtualFinland.UserAPI/src/VirtualFinland.UsersAPI/appsettings.local.json
@@ -28,7 +28,9 @@
         "IsEnabled": true
       },
       "Sinuna": {
-        "IsEnabled": true
+        "IsEnabled": true,
+        "AllowedAudiences": [],
+        "AudienceGuardEnabled": false
       },
       "SuomiFi": {
         "IsEnabled": true
diff --git a/VirtualFinland.UsersAPI.UnitTests/Tests/Security/AuthenticationTests.cs b/VirtualFinland.UsersAPI.UnitTests/Tests/Security/AuthenticationTests.cs
@@ -12,6 +12,7 @@
 using System.IdentityModel.Tokens.Jwt;
 using System.Security.Claims;
 using Microsoft.IdentityModel.Tokens;
+using VirtualFinland.UserAPI.Security.Models;
 
 namespace VirtualFinland.UsersAPI.UnitTests.Tests.Security;
 

Original file line number	Diff line number	Diff line change
`@@ -30,8 +30,12 @@ public JwtTokenResult ParseJwtToken(string token)`
`30`	`30`	`var tokenIssuer = parsedToken.Issuer;`
`31`	`31`	`var securityFeature = _features.Find(o => o.Issuer == tokenIssuer) ?? throw new NotAuthorizedException("The given token issuer is not valid");`
`32`	`32`
	`33`	`+ // Resolve and validate the token audience`
	`34`	`+ var tokenAudience = parsedToken.Audiences.FirstOrDefault() ?? throw new NotAuthorizedException("The given token audience is not valid");`
	`35`	`+ securityFeature.ValidateSecurityTokenAudience(tokenAudience);`
	`36`	`+`
`33`	`37`	`// Resolve user id`
`34`	`38`	`var userId = securityFeature.ResolveTokenUserId(parsedToken) ?? throw new NotAuthorizedException("The given token claim is not valid");`
`35`		`- return new JwtTokenResult { UserId = userId, Issuer = securityFeature.Issuer };`
	`39`	`+ return new JwtTokenResult { UserId = userId, Issuer = securityFeature.Issuer, Audience = tokenAudience };`
`36`	`40`	`}`
`37`	`41`	`}`
Original file line number	Diff line number	Diff line change
`@@ -10,6 +10,7 @@ public interface ISecurityFeature`
`10`	`10`	`void BuildAuthorization(AuthorizationOptions options);`
`11`	`11`	`string GetSecurityPolicySchemeName();`
`12`	`12`	`string? ResolveTokenUserId(JwtSecurityToken jwtSecurityToken);`
	`13`	`+ void ValidateSecurityTokenAudience(string audience);`
`13`	`14`
`14`		`- public string? Issuer { get; }`
	`15`	`+ public string Issuer { get; }`
`15`	`16`	`}`
Original file line number	Diff line number	Diff line change
`@@ -1,3 +1,5 @@`
	`1`	`+using VirtualFinland.UserAPI.Security.Models;`
	`2`	`+`
`1`	`3`	`namespace VirtualFinland.UserAPI.Security.Features;`
`2`	`4`
`3`	`5`	`public class TestbedSecurityFeature : SecurityFeature`
Original file line number	Diff line number	Diff line change
`@@ -2,6 +2,7 @@ namespace VirtualFinland.UserAPI.Security.Models;`
`2`	`2`
`3`	`3`	`public class JwtTokenResult`
`4`	`4`	`{`
`5`		`- public string? UserId { get; set; }`
`6`		`- public string? Issuer { get; set; }`
	`5`	`+ public string UserId { get; set; } = default!;`
	`6`	`+ public string Issuer { get; set; } = default!;`
	`7`	`+ public string Audience { get; set; } = default!;`
`7`	`8`	`}`
Original file line number	Diff line number	Diff line change
`@@ -1,7 +1,11 @@`
	`1`	`+namespace VirtualFinland.UserAPI.Security.Models;`
	`2`	`+`
`1`	`3`	`public class SecurityFeatureOptions`
`2`	`4`	`{`
`3`	`5`	`public string? OpenIdConfigurationUrl { get; set; }`
`4`	`6`	`public string? AuthorizationJwksJsonUrl { get; set; }`
`5`		`- public string? Issuer { get; set; }`
	`7`	`+ public string? Issuer { get; set; } = default!;`
`6`	`8`	`public bool IsEnabled { get; set; }`
	`9`	`+ public List<string> AllowedAudiences { get; set; } = new List<string>();`
	`10`	`+ public bool AudienceGuardEnabled { get; set; } = false;`
`7`	`11`	`}`