67 lines
3.5 KiB
C#
67 lines
3.5 KiB
C#
using System.Linq;
|
|
using System.Security.Claims;
|
|
using System.Threading.Tasks;
|
|
using Microsoft.AspNetCore.Authentication.Cookies;
|
|
using Oqtane.Infrastructure;
|
|
using Oqtane.Repository;
|
|
using Oqtane.Models;
|
|
using System.Collections.Generic;
|
|
using Oqtane.Extensions;
|
|
using Oqtane.Shared;
|
|
|
|
namespace Oqtane.Security
|
|
{
|
|
public static class PrincipalValidator
|
|
{
|
|
public static Task ValidateAsync(CookieValidatePrincipalContext context)
|
|
{
|
|
if (context != null && context.Principal.Identity.IsAuthenticated && context.Principal.Identity.Name != null)
|
|
{
|
|
// check if framework is installed
|
|
var config = context.HttpContext.RequestServices.GetService(typeof(IConfigManager)) as IConfigManager;
|
|
if (config.IsInstalled())
|
|
{
|
|
// get current site
|
|
var alias = context.HttpContext.GetAlias();
|
|
if (alias != null)
|
|
{
|
|
// check if principal matches current site
|
|
if (context.Principal.Claims.FirstOrDefault(item => item.Type == ClaimTypes.GroupSid)?.Value != alias.SiteKey)
|
|
{
|
|
// principal does not match site
|
|
var userRepository = context.HttpContext.RequestServices.GetService(typeof(IUserRepository)) as IUserRepository;
|
|
var userRoleRepository = context.HttpContext.RequestServices.GetService(typeof(IUserRoleRepository)) as IUserRoleRepository;
|
|
var _logger = context.HttpContext.RequestServices.GetService(typeof(ILogManager)) as ILogManager;
|
|
string path = context.Request.Path.ToString().ToLower();
|
|
|
|
User user = userRepository.GetUser(context.Principal.Identity.Name);
|
|
if (user != null)
|
|
{
|
|
// replace principal with roles for current site
|
|
List<UserRole> userroles = userRoleRepository.GetUserRoles(user.UserId, alias.SiteId).ToList();
|
|
var identity = UserSecurity.CreateClaimsIdentity(alias, user, userroles);
|
|
context.ReplacePrincipal(new ClaimsPrincipal(identity));
|
|
context.ShouldRenew = true;
|
|
if (!path.StartsWith("/api/")) // reduce log verbosity
|
|
{
|
|
_logger.Log(alias.SiteId, LogLevel.Information, "LoginValidation", Enums.LogFunction.Security, "Permissions Updated For User {Username} Accessing Resource {Url}", context.Principal.Identity.Name, path);
|
|
}
|
|
}
|
|
else
|
|
{
|
|
// user has no roles for site - remove principal
|
|
context.RejectPrincipal();
|
|
if (!path.StartsWith("/api/")) // reduce log verbosity
|
|
{
|
|
_logger.Log(alias.SiteId, LogLevel.Information, "LoginValidation", Enums.LogFunction.Security, "Permissions Removed For User {Username} Accessing Resource {Url}", context.Principal.Identity.Name, path);
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
return Task.CompletedTask;
|
|
}
|
|
}
|
|
}
|