-
Notifications
You must be signed in to change notification settings - Fork 159
/
AzureAdNewUserManager.cs
175 lines (151 loc) · 7.62 KB
/
AzureAdNewUserManager.cs
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
// Copyright (c) 2023 Jon P Smith, GitHub: JonPSmith, web: http://www.thereformedprogrammer.net/
// Licensed under MIT license. See License.txt in the project root for license information.
using System.Security.Cryptography;
using AuthPermissions.AdminCode;
using AuthPermissions.AspNetCore.OpenIdCode;
using AuthPermissions.BaseCode.CommonCode;
using AuthPermissions.BaseCode.DataLayer.Classes;
using AuthPermissions.BaseCode.SetupCode;
using AuthPermissions.SupportCode.AzureAdServices;
using LocalizeMessagesAndErrors;
using Microsoft.Extensions.Options;
using StatusGeneric;
namespace AuthPermissions.SupportCode.AddUsersServices.Authentication;
/// <summary>
/// This implements a user manager when using Azure AD as your authentication handler
/// </summary>
public class AzureAdNewUserManager : IAddNewUserManager
{
private readonly IAuthUsersAdminService _authUsersAdmin;
private readonly IAzureAdAccessService _azureAccessService;
private readonly AzureAdOptions _azureOptions;
private readonly IDefaultLocalizer _localizeDefault;
private readonly IAuthTenantAdminService _tenantAdminService;
/// <summary>
/// ctor
/// </summary>
/// <param name="authUsersAdmin"></param>
/// <param name="tenantAdminService"></param>
/// <param name="azureAccessService"></param>
/// <param name="azureOptions"></param>
/// <param name="localizeProvider"></param>
public AzureAdNewUserManager(IAuthUsersAdminService authUsersAdmin, IAuthTenantAdminService tenantAdminService,
IAzureAdAccessService azureAccessService, IOptions<AzureAdOptions> azureOptions, IAuthPDefaultLocalizer localizeProvider)
{
_authUsersAdmin = authUsersAdmin;
_tenantAdminService = tenantAdminService;
_azureAccessService = azureAccessService;
_localizeDefault = localizeProvider.DefaultLocalizer;
_azureOptions = azureOptions.Value;
}
/// <summary>
/// This tells you what Authentication handler, or group of handlers, that the Add User Manager supports
/// </summary>
public string AuthenticationGroup { get; } = "AzureAd";
/// <summary>
/// This holds the data provided for the login.
/// Used to check that the email of the person who will login is the same as the email provided by the user
/// NOTE: Email and UserName can be null if providing a default value
/// </summary>
public AddNewUserDto UserLoginData { get; private set; }
/// <summary>
/// This makes a quick check that the user isn't already has an AuthUser
/// </summary>
/// <param name="newUser"></param>
/// <returns>status, with error if there an user already</returns>
public async Task<IStatusGeneric> CheckNoExistingAuthUserAsync(AddNewUserDto newUser)
{
var status = new StatusGenericLocalizer(_localizeDefault);
if ((await _authUsersAdmin.FindAuthUserByEmailAsync(newUser.Email))?.Result != null)
return status.AddErrorString("ExistingUser".ClassLocalizeKey(this, true), //common
"There is already an AuthUser with your email, so you can't add another.",
nameof(AddNewUserDto.Email));
return status;
}
/// <summary>
/// This uses the <see cref="IAzureAdAccessService"/> to create the user with an temporary password in the AzureAD.
/// This returns the userId of the AzureAD user, which is uses to create the <see cref="AuthUser"/> with the Roles, Tenants, etc.
/// </summary>
/// <param name="newUser">The information for creating an AuthUser </param>
/// <returns>Returns the user Id</returns>
public async Task<IStatusGeneric<AuthUser>> SetUserInfoAsync(AddNewUserDto newUser)
{
UserLoginData = newUser ?? throw new ArgumentNullException(nameof(newUser));
var status = new StatusGenericLocalizer<AuthUser>(_localizeDefault);
var azureUserStatus = await FindOrCreateAzureAdUser(UserLoginData.Email);
if (status.CombineStatuses(azureUserStatus).HasErrors)
return status;
//We have found or created the Azure AD user, so we have the user's UserId.
//Now we create the AuthUser using the data we have been given
var tenantName = UserLoginData.TenantId == null
? null
: (await _tenantAdminService.GetTenantViaIdAsync((int)UserLoginData.TenantId)).Result?.TenantFullName;
return await _authUsersAdmin.AddNewUserAsync(azureUserStatus.Result,
UserLoginData.Email, UserLoginData.UserName, UserLoginData.Roles, tenantName);
}
/// <summary>
/// not used
/// </summary>
/// <returns>status with the final <see cref="AddNewUserDto"/> setting.
/// This is needed in the Azure AD version, as it creates a temporary password.</returns>
public Task<IStatusGeneric<AddNewUserDto>> LoginAsync()
{
if (UserLoginData == null)
throw new AuthPermissionsException($"Must call {nameof(SetUserInfoAsync)} before calling this method.");
var status = new StatusGenericLocalizer<AddNewUserDto>(_localizeDefault);
if (UserLoginData.Password == null)
{
status.SetMessageString("SuccessFoundUser".ClassLocalizeKey(this, true),
"Successfully found your Azure Ad user. Now login via the 'sign in' link.");
}
else
{
status.SetMessageString("SuccessCreatedUser".ClassLocalizeKey(this, true),
"Successfully created your Azure Ad user. Now login via the 'sign in' link.");
}
return Task.FromResult<IStatusGeneric<AddNewUserDto>>(status.SetResult(UserLoginData));
}
/// <summary>
/// If something happens that makes the user invalid, then this will remove the AuthUser.
/// Used in <see cref="SignInAndCreateTenant"/> if something goes wrong and we want to undo the tenant
/// </summary>
/// <param name="userId"></param>
/// <returns></returns>
public Task<IStatusGeneric> RemoveAuthUserAsync(string userId)
{
return _authUsersAdmin.DeleteUserAsync(userId);
}
//--------------------------------------------------
// private methods
private async Task<IStatusGeneric<string>> FindOrCreateAzureAdUser(string email)
{
var status = new StatusGenericLocalizer<string>(_localizeDefault);
var approaches = _azureOptions.AzureAdApproaches?.Split(',')
.Select(x => x.Trim().ToLower()).ToArray()
?? throw new AuthPermissionsException(
$"The Azure options in the appsettings file should contain a {nameof(AzureAdOptions.AzureAdApproaches)} part");
if (approaches.Contains("find"))
{
var foundUser =
await _azureAccessService.FindAzureUserAsync(email);
if (foundUser != null)
{
UserLoginData.Password = null; //this tells the code to not show a temporary password (used in Create)
return status.SetResult(foundUser);
}
}
if (approaches.Contains("create"))
{
//Create a temporary password for the AzureAD user that is going to be
var randomNumber = new byte[20];
using var rng = RandomNumberGenerator.Create();
rng.GetBytes(randomNumber);
UserLoginData.Password = Convert.ToBase64String(randomNumber);
var newUserStatus =
await _azureAccessService.CreateNewUserAsync(UserLoginData.Email, UserLoginData.UserName,
UserLoginData.Password);
return newUserStatus;
}
throw new AuthPermissionsException($"Could not {string.Join(" or ", approaches)} the Azure AD user.");
}
}