从mvc中的中间件手动调用授权流

Question

I've setup oauth authorization in an MVC aspnet core 2 application. It works as intended when I use the [Authorize] attribute but I can't get it to work with my middleware RequestHandler .

I tried creating a service that calls the context.ChallengeAsync() method but it fails when called from the middleware (the call never redirects). If the user isn't already logged in the consent page is never shown and the token returned is null .

If the user was already logged in the call returns the token. The service does work when called from inside a controller (instead of using [Authorize] )

So how do I get it to work ? I want to make sure the user is authorized (so that i have access to a token) before continuing...

Here are the relevant code sections:

Startup.cs

public class Startup
{
    public void ConfigureServices(IServiceCollection services)
    {
        services.AddAuthentication(options =>
        {
            options.DefaultAuthenticateScheme = CookieAuthenticationDefaults.AuthenticationScheme;
            options.DefaultSignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;
            options.DefaultChallengeScheme = OAuthOptionsDefaults.SchemeName;
        })
       .AddCookie() 
       .AddOAuth(OAuthOptionsDefaults.SchemeName, 
                options => { options.SaveTokens = true;  /*other options*/ });

        services.AddMvc();

        services.AddSingleton<IHttpContextAccessor, HttpContextAccessor>();
        services.AddScoped<IOAuthService, OAuthService>();
        services.AddTransient<IRequestHandler, RequestHandler>();
    }

    public void Configure(IApplicationBuilder app, IRequestHandler requestHandler, ..)
    {

        app.UseExceptionHandler("/Home/Error");
        app.UseStaticFiles();
        app.UseAuthentication();

        app.Map(new PathString("/myapi"), appbuilder =>
        {
            appbuilder.Run(async (context) =>
            {
                await requestHandler.Handle(context, "url to an api", "an api key");
            });

        });

        app.UseMvcWithDefaultRoute();
    }
}

RequestHandler.cs

public class RequestHandler : IRequestHandler
{
    //[Authorize] doesn't work
    public async Task Handle(HttpContext context, string apiUrl, string apiKey)
    {   
        //injected IOAuthService _service;
        //tried with and without context as parameter
        var accessToken = await _service.GetAccesTokenAsync();

        //do stuff ... 
    }
}

OAuthService.cs

public class OAuthService : IOAuthService
{
    private async Task<string> GetAccesTokenAsyncHelper(HttpContext context)
    {
        var isAuthenticated = ((ClaimsIdentity)context.User.Identity)?.IsAuthenticated ?? false;
        if (!isAuthenticated)
        {
            //tried with and without setting schemename
            await context.ChallengeAsync(OAuthOptionsDefaults.SchemeName);
        }

        return await context.GetTokenAsync(OAuthOptionsDefaults.SchemeName, "access_token");
    }

    public async Task<string> GetAccesTokenAsync()
    {
        //injected IHttpContextAccessor _accessor;
        var context = _accessor.HttpContext;
        return await GetAccesTokenAsyncHelper(context);
    }

    public async Task<string> GetAccesTokenAsync(HttpContext context)
    {
        return await GetAccesTokenAsyncHelper(context);
    }
}

Edit : made the question shorter and more to point in the hopes of someone answering it.

Answer 1

You need to add Identity to the user property of HttpContext

context.User.AddIdentity((ClaimsIdentity) principal.Identity);

I have added a tutorial here explaining how to authorize HttpContext in Middleware with JWT from the URL hope this will be helpful :)