My current implementation uses OWIN token implementation using the standard functionality using endpoints:
e.g /token endpoint and with the below method
and then using:
public override async Task GrantResourceOwnerCredentials(OAuthGrantResourceOwnerCredentialsContext context)
{
authentication code + claim assignment
context.Validated(ticket);
}
I am trying to impersonate a user. Ideally i would like to be able to recall / re-run my code in the GrantResourceOwnerCredentials but this only seems to be run with /token endpoint. Or find a way to regenerate the token claims and send those to the user manually in my own endpoint e.g /tokenimpersonate method?
I do not use cookies this is a pure token implementation.
The other alternative is that i could adjust the claims on an existing user but my understanding i need to log them out and log them in, in this case how do i pass a new token to the front-end?
This is the code i eventually used to make this work:
Authentication.SignOut(authTypeNames.ToArray());
var oAuthIdentity = new ClaimsIdentity(OAuthDefaults.AuthenticationType);
oAuthIdentity.AddClaim(new Claim(ClaimTypes.Name, dbUser.Username));
oAuthIdentity.AddClaim(new Claim(ClaimTypes.NameIdentifier, dbUser.User_ID.ToString()));
oAuthIdentity.AddClaim(new Claim(ClaimTypes.Role, dbUser.UserRole));
oAuthIdentity.AddClaim(new Claim(ClaimTypes.Role, dbUser.User_ID.ToString()));
//ads only certain docadmin ids to the role.
if (dbUser.UserRole == Medapp.BusinessFacade.Constants.ROLE_SECRETARY)
{
// /doc/home
//add guids of all the doctors as roles
var roles = db.OfficeAdministrators.Where(p => p.Admin_ID == dbUser.User_ID);
foreach (var role in roles)
{
oAuthIdentity.AddClaim(new Claim(ClaimTypes.Role, role.Doctor_ID.ToString()));
}
}
List<Claim> jroles = oAuthIdentity.Claims.Where(c => c.Type == ClaimTypes.Role).ToList();
AuthenticationProperties properties = CreateProperties(dbUser.User_ID.ToString(), dbUser.UserRole, dbUser.Username, Newtonsoft.Json.JsonConvert.SerializeObject(jroles.Select(x => x.Value))); //user.UserName);
properties.IsPersistent = true;
properties.ExpiresUtc = new System.DateTimeOffset(new DateTime().AddDays(365), new System.TimeSpan());
var ticket = new AuthenticationTicket(oAuthIdentity, properties);
DateTime currentUtc = DateTime.UtcNow;
ticket.Properties.IssuedUtc = currentUtc;
ticket.Properties.ExpiresUtc = currentUtc.Add(TimeSpan.FromDays(365));
string accessToken = Startup.OAuthOptions.AccessTokenFormat.Protect(ticket);
JObject token = new JObject(
new JProperty("username", dbUser.Username),
new JProperty("token", accessToken),
new JProperty("uid", dbUser.User_ID.ToString()),
new JProperty("type", dbUser.UserRole),
new JProperty("roles", Newtonsoft.Json.JsonConvert.SerializeObject(jroles.Select(x => x.Value))),
new JProperty("access_token", accessToken),
new JProperty("token_type", "bearer"),
new JProperty("expires_in", TimeSpan.FromDays(365).TotalSeconds.ToString()),
new JProperty("issued", currentUtc.ToString("ddd, dd MMM yyyy HH':'mm':'ss 'GMT'")),
new JProperty("expires", currentUtc.Add(TimeSpan.FromDays(365)).ToString("ddd, dd MMM yyyy HH:mm:ss 'GMT'"))
);
return Ok(token);