Giter VIP home page Giter VIP logo

opentouryoproject / multipurposeauthsite Goto Github PK

View Code? Open in Web Editor NEW
9.0 5.0 7.0 16.36 MB

汎用認証サイトは、ASP.NET Identity および JSON Web Token (JWT)によって強化されたOAuth 2.0およびOpenID ConnectのIdentity Provider (Idp) および Security Token Service (STS)です。(Multi-purpose Authentication Site is Identity Provider (Idp) and Security Token Service (STS) of OAuth 2.0 and OpenID Connect powered by ASP.NET Identity and JSON Web Token (JWT).)

Home Page: https://opentouryo.osscons.jp/index.php?汎用認証サイト（Multi-purpose%20Authentication%20Site）

Batchfile 0.49% C# 61.74% CSS 0.37% JavaScript 21.58% PLSQL 0.23% HTML 13.86% TSQL 0.49% ASP.NET 0.01% PowerShell 0.05% Shell 0.01% Kotlin 0.10% Swift 0.01% Objective-C 0.01% Dart 1.06%
oauth2 oidc sts mvc idp fapi saml2 c-sharp aspnet-identity jwt

multipurposeauthsite's People

Contributors

daisukenishino avatar daisukenishino2 avatar

Stargazers

avatar avatar avatar avatar avatar avatar avatar avatar avatar

Watchers

avatar avatar avatar avatar avatar

Forkers

shamohai lzh-boy lulzzz fr830 zxbe daisukenishino2 jakinchan

multipurposeauthsite's Issues

Change the method of identifying the System administrator user.

Requirement

  • A user having the role of the system administrator user added by the initial system administrator user should be changed to operate as the system administrator user.
  • To do this, must be identify the system administrator with the system administrator role, not the initial system administrator's UserName.
  • This problem became clear by fix of #14.

Move the menu location. And, add access control to it.

Requirement

Location.

From here to there.

Access control

Administration screens

Check if the user can activate the administration screen.
https://github.com/OpenTouryoProject/MultiPurposeAuthSite/blob/develop/root/programs/MultiPurposeAuthSite/MultiPurposeAuthSite/Views/Home/Index.cshtml#L62

OAuth 2.0 operation verification screen

Check if it is not locked down (#24).
https://github.com/OpenTouryoProject/MultiPurposeAuthSite/blob/develop/root/programs/MultiPurposeAuthSite/MultiPurposeAuthSite/Views/Home/Index.cshtml#L68

Merge the fixes into the develop branch.

Requirement

Merge the bug fixes into the develop branch,
These problem have been found at the testing time on the customize branch.

https://github.com/OpenTouryoProject/MultiPurposeAuthSite/commits/customize_p1

  • 41f33b9
    Bug fixes by the testing (1).
    • A problem occurred in the sign-up process due to the specification was changed.
    • Fix to display appropriate error message at redisplay.
  • 75e20c9
    Bug fixes by the testing (2).
    • Fixed the problem of culture fallback.
  • cfb995c
    Added the customize (6).
    The screen was splitted. And, added two screes.
    Fixed the following problems found at that time.
    • Session is no longer used, so there is no concern about session timeout.
    • When an unknown error occurs, in this case, it transits to the error screen instead of RedirectToAction. Therefore, this unnecessary coverage should be deleted.
  • 056dcbc
    Added the customize (7).
    Changed the specification of the PasswordReset screen.
  • d343b2e
    Quality improvement by the testing (1).
    Fixed the problem of OAuth2 flow.

Add following features related OAuth2 to user attribute edit screen.

Requirement

Add following features related OAuth2 to user attribute edit screen.

Automatic generation feature of ClientID and ClientSecret.

  • As a result, the users themself can add an any OAuth2 client to the authentication site.
  • Also, if the key leaks out, it is safe as users can update themselves.

Acquisition feature of "bearer token".

  • This is one way to achieve resource access in the "Trusted Subsystem Model".
  • As a more sophisticated response, it is planned to support of #5.

Reconsider the log output event and output method.

Requirement

  • Reconsider logging events and methods related to authentication.
  • Currently it is biased toward debugging trace and exception log output in user store.
  • This will be necessary for introduction to enterprise level projects.

There is needs to add an input field of password on the change user name screen.

Requirement

I thought it would be better if I could change this behavior with an optional switch.

Consideration

In the current implementation, while the logged-in user is away, you can change the user name and password by operating the edit screen. I think that this is assumed to use inside the building of the enterprise that tends to leave the seat, while the screen is open. But, originally, I think internal crimes are less likely to occur if it is inside the enterprise. On the other hand, when using outside the building, I think that there are many cases where it is self-responsibility. However, if you need to enter a password you are safe even if you leave your seat.

Target

I thought that this processing should be added to such as the following processing that affect more bigger than the password change processing.

Change user name & E-mail address screen

There is a case, suddenly, a user will not be able to use own account due to abuse of user name change by the other user. Especially, in the case of the E-mail address was changed, this state can not be recovered by only the password reset processing without tracking the ID and user name.

Delete account screen

Since deletion specification depends on the specification of each project, this screen does not exist at this time. However, since in case of deleting an account of e-mail format, there are cases that the account cannot be re-created, we think that it is meaningful to defend it with a password when adding an account deletion screen.

Close this specification to specification of OpenID Connect.

Requirement

I think that we should close this specification to specification of OpenID Connect.
In particular, I think we need to pay attention to the following points.

ID Token

This site returns a bearer token similar to the ID token.
Therefore, I think we need to check the specifications of the ID token carefully.

Claims

In RFC 6749 for OAuth 2.0, the endpoint specification for acquiring the user's claim is not determined.
Therefore, I think that it is good to decide the standard specification of this authentication site with reference to OpenID Connect.

The method of to include the claim and to get the claim set.

There is a method to specify to add the claim to the ID token and UserInfo response. As well as above, I think that it is good to reference this specification as the standard specification of this authentication site.

Support the "JWT Bearer Token Flow".

Requirement

This is one way to achieve resource access in the "Trusted Subsystem Model" same as the "#4".

I think that this method is a more secure method.

  • Implement by referring the implementation of google that is without client authentication.
  • In addition, key exchange is done using XML.
  • Develop a CUI tool to generate JWT assertion.

There is needs to consider the default processing policy of redirect_uri for this project.

Requirement

  • If redirect_uri is not specified,
    • redirect_uri registered by client registration is used.
    • In some cases, it is registered as a specific symbol.
  • If redirect_uri is specified,
    • Allow only redirect_uri for implemented on MultiPurposeAuthSite that is allowed for the unspecified client_id.
    • Alternatively, redirect_uri that forward-matches the redirect_uri already registered in the client is permitted.

Support the "OpenID Connect".

Requirement

Support the "OpenID Connect".

Method

Reference

Make StretchCount configurable.

Requirement

StretchCount is used for countermeasures against off-line brute force search.
It is intended to degrade the rapidly performance of the hash function.

But, currently, StretchCount is fixed to "1",
Because, this state is assumed that StretchCount will be re-written by the project.

But, I think this is unkindly specification.
Therefor, It should be make StretchCount configurable.
Also, for the above reasons, it is not necessary to use a variable value.

There is needs to add a switch that is to configure of the expiration date of the cookie authentication ticket.

Requirement

Such as this specification was requested.
I also think that there are many opportunities to use this config.

Looking at the information around the following,

It seems to be able to respond by fixing the following.

There is a problem with verification of ClientID and ClientSecret.

Overview

ApplicationOAuthBearerTokenProvider.cs
https://github.com/OpenTouryoProject/MultiPurposeAuthSite/blob/develop/root/programs/MultiPurposeAuthSite/MultiPurposeAuthSite/Models/ASPNETIdentity/TokenProviders/ApplicationOAuthBearerTokenProvider.cs

Even when ClientID and ClientSecret is not specified, basic authentication passes.

  • In this case, redirect will not be success with authorization code grant and implicit grant. therefore, this problem is small.
  • But, resource owner credentials grant and client credentials grant passes authentication, this is problem.

Output the tracelog using Dapper.

Requirement

The additional fix of #44.
This seems feasible on the DbCommand with the MiniProfiler.

NuGet Gallery

Some screens do not support responsive design correctly.

Requirement

I did not confirm the specification match with the OpenTouryo template and ASP.NET Identity template.
Check the layout when the screen size is reduced, and correct this as necessary.

layout system

Grid systems do not interfere if they are nested.
Therefore,

  • "sm" is the threshold of the menu area,
  • and "md" is the threshold of the content area.

And, these act effectively.

Media Queries

There was a problem in some selectors.

Component

navbar

These navis were irrelevant to responsive design.

To verify whether the "E-mail confirmation" can detach from the "sign-up process".

Requirement

Currently, "E-mail confirmation" is integrated into "sign-up process".

So,

Save the E-mail address to be updated to the temporary area,
And, if the result of ConfirmEmailAsync method is result.Succeeded,
I will try to update both the UserName and Email attributes for this.

What I care about is whether E-mail sending + code verification at the timing
when the E-mail address is not reflected in UserStore correctly functions on ASP.NET Identity.

This will be implemented in the following places as Investigation.
https://github.com/OpenTouryoProject/MultiPurposeAuthSite/blob/develop/root/programs/MultiPurposeAuthSite/MultiPurposeAuthSite/Controllers/ManageController.cs#L314

The error occurred in creating X509Certificate2 from a PFX or P12 file in production environment.

Requirement

The following exception occurred in a production environment.

Therefore, it is necessary to modify the library so that it can set the X509KeyStorageFlags from the application.

There is needs to lock down the OAuth 2.0 operation verification screen in production environment.

Requirement

Add a switch and lock down the following client side processes.

Redirect endpoint

https://github.com/OpenTouryoProject/MultiPurposeAuthSite/blob/develop/root/programs/MultiPurposeAuthSite/MultiPurposeAuthSite/Controllers/AccountController.cs#L1242

  • AccountController.OAuthAuthorizationCodeGrantClient
  • AccountController.OAuthImplicitGrantClient

Menu to launch

https://github.com/OpenTouryoProject/MultiPurposeAuthSite/blob/develop/root/programs/MultiPurposeAuthSite/MultiPurposeAuthSite/Views/Home/Index.cshtml#L68

Reconsider the sign up process.

Requirement

As a result of reconsideration, it was decided on the following specifications.

Resending confirmation mail

Describing behaviors when sign-up is repeated again, mainly because the confirmation mail has been lost. In this case, the record of the user exists. Therefore, delete the initial user name & password that is not activated, send confirmation mail after registering with a new user name & password.

User records that are accumulated like garbage and not activated

I think that it is necessary to delete user records that are accumulated like garbage and not activated. However, to execute this process, a time stamp is required. At the present time, such a field does not exist. Therefore, there is a need to add the date of generation to the user record.

There is needs to add a switch that is to configure of the expiration date of the link in the confirmation e-mail.

Requirement

Such as this specification was requested.
I also think that there are many opportunities to use this config.

Looking at the information around the following,

It seems to be able to respond by fixing the following.

Lock down the sign up and management functions.

Requirement

Assume a use case of the MultiPurposeAuthSite that is connected to an existing user store.
In this case, there are needs need to lock down the sign up and management functions.

When the screen size becomes smaller, then the left menu becomes too small.

Requirement

In case of the screen size becomes smaller, then I will respond by increasing the number of columns assigned to the menu. (As follows, use the currently using the grid system of bootstrap.)

<div id="body-bk">
    <div id="body" class="row">
        <div class="nav-side-menu col-sm-3 col-md-2">
            略
        </div>
        <div id="contents" class="col-sm-9 col-md-10">
            略
        </div>
    </div>
</div>

There is a problem with role management under multi-tenant environment.

Requirement

  • Even if it exists in different tenants, can not add roles with the same name.
    This is a specification of ASP.NET Identity, but there is a need to consider countermeasures.

  • Tenant administrator can not list the tenant users belonging to the global role.

    • Because the tenant administrator does not have ownership of the global role.
    • This fix could be responded by releasing authority.

Should be able to specify the expiration date of the confirmation link by using DB store.

Requirement

The feature to change or add the E-mail address.

This feature is using customized confirmation of E-mail address.

"Authorization code" feature .

Add the create date field.

"Refresh token" feature .

  • Add the create date field.
  • And for the refresh token, to implement switch of Enable / Disable.

There is a problem with processing related the "role" on the administration screen.

Requirement

There is a needs to fix the following problems.

  • You can give another account the role that is higher authority than the role to which you belong.
  • There is a problem with "parented" of the object that is created by "User who can create objects by granting privileges". Due to this problem, objects are not added to the same tenant.
  • Role should be also performed "conditional search" in the same way as #2 issue.

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.