dasiths/NEasyAuthMiddleware

Testing from Postman always returns 401

HeinA opened this issue · 6 comments

HeinA commented

'ello

While testing with postman, I always get a 401 Unauthorized.

I'm testing this for an Api that I want to call from Unity using Google sign-in.

I pass the Authentication Token I get from the ".auth/login/google" endpoint on my App Service to my API in the X-ZUMO-AUTH header.

Am I misunderstanding something?

Thanx
Hein

dasiths commented

I can't say for sure without looking at your code. Is the 401 being returned from your own code (i.e. Controller with Authorization attribute) or from a downstream API?

The best way to test it would be to do something like this in your code

    [Route("api/[controller]")]
    [ApiController]
    public class AuthTestController : ControllerBase
    {
        // GET api/values
        [HttpGet]
        public ActionResult<object> Get()
        {
            var headers = Request.Headers
                .Select(h => new {name = h.Key, value = h.Value})
                .ToList();

            var userClaims = HttpContext.User.Claims
                .Select(claim => new {name = claim.Type, value = claim.Value})
                .ToList();

            return new
            {
                Headers = headers,
                Claims = userClaims
            };
        }
    }
  1. Follow the ReadMe file from this repo and add NEasyAuthMiddleware in. Then add the above code snippet for the controller.
  2. Deploy it to an app service. (Configured to work with Google federated sign in)
  3. Then hit https://yourwebsitename.azurewebsites.net/api/AuthTest and see what it returns. If it has all the claims and headers you expect then we can be certain the middleware works.
  4. If there is a header but isn't mapped to a claim then you will have have to write a custom mapper as shown in the readme.
  5. The token will be in a claim or in the header hence you won't need to call .auth/login/google to get it AFAIK. You can then simply attach that as an authorization header in a downstream API call.
HeinA commented
dasiths commented

Don't paste your tokens in a public arena like this. Someone can steal your identity using it.

  • Did you follow my example and add all of this
        public void ConfigureServices(IServiceCollection services)
        {
            services.AddHttpContextAccessor();
            services.AddEasyAuth();

            if (_hostingEnvironment.IsDevelopment()) // Use the mock json file when not running in an app service
            {
                var mockFile = $"{_hostingEnvironment.ContentRootPath}\\mock_user.json";
                services.UseJsonFileToMockEasyAuth(mockFile);
            }
        }

        // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
        public void Configure(IApplicationBuilder app, IHostingEnvironment env)
        {
            app.UseAuthentication();
        }
  • Did you register your custom ClaimsMapper in the DI container in the ConfigureServices method above (services.Add<IClaimsMapper,YourClaimsMapper>()) ? If not it won't get picked up?

Also the claims coming from the payload you posted is

"claims": [
    {
      "typ": "stable_sid",
      "val": "sid:5bf302a89ac327f4050b216dc2b61629"
    },
    {
      "typ": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier",
      "val": "sid:cdaf4c83e38c87e40ad0a0fb202232ed"
    },
    {
      "typ": "http://schemas.microsoft.com/identity/claims/identityprovider",
      "val": "google"
    },
    {
      "typ": "ver",
      "val": "3"
    },
    {
      "typ": "nbf",
      "val": "1596442430"
    },
    {
      "typ": "exp",
      "val": "1599034430"
    },
    {
      "typ": "iat",
      "val": "1596442430"
    },
    {
      "typ": "iss",
      "val": "https://xafari.azurewebsites.net/"
    },
    {
      "typ": "aud",
      "val": "https://xafari.azurewebsites.net/"
    }
  ],
HeinA commented
dasiths commented

Glad you got it sorted.

dasiths commented

Thank you very much. I had to add app.UseAuthorization(); in my Configure Startup method. I misread Authentication for Authorization. This is a fantastic library, thanx. I looked long and hard to find something that does this :)
…
On Mon, Aug 3, 2020 at 11:30 AM Dasith Wijesiriwardena < @.***> wrote: Don't paste your tokens in a public arena like this. Someone can steal your identity using it. Did you register your ClaimsMapper in the DI container? If not it won't get picked up? — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#5 (comment)>, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAJBC7PVG7VK7CHSRY35P5LR6Z7TTANCNFSM4PSWWSUQ .

I didn't realize you were using AspnetCore 3.0+

You will have to follow this guide to upgrade my example. https://docs.microsoft.com/en-us/aspnet/core/migration/22-to-30?view=aspnetcore-3.1&tabs=visual-studio#migrate-startupconfigure

So you need both .UseAuthentication and .UseAuthorization