Longing to know

In my previous installment, I focused mostly on sharing Cookies between an OWIN application and a .NET Core application. What happens if you want to utilize the Bearer tokens as well?

Out of the box, .NET Core supports JSON Web Tokens (JWT) for authentication/authorization on API endpoints. However, without modifying a ton of stuff in our OWIN OAuthserver, bearer tokens from OWIN are not JWT’s. This present a problem if you want to use the tokens for a .NET Core API endpoint.

Since we already got all of the IDataProtectionProvider stuff sorted out, it’s actually pretty easy to get this working with a custom Middleware. The basic premise is that the Middleware should intercept any requests and check for an Authorization token. If it’s detected, then the token should be decrypted in order to provide us with an AuthrnticationTicket. Using the AuthenticationTicket, we can instantiate a ClaimsIdentity and attach it to the context. This providers our validated user to the current request.

The Middleware looks like this:

public class AuthenticationMiddleware
{
	private IDataProtectionProvider _protectionProvider;
	private readonly RequestDelegate _next;
	private List<string> _purpose = new List<string>() { "TokenMiddleware", "Access_Token", "v2" };

	public AuthenticationMiddleware(RequestDelegate next, IDataProtectionProvider protectionProvider)
	{
		_next = next;
		_protectionProvider = protectionProvider;
	}

	public async Task Invoke(HttpContext context)
	{
		if (!context.User.Identity.IsAuthenticated)
		{
			try
			{
				var authorizeHeader = context.Request.Headers["Authorization"];
				if (authorizeHeader != StringValues.Empty)
				{
					var authType = "bearer";
					string token = authorizeHeader.FirstOrDefault();
					if (token?.StartsWith(authType, StringComparison.OrdinalIgnoreCase) ?? false)
					{
						var regEx = new Regex(authType, RegexOptions.IgnoreCase);
						token = regEx.Replace(token, string.Empty).TrimStart();
						var dataProtector = _protectionProvider.CreateProtector(_purpose);
						string decryptedToken = dataProtector.Unprotect(token);
						TicketSerializer serializer = new TicketSerializer();
						AuthenticationTicket ticket = serializer.Deserialize(Encoding.UTF8.GetBytes(decryptedToken));
						context.User = ticket.Principal;
					}
				}
			}
			catch (Exception ex)
			{
				Console.WriteLine(ex);
			}
		}

		await _next(context);
	}
}

After defining the Middleware, we only need to tell IAppBuilder to use it. I put this as the first Middleware handler.

// Put our bearer token check first
app.UseMiddleware<AuthenticationMiddleware>();

The only other change I had to make was to ensure that the same application name is used for all of the IDataProtectionProviders used across the various applications. Otherwise, the IDataProtector “unprotect” will fail.

In the future, of course, I will update things to utilize JWT’s and move to a secure token provider other than OWIN. For now, though, this is a very convenient stop-gap.