nhyatt/bitwarden
1
0
Fork 0
mirror of https://github.com/bitwarden/server.git synced 2025-06-07 11:40:31 -05:00
Code

Merge remote-tracking branch 'origin/make-client-retrieval-more-extensible' into auth/pm-20532/tech-breakdown-poc-token-based-send-authn-and-authz

Browse Source
This commit is contained in:
Jared Snider 2025-05-29 12:34:42 -04:00
commit 194ca91c16
No known key found for this signature in database
GPG Key ID: A149DDD612516286
4 changed files with 17 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/Identity/IdentityServer/ClientProviders/SecretsManagerApiKeyProvider.cs
View File

@ -9,6 +9,8 @@ namespace Bit.Identity.IdentityServer.ClientProviders;
internal class SecretsManagerApiKeyProvider : IClientProvider
{
public const string ApiKeyPrefix = "apikey";
private readonly IApiKeyRepository _apiKeyRepository;
private readonly IOrganizationRepository _organizationRepository;

6
src/Identity/IdentityServer/DynamicClientStore.cs
View File

@ -1,5 +1,6 @@
#nullable enable
using Bit.Identity.IdentityServer.ClientProviders;
using Duende.IdentityServer.Models;
using Duende.IdentityServer.Stores;
@ -18,7 +19,7 @@ internal class DynamicClientStore : IClientStore
public DynamicClientStore(
IServiceProvider serviceProvider,
[FromKeyedServices("sm-apikey")] IClientProvider apiKeyClientProvider,
[FromKeyedServices(SecretsManagerApiKeyProvider.ApiKeyPrefix)] IClientProvider apiKeyClientProvider,
StaticClientStore staticClientStore
)
{
@ -46,8 +47,6 @@ internal class DynamicClientStore : IClientStore
// Increment past the period
var identifierName = clientIdSpan[..firstPeriod++];
// TODO: Validate some rules about the identifierName?
var identifier = clientIdSpan[firstPeriod..];
// The identifier is required to be non-empty
@ -56,6 +55,7 @@ internal class DynamicClientStore : IClientStore
return Task.FromResult<Client?>(null);
}
// Once identifierName is proven valid, materialize the string
var clientBuilder = _serviceProvider.GetKeyedService<IClientProvider>(identifierName.ToString());
if (clientBuilder == null)

14
src/Identity/IdentityServer/ServiceCollectionExtensions.cs
View File

@ -4,15 +4,23 @@ namespace Microsoft.Extensions.DependencyInjection;
public static class ServiceCollectionExtensions
{
/// <summary>
/// Registers a custom <see cref="IClientProvider"/> for the given identifier to be called when a client id with
/// the identifier is attempting authentication.
/// </summary>
/// <typeparam name="T">Your custom implementation of <see cref="IClientProvider"/>.</typeparam>
/// <param name="services">The service collection to add services to.</param>
/// <param name="identifier">
/// The identifier to be used to invoke your client provider if a <c>client_id</c> is prefixed with your identifier
/// then your <see cref="IClientProvider"/> implementation will be invoked with the data after the seperating <c>.</c>.
/// </param>
/// <returns>The <see cref="IServiceCollection"/> for additional chaining.</returns>
public static IServiceCollection AddClientProvider<T>(this IServiceCollection services, string identifier)
where T : class, IClientProvider
{
ArgumentNullException.ThrowIfNull(services);
ArgumentException.ThrowIfNullOrWhiteSpace(identifier);
// TODO: Track name so that if they register the same one twice it's an error?
// TODO: We could allow customization of service lifetime
services.AddKeyedTransient<IClientProvider, T>(identifier);
return services;

2
src/Identity/Utilities/ServiceCollectionExtensions.cs
View File

@ -78,7 +78,7 @@ public static class ServiceCollectionExtensions
services.AddClientProvider<UserClientProvider>("user");
services.AddClientProvider<OrganizationClientProvider>("organization");
services.AddClientProvider<SecretsManagerApiKeyProvider>("sm-apikey");
services.AddClientProvider<SecretsManagerApiKeyProvider>(SecretsManagerApiKeyProvider.ApiKeyPrefix);
if (CoreHelpers.SettingHasValue(globalSettings.IdentityServer.CosmosConnectionString))
{