| | | 1 | | using Elsa.Common.Multitenancy; |
| | | 2 | | using Elsa.Extensions; |
| | | 3 | | using Elsa.ExternalAuthentication.Contracts; |
| | | 4 | | using Elsa.ExternalAuthentication.Options; |
| | | 5 | | using Elsa.ExternalAuthentication.Permissions; |
| | | 6 | | using Elsa.ExternalAuthentication.Policies; |
| | | 7 | | using Elsa.ExternalAuthentication.Providers; |
| | | 8 | | using Elsa.ExternalAuthentication.Services; |
| | | 9 | | using Elsa.ExternalAuthentication.Stores.InMemory; |
| | | 10 | | using Elsa.ExternalAuthentication.Validation; |
| | | 11 | | using Elsa.Identity.Contracts; |
| | | 12 | | using Microsoft.AspNetCore.Builder; |
| | | 13 | | using Microsoft.AspNetCore.RateLimiting; |
| | | 14 | | using Microsoft.Extensions.Diagnostics.HealthChecks; |
| | | 15 | | using Microsoft.Extensions.DependencyInjection.Extensions; |
| | | 16 | | using Microsoft.Extensions.Options; |
| | | 17 | | |
| | | 18 | | namespace Microsoft.Extensions.DependencyInjection; |
| | | 19 | | |
| | | 20 | | public static class ServiceCollectionExtensions |
| | | 21 | | { |
| | | 22 | | /// <summary>Adds the explicit, non-readiness External Authentication health bridge.</summary> |
| | | 23 | | public static IHealthChecksBuilder AddExternalAuthenticationHealthCheck(this IServiceCollection services, string nam |
| | 0 | 24 | | services.AddHealthChecks().AddCheck<ExternalAuthenticationHealthCheck>(name, HealthStatus.Degraded, tags ?? ["ex |
| | | 25 | | |
| | | 26 | | /// <summary> |
| | | 27 | | /// Adds the protocol-neutral External Authentication foundation and its single-node defaults. |
| | | 28 | | /// Hosts requiring durable, multi-node state may replace the store registrations. |
| | | 29 | | /// </summary> |
| | | 30 | | public static IServiceCollection AddExternalAuthenticationServices(this IServiceCollection services, Action<External |
| | | 31 | | { |
| | 6 | 32 | | var options = services.AddOptions<ExternalAuthenticationOptions>().ValidateOnStart(); |
| | 6 | 33 | | if (configureOptions != null) |
| | 3 | 34 | | options.Configure(configureOptions); |
| | | 35 | | |
| | | 36 | | // The module evaluates permissions outside endpoint authorization -- delegation, the grant boundary, |
| | | 37 | | // and the recovery override -- so it depends on the evaluator whether or not a host wired one up. |
| | | 38 | | // The call is TryAdd-based and idempotent, so a host that already registered one keeps it. |
| | 6 | 39 | | services.AddElsaAuthorization(); |
| | | 40 | | |
| | | 41 | | // Contributed explicitly rather than left to the host's assembly scan, so the module's resources reach |
| | | 42 | | // the catalog on any host that registers its services, the same reason AddElsaAuthorization is called |
| | | 43 | | // here. Registration is TryAddEnumerable-backed, so a host that also scans this assembly gets one copy. |
| | 6 | 44 | | services.AddPermissionDescriptors<ExternalAuthenticationResourcePermissionsDescriptorProvider>(); |
| | | 45 | | |
| | 6 | 46 | | services.AddExternalAuthenticationExtension(ExternalAuthenticationExtensionKind.UnlinkedIdentityPolicy, RejectUn |
| | 6 | 47 | | services.AddExternalAuthenticationExtension(ExternalAuthenticationExtensionKind.UnlinkedIdentityPolicy, CreateUs |
| | 6 | 48 | | services.AddExternalAuthenticationExtension(ExternalAuthenticationExtensionKind.UnlinkedIdentityPolicy, MatchExt |
| | 6 | 49 | | services.AddExternalAuthenticationExtension(ExternalAuthenticationExtensionKind.PermissionGrantSource, ElsaRoleP |
| | 6 | 50 | | services.AddExternalAuthenticationExtension(ExternalAuthenticationExtensionKind.PermissionGrantSource, ClaimMapp |
| | 6 | 51 | | services.AddExternalAuthenticationExtension(ExternalAuthenticationExtensionKind.PermissionGrantSource, GroupMapp |
| | 6 | 52 | | services.AddExternalAuthenticationExtension(ExternalAuthenticationExtensionKind.PermissionGrantSource, ClaimPass |
| | | 53 | | // The validator warns about grant-boundary configuration, and ValidateOnStart resolves it on any |
| | | 54 | | // IOptions access, so a logger has to be resolvable even on a bare service collection. AddLogging is |
| | | 55 | | // TryAdd-based, so a host that already configured logging keeps its own. |
| | 6 | 56 | | services.AddLogging(); |
| | 6 | 57 | | services.TryAddEnumerable(ServiceDescriptor.Singleton<IValidateOptions<ExternalAuthenticationOptions>, ExternalA |
| | 6 | 58 | | services.AddDataProtection(); |
| | 7 | 59 | | services.AddRateLimiter(_ => { }); |
| | 6 | 60 | | services.TryAddEnumerable(ServiceDescriptor.Singleton<IConfigureOptions<RateLimiterOptions>, ConfigureExternalAu |
| | | 61 | | |
| | | 62 | | // The module reads the ambient tenant outside the multitenancy feature -- connection scoping and the |
| | | 63 | | // role-deletion contributor's tenant boundary -- so it depends on an accessor whether or not a host |
| | | 64 | | // enabled multitenancy. TryAdd keeps a host's own registration. |
| | 6 | 65 | | services.TryAddSingleton<ITenantAccessor, DefaultTenantAccessor>(); |
| | | 66 | | |
| | 6 | 67 | | services.TryAddSingleton<ConnectionRevisionCalculator>(); |
| | 6 | 68 | | services.TryAddSingleton<FinalLoginPathGuard>(); |
| | 6 | 69 | | services.TryAddSingleton<ExternalAuthenticationSecurityNotifier>(); |
| | 6 | 70 | | services.TryAddScoped<ConnectionTestService>(); |
| | 6 | 71 | | services.TryAddScoped<PreviewSignInService>(); |
| | 6 | 72 | | services.TryAddSingleton<ExternalAuthenticationHealthCheck>(); |
| | 6 | 73 | | services.TryAddSingleton<IOutboundDnsResolver, SystemOutboundDnsResolver>(); |
| | 6 | 74 | | services.TryAddSingleton<OutboundDestinationValidator>(); |
| | 6 | 75 | | services.TryAddSingleton<IValidatedAddressConnector, SocketValidatedAddressConnector>(); |
| | 6 | 76 | | services.TryAddSingleton<ValidatedOutboundConnectionFactory>(); |
| | 6 | 77 | | services.TryAddSingleton<IProviderHttpClientFactory, ProviderHttpClientFactory>(); |
| | 6 | 78 | | services.TryAddEnumerable(ServiceDescriptor.Singleton<IIdentityProviderConnectionSource, ConfigurationIdentityPr |
| | 6 | 79 | | services.TryAddSingleton<IIdentityProviderConnectionStore, InMemoryIdentityProviderConnectionStore>(); |
| | 6 | 80 | | services.TryAddEnumerable(ServiceDescriptor.Singleton<IIdentityProviderConnectionSource, DatabaseIdentityProvide |
| | 6 | 81 | | services.TryAddSingleton<IIdentityProviderConnectionRegistry, DefaultIdentityProviderConnectionRegistry>(); |
| | 6 | 82 | | services.TryAddSingleton<IIdentityProviderConnectionValidityAssessor, IdentityProviderConnectionValidityAssessor |
| | 6 | 83 | | services.TryAddSingleton<ExtensionDescriptorValidator>(); |
| | 6 | 84 | | services.TryAddSingleton<IExternalAuthenticationAdapterRegistry, DefaultExternalAuthenticationAdapterRegistry>() |
| | 6 | 85 | | services.TryAddSingleton<IUnlinkedIdentityPolicyRegistry, DefaultUnlinkedIdentityPolicyRegistry>(); |
| | 6 | 86 | | services.TryAddSingleton<IExternalUserMatcherRegistry, DefaultExternalUserMatcherRegistry>(); |
| | 6 | 87 | | services.TryAddScoped<IPermissionGrantSourceRegistry, DefaultPermissionGrantSourceRegistry>(); |
| | 6 | 88 | | services.TryAddSingleton<IAdapterSettingsMigrationService, AdapterSettingsMigrationService>(); |
| | | 89 | | |
| | 6 | 90 | | services.TryAddSingleton<IExternalAuthenticationStateStore, InMemoryExternalAuthenticationStateStore>(); |
| | 6 | 91 | | services.TryAddSingleton<IExternalAuthenticationHandleHasher, HmacExternalAuthenticationHandleHasher>(); |
| | 6 | 92 | | services.TryAddSingleton<IAuthorizationGrantStore, InMemoryAuthorizationGrantStore>(); |
| | 6 | 93 | | services.TryAddSingleton<IExternalAuthenticationSessionStore, InMemoryExternalAuthenticationSessionStore>(); |
| | 6 | 94 | | services.TryAddSingleton<IPreviewResultStore, InMemoryPreviewResultStore>(); |
| | 6 | 95 | | services.TryAddSingleton<IConnectionObservationStore, InMemoryConnectionObservationStore>(); |
| | 6 | 96 | | services.TryAddSingleton<IConnectionRegistryVersionStore, InMemoryConnectionRegistryVersionStore>(); |
| | 6 | 97 | | services.TryAddSingleton<InMemoryExternalIdentityProvisionerState>(); |
| | 6 | 98 | | services.TryAddScoped<InMemoryExternalIdentityProvisioner>(); |
| | 6 | 99 | | services.TryAddScoped<IExternalIdentityProvisioner>(serviceProvider => serviceProvider.GetRequiredService<InMemo |
| | 6 | 100 | | services.TryAddScoped<IExternalIdentityLinkManagementStore>(serviceProvider => serviceProvider.GetRequiredServic |
| | 6 | 101 | | services.TryAddScoped<ExternalIdentityLinkManagementService>(); |
| | 6 | 102 | | services.TryAddScoped<IExternalIdentityResolver, DefaultExternalIdentityResolver>(); |
| | 6 | 103 | | services.TryAddScoped<IPermissionGrantResolver, DefaultPermissionGrantResolver>(); |
| | 6 | 104 | | services.TryAddScoped<IPermissionDelegationAuthorizer, DefaultPermissionDelegationAuthorizer>(); |
| | 6 | 105 | | services.TryAddEnumerable(ServiceDescriptor.Singleton<ISecretBindingResolver, ConfigurationSecretBindingResolver |
| | 6 | 106 | | services.TryAddEnumerable(ServiceDescriptor.Singleton<IUnlinkedIdentityPolicy, RejectUnlinkedIdentityPolicy>()); |
| | 6 | 107 | | services.TryAddEnumerable(ServiceDescriptor.Singleton<IUnlinkedIdentityPolicy, CreateUserUnlinkedIdentityPolicy> |
| | 6 | 108 | | services.TryAddEnumerable(ServiceDescriptor.Singleton<IUnlinkedIdentityPolicy, MatchExternalUserUnlinkedIdentity |
| | 6 | 109 | | services.TryAddEnumerable(ServiceDescriptor.Scoped<IPermissionGrantSource, ElsaRolePermissionGrantSource>()); |
| | 6 | 110 | | services.TryAddEnumerable(ServiceDescriptor.Scoped<IPermissionGrantSource, ClaimMappingPermissionGrantSource>()) |
| | 6 | 111 | | services.TryAddEnumerable(ServiceDescriptor.Scoped<IPermissionGrantSource, GroupMappingPermissionGrantSource>()) |
| | 6 | 112 | | services.TryAddEnumerable(ServiceDescriptor.Scoped<IPermissionGrantSource, ClaimPassThroughPermissionGrantSource |
| | 6 | 113 | | services.TryAddScoped<IExternalAuthenticationTokenIssuer, DefaultExternalAuthenticationTokenIssuer>(); |
| | 6 | 114 | | services.TryAddScoped<IExternalAuthenticationBroker, ExternalAuthenticationBroker>(); |
| | 6 | 115 | | services.TryAddScoped<IdentityProviderConnectionManagementService>(); |
| | 6 | 116 | | services.TryAddEnumerable(ServiceDescriptor.Scoped<IRoleDeletionDependencyContributor, ExternalAuthenticationRol |
| | 6 | 117 | | services.TryAddEnumerable(ServiceDescriptor.Scoped<IUserDeletionDependencyContributor, ExternalAuthenticationUse |
| | | 118 | | |
| | 6 | 119 | | return services; |
| | | 120 | | } |
| | | 121 | | |
| | | 122 | | /// <summary> |
| | | 123 | | /// Registers the stable identifier of a trusted deployment-installed extension |
| | | 124 | | /// for startup selection validation. |
| | | 125 | | /// </summary> |
| | | 126 | | public static IServiceCollection AddExternalAuthenticationExtension( |
| | | 127 | | this IServiceCollection services, |
| | | 128 | | ExternalAuthenticationExtensionKind kind, |
| | | 129 | | string type) |
| | | 130 | | { |
| | 45 | 131 | | ArgumentException.ThrowIfNullOrWhiteSpace(type); |
| | 45 | 132 | | services.Configure<ExternalAuthenticationExtensionOptions>(options => |
| | 52 | 133 | | options.Registrations.Add(new(kind, type))); |
| | 45 | 134 | | return services; |
| | | 135 | | } |
| | | 136 | | } |