Add more Token validation configuration

CGI-FR · Jun 29, 2022 · e8668a7 · e8668a7
1 parent 5337635
commit e8668a7
Show file tree

Hide file tree

Showing 4 changed files with 16 additions and 0 deletions.
diff --git a/src/AzureIoTHub.Portal/Server/ConfigHandler.cs b/src/AzureIoTHub.Portal/Server/ConfigHandler.cs
@@ -25,6 +25,8 @@ public abstract class ConfigHandler
         internal const string OIDCValidateAudienceKey = "OIDC:ValidateAudience";
         internal const string OIDCValidateLifetimeKey = "OIDC:ValidateLifetime";
         internal const string OIDCValidateIssuerSigningKeyKey = "OIDC:ValidateIssuerSigningKey";
+        internal const string OIDCValidateActorKey = "OIDC:ValidateActor";
+        internal const string OIDCValidateTokenReplayKey = "OIDC:ValidateTokenReplay";
 
         internal const string IsLoRaFeatureEnabledKey = "LoRaFeature:Enabled";
 
@@ -79,6 +81,10 @@ internal static ConfigHandler Create(IWebHostEnvironment env, IConfiguration con
 
         internal abstract bool OIDCValidateIssuerSigningKey { get; }
 
+        internal abstract bool OIDCValidateActor { get; }
+
+        internal abstract bool OIDCValidateTokenReplay { get; }
+
         internal abstract bool IsLoRaEnabled { get; }
 
         internal abstract string StorageAccountBlobContainerName { get; }

diff --git a/src/AzureIoTHub.Portal/Server/DevelopmentConfigHandler.cs b/src/AzureIoTHub.Portal/Server/DevelopmentConfigHandler.cs
@@ -48,6 +48,10 @@ internal DevelopmentConfigHandler(IConfiguration config)
 
         internal override bool OIDCValidateIssuerSigningKey => this.config.GetValue(OIDCValidateIssuerSigningKeyKey, true);
 
+        internal override bool OIDCValidateActor => this.config.GetValue(OIDCValidateActorKey, false);
+
+        internal override bool OIDCValidateTokenReplay => this.config.GetValue(OIDCValidateTokenReplayKey, false);
+
         internal override bool IsLoRaEnabled => bool.Parse(this.config[IsLoRaFeatureEnabledKey] ?? "true");
 
         internal override string StorageAccountBlobContainerName => this.config[StorageAccountBlobContainerNameKey];

diff --git a/src/AzureIoTHub.Portal/Server/ProductionConfigHandler.cs b/src/AzureIoTHub.Portal/Server/ProductionConfigHandler.cs
@@ -48,6 +48,10 @@ internal ProductionConfigHandler(IConfiguration config)
 
         internal override bool OIDCValidateIssuerSigningKey => this.config.GetValue(OIDCValidateIssuerSigningKeyKey, true);
 
+        internal override bool OIDCValidateActor => this.config.GetValue(OIDCValidateActorKey, false);
+
+        internal override bool OIDCValidateTokenReplay => this.config.GetValue(OIDCValidateTokenReplayKey, false);
+
         internal override bool IsLoRaEnabled => bool.Parse(this.config[IsLoRaFeatureEnabledKey] ?? "true");
 
         internal override string StorageAccountBlobContainerName => this.config[StorageAccountBlobContainerNameKey];

diff --git a/src/AzureIoTHub.Portal/Server/Startup.cs b/src/AzureIoTHub.Portal/Server/Startup.cs
@@ -91,6 +91,8 @@ public void ConfigureServices(IServiceCollection services)
                     opts.TokenValidationParameters.ValidateAudience = configuration.OIDCValidateAudience;
                     opts.TokenValidationParameters.ValidateLifetime = configuration.OIDCValidateLifetime;
                     opts.TokenValidationParameters.ValidateIssuerSigningKey = configuration.OIDCValidateIssuerSigningKey;
+                    opts.TokenValidationParameters.ValidateActor = configuration.OIDCValidateActor;
+                    opts.TokenValidationParameters.ValidateTokenReplay = configuration.OIDCValidateTokenReplay;
                 });
 
             _ = services.AddSingleton(configuration);