I have a ASp.Net WebApi and I add the DelegatingHandler for modify the requestUri.
I tried some examples without results, It is possible?
I Would like to encrypt (client) Decrypt (WebApi) part of the URL.
In the WebApi exists the controller with the route:
api/employee/getInfo/{name}/{lastname}/{date}
From my web client I do the GET to the URL:
http://localhost/api/employee/getInfo/jhon/smith/010525
In the client interceptor I'm encrypt the last part of the URL, (base64 for the example)
http://localhost/api/employee/getInfo/amhvbi9zbWl0aC8wMTA1MjU=
Then in the SendAsync from DelegatingHandler that I want is decrypt the last part to
restore to the original URL to the webapi executes the proper webapi function.
thanks.
I did the next:
I added an additional route to my controller
[Route("api/employee/getInfo/{payload}")]
in the webapi
in the client interceptor change the original call
http://localhost/api/employee/getInfo/jhon/smith/010525
to
http://localhost/api/employee/getInfo/EncryptedInfo
finally in the DelegatingHandler
decrypt and convert to QueryString
http://localhost/api/employee/getInfo?name=jhon&lastname=smith&date=010525
I don't know if it's the correct way but for the moment is working.
If somebody have a better and correct solution please share.
thanks.
Related
I have a Spring Boot application, that is using Spring Security with OAuth 2.0. Currently, it is operating against an Authentication Server based on Spring Example code. However, running our own Auth Server has always been a short-term target to facilitate development, not a long-term goal. We have been using the authorization_code grant type and would like to continue using that, irrespective of the Auth Server implementation.
I am attempting to make changes to use OAuth 2.0 Endpoints in Azure Active Directory, to behave as our Authentication Server. So far, I have a successful call to the /authorize endpoint. But the call to get the /token fails with an invalid request error. I can see the requests going out.
It appears that parameters that Azure states as mandatory are not being populated in the POST request. Looking at the Azure doco, it expects the client_id to be defined in the body of the message posted to the endpoint, and that is not added, by default, by Spring.
Can anyone point me in the right direction for how I can add fields to the Form Map that is used when constructing the Access Token request? I can see where the AccessTokenRequest object is being setup in OAuth2ClientConfiguration....
#Bean
#Scope(value = "request", proxyMode = ScopedProxyMode.INTERFACES)
protected AccessTokenRequest accessTokenRequest(#Value("#{request.parameterMap}")
Map<String, String[]> parameters, #Value("#{request.getAttribute('currentUri')}")
String currentUri) {
DefaultAccessTokenRequest request = new DefaultAccessTokenRequest(parameters);
request.setCurrentUri(currentUri);
return request;
}
Should I be trying to define the map in a request.parameterMap spring property? If so, I'm not too sure how that works.
Or should I be using one of the interfaces defined in the AuthorizationServerConfigurerAdapter class?
I have the information to include when sending the AccessTokenRequest, I just don't know the best way to configure Spring to include it? Thanks for any help.
Actually, I found this out. I needed to change the client authentication scheme. Simply adding the following to my application properties added the client_id to the form....
security.oauth2.client.clientAuthenticationScheme=form
If you're using yaml, then yaml-ize it. Thank you Spring!
I want to convert our existing WCF REST web services to ASP.NET Web APIso I started to look into it.
Getting one of my function (i.e. login) up and running in ASP.NET Web API was quite straight forward but there is one thing I'm confused about and I hope one of you can clarify this for me.
In our WCF REST web service, our login (POST) function was called as follows:
http://localhost/mywebsite/mywebservice.svc/Authentication/Login
We'd pass a LoginRequest to it and we'd get a LoginResponse back.
Now in ASP.NET Web API, I've our Login (POST) function is being called as follows:
http://localhost/api/authentication and I'm passing the same LoginRequest and I get the same LoginResponse.
My confusion is, how does ASP.NET Web API know to use the Login function which is defined in the AuthenticationController?
I assume it has something to do with the parameter type being passed but what if I have another function that has the same parameter type, how would it differentiate between the 2?
For example, what if I had a LocalLogin and CloudLogin (not the case btw) and both require the LoginRequest as an input parameter and both return the LoginResponse, how would it know which one to call since it's not part of the URI?
Thanks.
I'm trying to use Thinktecture.IdentityModel.45 for authentication in ASP.NET Web API.
I'm trying to get the Basic Authentication to work. And have downloaded the source and got the sample to work. (JsBasicAuth).
We have Web API in the same project as a MVC application. And when the test client calls ~/api/identity all handlers and authorization work. But then the framework (web api) tries to invoke a controller called "identity" and the call fails.
{"Message":"No HTTP resource was found that matches the request URI 'http://localhost/app/api/identity'.","MessageDetail":"No type was found that matches the controller named 'identity'."}
Do I need to exclude /identity /token from the routing? What am I missing?
I now discovered the Common project in the sample solution. There is a IdentityController there. And I didn't have that in my own project. Now it works! :)
I am new to web services. The last time I dealt with SOAP was when I created a bunch of wrapper classes that sent requests and received responses back per some response objects/classes I had created. So I had an object to send certain API requests and likewise a set of objects to hold the response back as an object so I could utilize that 3rd party API.
Then someone came to me and said why not just use the wsdl and a web service. Ok, so today I went and created a "Service Reference". I see that this is what's called a "Proxy Class". You just instantiate an instance of this and then walla you have access to all the methods from the wsdl.
But this leaves me with auth questions. Back when I created my own classes manually, I had a class which exposed properties that I would set then access for things like signature, username, password that got sent along with the Http request that were required by whatever 3rd party API I was using to make API calls.
But then with using a Service Reference, how then would I pass this information just like I had done in my custom classes? For instance I'm going to be working with the PayPal API. It requires you to send a signature and a few other pieces of information like username and password.
// Determins if API call needs to use a session based URI
string requestURI = UseAuthURI == true ? _requestURIAuthBased + aSessionID : _requestURI;
byte[] data = XmlUtil.DocumentToBytes(doc);
// Create the atual Request instance
HttpWebRequest request = CreateWebRequest(requestURI, data.Length);
So how do I pass username, password, signature, etc. when using web service references for each method call? Is it as simple as specifying it as a param to the method or do you use the .Credentials and .URL methods of your proxy class object? It seems to me Credentials means windows credentials but I could be wrong. Is it limited to that or can you use that to specify those required header values that PayPal expects with each method call/API request?
Using Web Service or Web Service Reference
How would I generate a proper URL for an MVC application to be included in an e-mail?
This is for my registration system which is separate from my controller/action. Basically, I want to send an email verification to fire an Action on a Controller. I don't want to hardcode the URL in, I would want something like the Url property on the Views.
In your Controller, the UrlHelper is just called "Url" - so:
void Index() {
string s = this.Url.Action("Index", "Controller");
}
The "this" is unnecessary, but it tells you where this Url variable comes from
I used:
Html.BuildUrlFromExpression<AccountController>(c=>c.Confirm(Model.confirmedGUID.Value))
It is part of the HTMLHelper (I think in the MVC Futures) so you may have to pass an instance of the HTMLHelper to your service layer, not sure. I use this directly in my view which renders to an email. That gives you the absolute URL and then I store the domain (http://www.mysite.com) in the config file and append it before the URL.
You should probably make the URL part of the configuration of your application.
I know you can do stuff with e.g. the Server property on your web application, but the application will never know if its IP or domain name is reachable from the outside as it might be hidden behind a proxy or a load balancer.
If I'm reading the question correctly, you need to controller/action outside the MVC code. If so, you will need to simply configure the URL in Application Configuration or some such place, unless you have access to the controller classes and use reflection to get the names.