diff options
Diffstat (limited to 'src/OAuth/OAuthServiceProvider/Members')
8 files changed, 297 insertions, 0 deletions
diff --git a/src/OAuth/OAuthServiceProvider/Members/Authorize.aspx b/src/OAuth/OAuthServiceProvider/Members/Authorize.aspx new file mode 100644 index 0000000..b3e2c6a --- /dev/null +++ b/src/OAuth/OAuthServiceProvider/Members/Authorize.aspx @@ -0,0 +1,58 @@ +<%@ Page Title="" Language="C#" MasterPageFile="~/MasterPage.master" AutoEventWireup="true" Inherits="OAuthServiceProvider.Authorize" Codebehind="Authorize.aspx.cs" %> + +<asp:Content ID="Content2" ContentPlaceHolderID="Body" runat="Server"> + <asp:MultiView runat="server" ActiveViewIndex="0" ID="multiView"> + <asp:View runat="server"> + <div style="background-color: Yellow"> + <b>Warning</b>: Never give your login credentials to another web site or application. + </div> + <asp:HiddenField runat="server" ID="OAuthAuthorizationSecToken" EnableViewState="false" /> + <p>The client web site or application <asp:Label ID="consumerLabel" Font-Bold="true" + runat="server" Text="[consumer]" /> wants access to your <asp:Label ID="desiredAccessLabel" + Font-Bold="true" runat="server" Text="[protected resource]" />. </p> + <p>Do you want to allow this? </p> + <div style="display: none" id="responseButtonsDiv"> + <asp:Button ID="allowAccessButton" runat="server" Text="Yes" OnClick="allowAccessButton_Click" /> + <asp:Button ID="denyAccessButton" runat="server" Text="No" OnClick="denyAccessButton_Click" /> + </div> + <div id="javascriptDisabled"> + <b>Javascript appears to be disabled in your browser. </b>This page requires Javascript + to be enabled to better protect your security. + </div> + <p>If you grant access now, you can revoke it at any time by returning to this page. + </p> + <asp:Panel runat="server" BackColor="Red" ForeColor="White" Font-Bold="true" Visible="false" ID="OAuth10ConsumerWarning"> + This website is registered with service_PROVIDER_DOMAIN_NAME to make authorization requests, but has not been configured to send requests securely. If you grant access but you did not initiate this request at consumer_DOMAIN_NAME, it may be possible for other users of consumer_DOMAIN_NAME to access your data. We recommend you deny access unless you are certain that you initiated this request directly with consumer_DOMAIN_NAME. + </asp:Panel> + <script language="javascript" type="text/javascript"> + //<![CDATA[ + // we use HTML to hide the action buttons and Javascript to show them + // to protect against click-jacking in an iframe whose javascript is disabled. + document.getElementById('responseButtonsDiv').style.display = 'block'; + document.getElementById('javascriptDisabled').style.display = 'none'; + + // Frame busting code (to protect us from being hosted in an iframe). + // This protects us from click-jacking. + if (document.location !== window.top.location) { + window.top.location = document.location; + } + //]]> + </script> + </asp:View> + <asp:View runat="server"> + <p>Authorization has been granted.</p> + <asp:MultiView runat="server" ID="verifierMultiView" ActiveViewIndex="0"> + <asp:View runat="server"> + <p>You must enter this verification code at the Consumer: <asp:Label runat="server" + ID="verificationCodeLabel" /> </p> + </asp:View> + <asp:View ID="View1" runat="server"> + <p>You may now close this window and return to the Consumer. </p> + </asp:View> + </asp:MultiView> + </asp:View> + <asp:View runat="server"> + <p>Authorization has been denied. You're free to do whatever now. </p> + </asp:View> + </asp:MultiView> +</asp:Content> diff --git a/src/OAuth/OAuthServiceProvider/Members/Authorize.aspx.cs b/src/OAuth/OAuthServiceProvider/Members/Authorize.aspx.cs new file mode 100644 index 0000000..faa2147 --- /dev/null +++ b/src/OAuth/OAuthServiceProvider/Members/Authorize.aspx.cs @@ -0,0 +1,80 @@ +namespace OAuthServiceProvider { + using System; + using System.Collections.Generic; + using System.Linq; + using System.Security.Cryptography; + using System.Web; + using System.Web.UI; + using System.Web.UI.WebControls; + using DotNetOpenAuth; + using DotNetOpenAuth.OAuth; + using DotNetOpenAuth.OAuth.Messages; + using OAuthServiceProvider.Code; + + /// <summary> + /// Conducts the user through a Consumer authorization process. + /// </summary> + public partial class Authorize : System.Web.UI.Page { + private static readonly RandomNumberGenerator CryptoRandomDataGenerator = new RNGCryptoServiceProvider(); + + private string AuthorizationSecret { + get { return Session["OAuthAuthorizationSecret"] as string; } + set { Session["OAuthAuthorizationSecret"] = value; } + } + + protected void Page_Load(object sender, EventArgs e) { + if (!IsPostBack) { + if (Global.PendingOAuthAuthorization == null) { + Response.Redirect("~/Members/AuthorizedConsumers.aspx"); + } else { + ITokenContainingMessage pendingToken = Global.PendingOAuthAuthorization; + var token = Global.DataContext.OAuthTokens.Single(t => t.Token == pendingToken.Token); + this.desiredAccessLabel.Text = token.Scope; + this.consumerLabel.Text = Global.TokenManager.GetConsumerForToken(token.Token).ConsumerKey; + + // Generate an unpredictable secret that goes to the user agent and must come back + // with authorization to guarantee the user interacted with this page rather than + // being scripted by an evil Consumer. + byte[] randomData = new byte[8]; + CryptoRandomDataGenerator.GetBytes(randomData); + this.AuthorizationSecret = Convert.ToBase64String(randomData); + this.OAuthAuthorizationSecToken.Value = this.AuthorizationSecret; + + this.OAuth10ConsumerWarning.Visible = Global.PendingOAuthAuthorization.IsUnsafeRequest; + } + } + } + + protected void allowAccessButton_Click(object sender, EventArgs e) { + if (this.AuthorizationSecret != this.OAuthAuthorizationSecToken.Value) { + throw new ArgumentException(); // probably someone trying to hack in. + } + this.AuthorizationSecret = null; // clear one time use secret + var pending = Global.PendingOAuthAuthorization; + Global.AuthorizePendingRequestToken(); + this.multiView.ActiveViewIndex = 1; + + ServiceProvider sp = new ServiceProvider(Constants.SelfDescription, Global.TokenManager); + var response = sp.PrepareAuthorizationResponse(pending); + if (response != null) { + sp.Channel.Send(response); + } else { + if (pending.IsUnsafeRequest) { + this.verifierMultiView.ActiveViewIndex = 1; + } else { + string verifier = ServiceProvider.CreateVerificationCode(VerificationCodeFormat.AlphaNumericNoLookAlikes, 10); + this.verificationCodeLabel.Text = verifier; + ITokenContainingMessage requestTokenMessage = pending; + var requestToken = Global.TokenManager.GetRequestToken(requestTokenMessage.Token); + requestToken.VerificationCode = verifier; + Global.TokenManager.UpdateToken(requestToken); + } + } + } + + protected void denyAccessButton_Click(object sender, EventArgs e) { + // erase the request token. + this.multiView.ActiveViewIndex = 2; + } + } +}
\ No newline at end of file diff --git a/src/OAuth/OAuthServiceProvider/Members/Authorize.aspx.designer.cs b/src/OAuth/OAuthServiceProvider/Members/Authorize.aspx.designer.cs new file mode 100644 index 0000000..8aaf94d --- /dev/null +++ b/src/OAuth/OAuthServiceProvider/Members/Authorize.aspx.designer.cs @@ -0,0 +1,105 @@ +//------------------------------------------------------------------------------ +// <auto-generated> +// This code was generated by a tool. +// +// Changes to this file may cause incorrect behavior and will be lost if +// the code is regenerated. +// </auto-generated> +//------------------------------------------------------------------------------ + +namespace OAuthServiceProvider { + + + public partial class Authorize { + + /// <summary> + /// multiView control. + /// </summary> + /// <remarks> + /// Auto-generated field. + /// To modify move field declaration from designer file to code-behind file. + /// </remarks> + protected global::System.Web.UI.WebControls.MultiView multiView; + + /// <summary> + /// OAuthAuthorizationSecToken control. + /// </summary> + /// <remarks> + /// Auto-generated field. + /// To modify move field declaration from designer file to code-behind file. + /// </remarks> + protected global::System.Web.UI.WebControls.HiddenField OAuthAuthorizationSecToken; + + /// <summary> + /// consumerLabel control. + /// </summary> + /// <remarks> + /// Auto-generated field. + /// To modify move field declaration from designer file to code-behind file. + /// </remarks> + protected global::System.Web.UI.WebControls.Label consumerLabel; + + /// <summary> + /// desiredAccessLabel control. + /// </summary> + /// <remarks> + /// Auto-generated field. + /// To modify move field declaration from designer file to code-behind file. + /// </remarks> + protected global::System.Web.UI.WebControls.Label desiredAccessLabel; + + /// <summary> + /// allowAccessButton control. + /// </summary> + /// <remarks> + /// Auto-generated field. + /// To modify move field declaration from designer file to code-behind file. + /// </remarks> + protected global::System.Web.UI.WebControls.Button allowAccessButton; + + /// <summary> + /// denyAccessButton control. + /// </summary> + /// <remarks> + /// Auto-generated field. + /// To modify move field declaration from designer file to code-behind file. + /// </remarks> + protected global::System.Web.UI.WebControls.Button denyAccessButton; + + /// <summary> + /// OAuth10ConsumerWarning control. + /// </summary> + /// <remarks> + /// Auto-generated field. + /// To modify move field declaration from designer file to code-behind file. + /// </remarks> + protected global::System.Web.UI.WebControls.Panel OAuth10ConsumerWarning; + + /// <summary> + /// verifierMultiView control. + /// </summary> + /// <remarks> + /// Auto-generated field. + /// To modify move field declaration from designer file to code-behind file. + /// </remarks> + protected global::System.Web.UI.WebControls.MultiView verifierMultiView; + + /// <summary> + /// verificationCodeLabel control. + /// </summary> + /// <remarks> + /// Auto-generated field. + /// To modify move field declaration from designer file to code-behind file. + /// </remarks> + protected global::System.Web.UI.WebControls.Label verificationCodeLabel; + + /// <summary> + /// View1 control. + /// </summary> + /// <remarks> + /// Auto-generated field. + /// To modify move field declaration from designer file to code-behind file. + /// </remarks> + protected global::System.Web.UI.WebControls.View View1; + } +} diff --git a/src/OAuth/OAuthServiceProvider/Members/AuthorizedConsumers.aspx b/src/OAuth/OAuthServiceProvider/Members/AuthorizedConsumers.aspx new file mode 100644 index 0000000..3506eb9 --- /dev/null +++ b/src/OAuth/OAuthServiceProvider/Members/AuthorizedConsumers.aspx @@ -0,0 +1,6 @@ +<%@ Page Title="" Language="C#" MasterPageFile="~/MasterPage.master" AutoEventWireup="true" Inherits="OAuthServiceProvider.AuthorizedConsumers" Codebehind="AuthorizedConsumers.aspx.cs" %> + +<asp:Content ID="Content2" ContentPlaceHolderID="Body" runat="Server"> + <h2>The following consumers have access to your data</h2> + <p>TODO</p> +</asp:Content> diff --git a/src/OAuth/OAuthServiceProvider/Members/AuthorizedConsumers.aspx.cs b/src/OAuth/OAuthServiceProvider/Members/AuthorizedConsumers.aspx.cs new file mode 100644 index 0000000..fe647a8 --- /dev/null +++ b/src/OAuth/OAuthServiceProvider/Members/AuthorizedConsumers.aspx.cs @@ -0,0 +1,17 @@ +namespace OAuthServiceProvider { + using System; + using System.Collections.Generic; + using System.Linq; + using System.Web; + using System.Web.UI; + using System.Web.UI.WebControls; + + /// <summary> + /// Lists the consumers that have active request or access tokens + /// and provides a mechanism for the user to revoke permissions. + /// </summary> + public partial class AuthorizedConsumers : System.Web.UI.Page { + protected void Page_Load(object sender, EventArgs e) { + } + } +}
\ No newline at end of file diff --git a/src/OAuth/OAuthServiceProvider/Members/AuthorizedConsumers.aspx.designer.cs b/src/OAuth/OAuthServiceProvider/Members/AuthorizedConsumers.aspx.designer.cs new file mode 100644 index 0000000..419c114 --- /dev/null +++ b/src/OAuth/OAuthServiceProvider/Members/AuthorizedConsumers.aspx.designer.cs @@ -0,0 +1,15 @@ +//------------------------------------------------------------------------------ +// <auto-generated> +// This code was generated by a tool. +// +// Changes to this file may cause incorrect behavior and will be lost if +// the code is regenerated. +// </auto-generated> +//------------------------------------------------------------------------------ + +namespace OAuthServiceProvider { + + + public partial class AuthorizedConsumers { + } +} diff --git a/src/OAuth/OAuthServiceProvider/Members/Logoff.aspx b/src/OAuth/OAuthServiceProvider/Members/Logoff.aspx new file mode 100644 index 0000000..afa9dd9 --- /dev/null +++ b/src/OAuth/OAuthServiceProvider/Members/Logoff.aspx @@ -0,0 +1,8 @@ +<%@ Page Title="Log off" Language="C#" MasterPageFile="~/MasterPage.master" %> + +<script runat="server"> + private void Page_Load(object sender, EventArgs e) { + FormsAuthentication.SignOut(); + Response.Redirect("~/"); + } +</script> diff --git a/src/OAuth/OAuthServiceProvider/Members/Web.config b/src/OAuth/OAuthServiceProvider/Members/Web.config new file mode 100644 index 0000000..50fab27 --- /dev/null +++ b/src/OAuth/OAuthServiceProvider/Members/Web.config @@ -0,0 +1,8 @@ +<?xml version="1.0"?> +<configuration> + <system.web> + <authorization> + <deny users="?"/> + </authorization> + </system.web> +</configuration> |