From b9f25d547f87a12775585fb8cfae0c77c337f0c9 Mon Sep 17 00:00:00 2001 From: MikeV-TalentConsulting <122601927+MikeV-TalentConsulting@users.noreply.github.com> Date: Mon, 18 Nov 2024 11:01:36 +0000 Subject: [PATCH 1/4] ServiceAccount --- .../Models/AppSettings.cs | 1 + .../Models/ServiceAccount.cs | 12 ++++++++++ .../Program.cs | 4 ++-- .../Providers/UserProvider.cs | 23 +++++++++++++++++-- .../appsettings.json | 7 +++++- 5 files changed, 42 insertions(+), 5 deletions(-) create mode 100644 SFA.DAS.Authorization/SFA.DAS.Authorization.TokenGenerator/SFA.DAS.Authorization.TokenGenerator/Models/ServiceAccount.cs diff --git a/SFA.DAS.Authorization/SFA.DAS.Authorization.TokenGenerator/SFA.DAS.Authorization.TokenGenerator/Models/AppSettings.cs b/SFA.DAS.Authorization/SFA.DAS.Authorization.TokenGenerator/SFA.DAS.Authorization.TokenGenerator/Models/AppSettings.cs index 114fcf8d0..68332ed47 100644 --- a/SFA.DAS.Authorization/SFA.DAS.Authorization.TokenGenerator/SFA.DAS.Authorization.TokenGenerator/Models/AppSettings.cs +++ b/SFA.DAS.Authorization/SFA.DAS.Authorization.TokenGenerator/SFA.DAS.Authorization.TokenGenerator/Models/AppSettings.cs @@ -5,4 +5,5 @@ public class AppSettings public string? UserBearerTokenSigningKey { get; set; } public ProviderUser? ProviderUser { get; set; } public EmployerUser? EmployerUser { get; set; } + public ServiceAccount? ServiceAccount { get; set; } } diff --git a/SFA.DAS.Authorization/SFA.DAS.Authorization.TokenGenerator/SFA.DAS.Authorization.TokenGenerator/Models/ServiceAccount.cs b/SFA.DAS.Authorization/SFA.DAS.Authorization.TokenGenerator/SFA.DAS.Authorization.TokenGenerator/Models/ServiceAccount.cs new file mode 100644 index 000000000..bd5ea7df1 --- /dev/null +++ b/SFA.DAS.Authorization/SFA.DAS.Authorization.TokenGenerator/SFA.DAS.Authorization.TokenGenerator/Models/ServiceAccount.cs @@ -0,0 +1,12 @@ +using System.Text.Json.Serialization; + +namespace SFA.DAS.Authorization.TokenGenerator.Models; + +public class ServiceAccount +{ + [JsonPropertyName("sub")] + public string? Sub { get; set; } + + //[JsonPropertyName("serviceAccount")] + //public string? ServiceAccountId { get; set; } +} diff --git a/SFA.DAS.Authorization/SFA.DAS.Authorization.TokenGenerator/SFA.DAS.Authorization.TokenGenerator/Program.cs b/SFA.DAS.Authorization/SFA.DAS.Authorization.TokenGenerator/SFA.DAS.Authorization.TokenGenerator/Program.cs index 7c9eb0662..f2afc8651 100644 --- a/SFA.DAS.Authorization/SFA.DAS.Authorization.TokenGenerator/SFA.DAS.Authorization.TokenGenerator/Program.cs +++ b/SFA.DAS.Authorization/SFA.DAS.Authorization.TokenGenerator/SFA.DAS.Authorization.TokenGenerator/Program.cs @@ -69,9 +69,9 @@ static List SetUserClaims(AppSettings appSettings) var userType = string.Empty; // Select user type - while (userType != "P" && userType != "E") + while (userType != "P" && userType != "E" && userType !="S") { - Console.WriteLine("Enter P for provider user or E for employer user"); + Console.WriteLine("Enter P for provider user, E for employer user or S for service account"); userType = Console.ReadLine()?.ToUpper(); } diff --git a/SFA.DAS.Authorization/SFA.DAS.Authorization.TokenGenerator/SFA.DAS.Authorization.TokenGenerator/Providers/UserProvider.cs b/SFA.DAS.Authorization/SFA.DAS.Authorization.TokenGenerator/SFA.DAS.Authorization.TokenGenerator/Providers/UserProvider.cs index 650eef99b..917b04075 100644 --- a/SFA.DAS.Authorization/SFA.DAS.Authorization.TokenGenerator/SFA.DAS.Authorization.TokenGenerator/Providers/UserProvider.cs +++ b/SFA.DAS.Authorization/SFA.DAS.Authorization.TokenGenerator/SFA.DAS.Authorization.TokenGenerator/Providers/UserProvider.cs @@ -18,7 +18,9 @@ internal static List GenerateUserClaims(string userType, AppSettings appS return GetProviderUserClaims(appSettings.ProviderUser); case "E": return GetEmployerUserClaims(appSettings.EmployerUser); - } + case "S": + return GetServiceAccountClaims(appSettings.ServiceAccount); + } throw new ArgumentException("Invalid user type"); } @@ -76,7 +78,24 @@ private static List GetProviderUserClaims(ProviderUser? providerUser) return claims; } - private static Claim CreateExpiryClaim() + private static List GetServiceAccountClaims(ServiceAccount? serviceAccount) + { + if (serviceAccount == null) + { + serviceAccount = new ServiceAccount(); + } + + var claims = new List + { + serviceAccount.CreateClaim(x => x.Sub), + //serviceAccount.CreateClaim(x => x.ServiceAccountId), + CreateExpiryClaim() + }; + + return claims; + } + + private static Claim CreateExpiryClaim() { long unixTime = ((DateTimeOffset)DateTime.UtcNow.AddMinutes(5)).ToUnixTimeSeconds(); return new Claim("exp", unixTime.ToString()); diff --git a/SFA.DAS.Authorization/SFA.DAS.Authorization.TokenGenerator/SFA.DAS.Authorization.TokenGenerator/appsettings.json b/SFA.DAS.Authorization/SFA.DAS.Authorization.TokenGenerator/SFA.DAS.Authorization.TokenGenerator/appsettings.json index 489417d40..b88d04514 100644 --- a/SFA.DAS.Authorization/SFA.DAS.Authorization.TokenGenerator/SFA.DAS.Authorization.TokenGenerator/appsettings.json +++ b/SFA.DAS.Authorization/SFA.DAS.Authorization.TokenGenerator/SFA.DAS.Authorization.TokenGenerator/appsettings.json @@ -1,5 +1,6 @@ { "UserBearerTokenSigningKey": "abcdefghijklmnopqrstuv123456789==", + "xxUserBearerTokenSigningKey": "6b8dbd1b-b629-452e-a627-3f87b71b000e", "ProviderUser": { "sub": "ef141707-92fa-40be-b19e-e03b76abce38", "email": "guybrush.threepwood@education.gov.uk", @@ -16,7 +17,7 @@ "rolenumericid": "12345", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "Guybrush Threepwood", "http://schemas.portal.com/displayname": "Guybrush Threepwood", - "http://schemas.portal.com/ukprn": "0", + "http://schemas.portal.com/ukprn": "10005077", "exp": null }, "EmployerUser": { @@ -37,5 +38,9 @@ "http://das/employer/identity/claims/display_name": "John Smith", "http://das/employer/identity/claims/account": "VN48RP", "exp": null + }, + "ServiceAccount": { + "sub": "service-account-id", + "serviceAccount": "Earnings" } } From ef125ea2ca49273718c1ea046beab37771845a93 Mon Sep 17 00:00:00 2001 From: MikeV-TalentConsulting <122601927+MikeV-TalentConsulting@users.noreply.github.com> Date: Tue, 11 Mar 2025 11:04:47 +0000 Subject: [PATCH 2/4] Update appsettings.json --- .../SFA.DAS.Authorization.TokenGenerator/appsettings.json | 1 - 1 file changed, 1 deletion(-) diff --git a/SFA.DAS.Authorization/SFA.DAS.Authorization.TokenGenerator/SFA.DAS.Authorization.TokenGenerator/appsettings.json b/SFA.DAS.Authorization/SFA.DAS.Authorization.TokenGenerator/SFA.DAS.Authorization.TokenGenerator/appsettings.json index b88d04514..3c4695ed0 100644 --- a/SFA.DAS.Authorization/SFA.DAS.Authorization.TokenGenerator/SFA.DAS.Authorization.TokenGenerator/appsettings.json +++ b/SFA.DAS.Authorization/SFA.DAS.Authorization.TokenGenerator/SFA.DAS.Authorization.TokenGenerator/appsettings.json @@ -1,6 +1,5 @@ { "UserBearerTokenSigningKey": "abcdefghijklmnopqrstuv123456789==", - "xxUserBearerTokenSigningKey": "6b8dbd1b-b629-452e-a627-3f87b71b000e", "ProviderUser": { "sub": "ef141707-92fa-40be-b19e-e03b76abce38", "email": "guybrush.threepwood@education.gov.uk", From 0f48b71f411040da0c77e0b34f8577f494545580 Mon Sep 17 00:00:00 2001 From: MikeV-TalentConsulting <122601927+MikeV-TalentConsulting@users.noreply.github.com> Date: Tue, 25 Mar 2025 13:55:46 +0000 Subject: [PATCH 3/4] Update ServiceAccount.cs --- .../Models/ServiceAccount.cs | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/SFA.DAS.Authorization/SFA.DAS.Authorization.TokenGenerator/SFA.DAS.Authorization.TokenGenerator/Models/ServiceAccount.cs b/SFA.DAS.Authorization/SFA.DAS.Authorization.TokenGenerator/SFA.DAS.Authorization.TokenGenerator/Models/ServiceAccount.cs index bd5ea7df1..5a509345c 100644 --- a/SFA.DAS.Authorization/SFA.DAS.Authorization.TokenGenerator/SFA.DAS.Authorization.TokenGenerator/Models/ServiceAccount.cs +++ b/SFA.DAS.Authorization/SFA.DAS.Authorization.TokenGenerator/SFA.DAS.Authorization.TokenGenerator/Models/ServiceAccount.cs @@ -7,6 +7,6 @@ public class ServiceAccount [JsonPropertyName("sub")] public string? Sub { get; set; } - //[JsonPropertyName("serviceAccount")] - //public string? ServiceAccountId { get; set; } + [JsonPropertyName("serviceAccount")] + public string? ServiceAccountId { get; set; } } From 1e274f61acec3c77777325f9b82613b1050bc505 Mon Sep 17 00:00:00 2001 From: MikeV-TalentConsulting <122601927+MikeV-TalentConsulting@users.noreply.github.com> Date: Tue, 25 Mar 2025 13:58:16 +0000 Subject: [PATCH 4/4] Update UserProvider.cs --- .../Providers/UserProvider.cs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/SFA.DAS.Authorization/SFA.DAS.Authorization.TokenGenerator/SFA.DAS.Authorization.TokenGenerator/Providers/UserProvider.cs b/SFA.DAS.Authorization/SFA.DAS.Authorization.TokenGenerator/SFA.DAS.Authorization.TokenGenerator/Providers/UserProvider.cs index 917b04075..d5b0a75e7 100644 --- a/SFA.DAS.Authorization/SFA.DAS.Authorization.TokenGenerator/SFA.DAS.Authorization.TokenGenerator/Providers/UserProvider.cs +++ b/SFA.DAS.Authorization/SFA.DAS.Authorization.TokenGenerator/SFA.DAS.Authorization.TokenGenerator/Providers/UserProvider.cs @@ -88,7 +88,7 @@ private static List GetServiceAccountClaims(ServiceAccount? serviceAccoun var claims = new List { serviceAccount.CreateClaim(x => x.Sub), - //serviceAccount.CreateClaim(x => x.ServiceAccountId), + serviceAccount.CreateClaim(x => x.ServiceAccountId), CreateExpiryClaim() };