Εφαρμόστε την εκχωρημένη ροή του OAUTH 2.0 Token Exchange μεταξύ ενός Azure AD API και ενός API που προστατεύεται με χρήση OpenIddict

public async Task<List<string>> GetApiDataAsync(string aadAccessToken)
{
	try
	{
		var client = _clientFactory.CreateClient();

		client.BaseAddress = new Uri(
			_downstreamApi.Value.ApiBaseAddress);

		var access_token = await _apiTokenClient
			.GetApiTokenOauthGrantTokenExchange
		(
			_downstreamApi.Value.ClientId,
			_downstreamApi.Value.Audience,
			_downstreamApi.Value.ScopeForAccessToken,
			_downstreamApi.Value.ClientSecret,
			aadAccessToken
		);

		client.SetBearerToken(access_token);

		var response = await client.GetAsync("api/values");
		if (response.IsSuccessStatusCode)
		{
			var data = await JsonSerializer
				.DeserializeAsync<List<string>>(
			await response.Content.ReadAsStreamAsync());

			if(data != null)
				return data;

			return new List<string>();
		}

		throw new ApplicationException($"Status code: {response.StatusCode}, 
			Error: {response.ReasonPhrase}");
	}
	catch (Exception e)
	{
		throw new ApplicationException($"Exception {e}");
	}
}

private async Task<AccessTokenItem> GetApiTokenOauthGrantTokenExchangeAad(
	string clientId, 
	string audience,
	string scope, 
	string clientSecret, 
	string aadAccessToken)
{
	var tokenExchangeHttpClient = _httpClientFactory.CreateClient();
	tokenExchangeHttpClient.BaseAddress = new Uri(
		_downstreamApiConfigurations.Value.IdentityProviderUrl);

	var tokenExchangeSuccessResponse = await RequestDelegatedAccessToken
		.GetDelegatedApiTokenTokenExchange(
			new GetDelegatedApiTokenOAuthTokenExchangeModel
			{
				Scope = scope,
				AccessToken = aadAccessToken,
				ClientSecret = clientSecret,
				Audience = audience,
				ClientId = clientId,
				EndpointUrl = "/connect/oauthTokenExchangetoken",
				GrantExchangeHttpClient = tokenExchangeHttpClient
			}, _logger);

	if (tokenExchangeSuccessResponse != null)
	{
		return new AccessTokenItem
		{
			ExpiresIn = DateTime.UtcNow
				.AddSeconds(tokenExchangeSuccessResponse.expires_in),
			AccessToken = tokenExchangeSuccessResponse.access_token
		};
	}

	_logger.LogError(
		"no success response from oauth token exchange access token request");
	throw new ApplicationException(
		"no success response from oauth token exchange access token request");
}

public static async Task<OauthTokenExchangeSuccessResponse?> GetDelegatedApiTokenTokenExchange(
	GetDelegatedApiTokenOAuthTokenExchangeModel reqData, ILogger logger)
{
	if (reqData.GrantExchangeHttpClient == null)
		throw new ArgumentException("Httpclient missing, is null");

	string credentials = CreateBasicAuthenticationHeader(reqData);

	reqData.GrantExchangeHttpClient.DefaultRequestHeaders.Authorization =
		new AuthenticationHeaderValue("Basic", credentials);

	KeyValuePair<string, string>[] oauthTokenExchangeBody = CreateTokenExchangeBody(reqData);

	var response = await reqData.GrantExchangeHttpClient.PostAsync(reqData.EndpointUrl,
		new FormUrlEncodedContent(oauthTokenExchangeBody));

	if (response.IsSuccessStatusCode)
	{
		var tokenResponse = await JsonSerializer.DeserializeAsync<OauthTokenExchangeSuccessResponse>(
		await response.Content.ReadAsStreamAsync());
		return tokenResponse;
	}

	if (response.StatusCode == System.Net.HttpStatusCode.Unauthorized)
	{
		// Unauthorized error
		var errorResult = await JsonSerializer.DeserializeAsync<OauthTokenExchangeErrorResponse>(
	   await response.Content.ReadAsStreamAsync());

		if (errorResult != null)
		{
			logger.LogInformation("{error} {error_description} {correlation_id} {trace_id}",
				errorResult.error,
				errorResult.error_description,
				errorResult.correlation_id,
				errorResult.trace_id);
		}
		else
		{
			logger.LogInformation("RequestDelegatedAccessToken Error, Unauthorized unknown reason");
		}
	}
	else
	{
		// unknown error, log
		logger.LogInformation("RequestDelegatedAccessToken Error unknown reason");
	}

	return null;
}

private static KeyValuePair<string, string>[] CreateTokenExchangeBody(
	GetDelegatedApiTokenOAuthTokenExchangeModel reqData)
{
	// Content-Type: application/x-www-form-urlencoded
	var oauthTokenExchangeBody = new[]
	{
		new KeyValuePair<string, string>("grant_type", 
			OAuthGrantExchangeConsts.GRANT_TYPE),
		new KeyValuePair<string, string>("audience", reqData.Audience),
		new KeyValuePair<string, string>("subject_token_type", 
			OAuthGrantExchangeConsts.TOKEN_TYPE_ACCESS_TOKEN),
		new KeyValuePair<string, string>("subject_token", reqData.AccessToken),
		new KeyValuePair<string, string>("scope", reqData.Scope)

		// new KeyValuePair<string, string>("resource", "--optional--")
		// new KeyValuePair<string, string>("requested_token_type", "--optional--")
		// new KeyValuePair<string, string>("actor_token", "--optional--")
		// new KeyValuePair<string, string>("actor_token_type", "--optional--")
	};

	return oauthTokenExchangeBody;
}

public class OAuthGrantExchangeConsts
{
    public const string TOKEN_TYPE_ACCESS_TOKEN = "urn:ietf:params:oauth:token-type:access_token";
    public const string TOKEN_TYPE_REFRESH_TOKEN = "urn:ietf:params:oauth:token-type:refresh_token";
    public const string TOKEN_TYPE_ID_TOKEN = "urn:ietf:params:oauth:token-type:id_token";
    public const string TOKEN_TYPE_SAML1 = "urn:ietf:params:oauth:token-type:saml1";
    public const string TOKEN_TYPE_SAML2 = "urn:ietf:params:oauth:token-type:saml2";

    public const string GRANT_TYPE = "urn:ietf:params:oauth:grant-type:token-exchange";

    public const string ERROR_INVALID_REQUEST = "invalid_request";
    public const string ERROR_INVALID_CLIENT = "invalid_client";
    public const string ERROR_INVALID_GRANT = "invalid_grant";
    public const string ERROR_UNAUTHORIZED_CLIENT = "unauthorized_client";
    public const string ERROR_UNSUPPORTED_GRANT_TYPE = "unsupported_grant_type";
    public const string ERROR_INVALID_SCOPE = "invalid_scope";

    // ... more consts, see the code for the full definitions
}

[Authorize(AuthenticationSchemes = BasicAuthenticationDefaults.AuthenticationScheme)]
[HttpPost("~/connect/oauthTokenExchangetoken"), Produces("application/json")]
public async Task<IActionResult> Exchange([FromForm] OauthTokenExchangePayload oauthTokenExchangePayload)
{
	// Implement validate and create AT logic
}

var (Valid, Reason, Error) = ValidateOauthTokenExchangeRequestPayload
	.IsValid(oauthTokenExchangePayload, 
		_oauthTokenExchangeConfigurationConfiguration);

if(!Valid)
{
	return UnauthorizedValidationParametersFailed(
		oauthTokenExchangePayload, Reason, Error);
}

// get well known endpoints and validate access token sent in the assertion
var configurationManager = new ConfigurationManager<OpenIdConnectConfiguration>(
	_oauthTokenExchangeConfigurationConfiguration.AccessTokenMetadataAddress, 
	new OpenIdConnectConfigurationRetriever());

var wellKnownEndpoints =  await configurationManager
	.GetConfigurationAsync();

var accessTokenValidationResult = 
	ValidateOauthTokenExchangeRequestPayload.ValidateTokenAndSignature(
		oauthTokenExchangePayload.subject_token,
		_oauthTokenExchangeConfigurationConfiguration,
		wellKnownEndpoints.SigningKeys);

if(!accessTokenValidationResult.Valid)
{
	return UnauthorizedValidationTokenAndSignatureFailed(
		oauthTokenExchangePayload, accessTokenValidationResult);
}

public static (bool Valid, string Reason, ClaimsPrincipal? 
	ClaimsPrincipal) ValidateTokenAndSignature(
	string jwtToken, 
	OauthTokenExchangeConfiguration oboConfiguration, 
	ICollection<SecurityKey> signingKeys)
{
	try
	{
		var validationParameters = new TokenValidationParameters
		{
			RequireExpirationTime = true,
			ValidateLifetime = true,
			ClockSkew = TimeSpan.FromMinutes(1),
			RequireSignedTokens = true,
			ValidateIssuerSigningKey = true,
			IssuerSigningKeys = signingKeys,
			ValidateIssuer = true,
			ValidIssuer = oboConfiguration.AccessTokenAuthority,
			ValidateAudience = true, 
			ValidAudience = oboConfiguration.AccessTokenAudience
		};

		ISecurityTokenValidator tokenValidator = new JwtSecurityTokenHandler();

		var claimsPrincipal = tokenValidator
			.ValidateToken(jwtToken, validationParameters, out var _);

		return (true, string.Empty, claimsPrincipal);
	}
	catch (Exception ex)
	{
		return (false, $"Access Token Authorization failed {ex.Message}", null);
	}
}

// get claims from aad token and re use in OpenIddict token
var claimsPrincipal = accessTokenValidationResult.ClaimsPrincipal;

var isDelegatedToken = ValidateOauthTokenExchangeRequestPayload
	.IsDelegatedAadAccessToken(claimsPrincipal);

if (!isDelegatedToken)
{
	return UnauthorizedValidationRequireDelegatedTokenFailed();
}

var name = ValidateOauthTokenExchangeRequestPayload
	.GetPreferredUserName(claimsPrincipal);
var isNameAndEmail = ValidateOauthTokenExchangeRequestPayload
	.IsEmailValid(name);
if(!isNameAndEmail)
{
	return UnauthorizedValidationPrefferedUserNameFailed();
}

// validate user exists
var user = await _userManager.FindByNameAsync(name);
if (user == null)
{
	return UnauthorizedValidationNoUserExistsFailed();
}

public static bool IsDelegatedAadAccessToken(ClaimsPrincipal claimsPrincipal)
{
	// oid if magic MS namespaces not user
	var oid = claimsPrincipal.Claims.FirstOrDefault(t => t.Type == 
		"http://schemas.microsoft.com/identity/claims/objectidentifier");
	// scp if magic MS namespaces not added
	var scp = claimsPrincipal.Claims.FirstOrDefault(t => t.Type 
		== "http://schemas.microsoft.com/identity/claims/scope");

	if (oid != null && scp != null)
	{
		return true;
	}

	oid = claimsPrincipal.Claims.FirstOrDefault(t => t.Type == "oid");
	scp = claimsPrincipal.Claims.FirstOrDefault(t => t.Type == "scp");
	if (oid != null && scp != null)
	{
		return true;
	}

	return false;
}

// use data and return new access token
var (ActiveCertificate, _) = await Startup.GetCertificates(_environment, _configuration);

var tokenData = new CreateDelegatedAccessTokenPayloadModel
{
	Sub = Guid.NewGuid().ToString(),
	ClaimsPrincipal = claimsPrincipal,
	SigningCredentials = ActiveCertificate,
	Scope = _oauthTokenExchangeConfigurationConfiguration.ScopeForNewAccessToken,
	Audience = _oauthTokenExchangeConfigurationConfiguration.AudienceForNewAccessToken,
	Issuer = _oauthTokenExchangeConfigurationConfiguration.IssuerForNewAccessToken,
	OriginalClientId = _oauthTokenExchangeConfigurationConfiguration.AccessTokenAudience
};

var accessToken = CreateDelegatedAccessTokenPayload.GenerateJwtTokenAsync(tokenData);

_logger.LogInformation("OBO new access token returned sub {sub}", tokenData.Sub);

if(IdentityModelEventSource.ShowPII)
{
	_logger.LogDebug("OBO new access token returned for sub {sub} for user {Username}", tokenData.Sub,
		ValidateOauthTokenExchangeRequestPayload.GetPreferredUserName(claimsPrincipal));
}

return Ok(new OauthTokenExchangeSuccessResponse
{
	expires_in = 60 * 60,
	access_token = accessToken,
	scope = oauthTokenExchangePayload.scope
});

public static string GenerateJwtTokenAsync(CreateDelegatedAccessTokenPayloadModel payload)
{
	SigningCredentials signingCredentials = new X509SigningCredentials(payload.SigningCredentials);

	var alg = signingCredentials.Algorithm;

	//{
	//  "alg": "RS256",
	//  "kid": "....",
	//  "typ": "at+jwt",
	//}

	var subject = new ClaimsIdentity(new[] {
			new Claim("sub", payload.Sub),              
			new Claim("scope", payload.Scope),
			new Claim("act", $"{{ \"sub\": \"{payload.OriginalClientId}\" }}", JsonClaimValueTypes.Json )
		});

	if(payload.ClaimsPrincipal != null)
	{
		var name = ValidateOauthTokenExchangeRequestPayload.GetPreferredUserName(payload.ClaimsPrincipal);
		var azp = ValidateOauthTokenExchangeRequestPayload.GetAzp(payload.ClaimsPrincipal);
		var azpacr = ValidateOauthTokenExchangeRequestPayload.GetAzpacr(payload.ClaimsPrincipal);

		if(!string.IsNullOrEmpty(name))
			subject.AddClaim(new Claim("name", name));

		if (!string.IsNullOrEmpty(name))
			subject.AddClaim(new Claim("azp", azp));

		if (!string.IsNullOrEmpty(name))
			subject.AddClaim(new Claim("azpacr", azpacr));
	}

	var tokenHandler = new JwtSecurityTokenHandler();
	var tokenDescriptor = new SecurityTokenDescriptor
	{       
		Subject = subject,
		Expires = DateTime.UtcNow.AddHours(1),
		IssuedAt = DateTime.UtcNow,
		Issuer = "https://localhost:44318/",
		Audience = payload.Audience,
		SigningCredentials = signingCredentials,
		TokenType = "at+jwt"
	};

	tokenDescriptor.AdditionalHeaderClaims ??= new Dictionary<string, object>();

	if (!tokenDescriptor.AdditionalHeaderClaims.ContainsKey("alg"))
	{
		tokenDescriptor.AdditionalHeaderClaims.Add("alg", alg);
	}

	var token = tokenHandler.CreateToken(tokenDescriptor);

	return tokenHandler.WriteToken(token);
}