mirror of
https://github.com/dotnet/MQTTnet.git
synced 2026-10-18 02:13:00 +08:00
Add authorization for MQTTnet.Server
This commit is contained in:
Christian Kratky
@@ -0,0 +1,111 @@
|
||||
using System;
|
||||
using System.IO;
|
||||
using System.Net.Http.Headers;
|
||||
using System.Security.Claims;
|
||||
using System.Text;
|
||||
using System.Text.Encodings.Web;
|
||||
using System.Threading.Tasks;
|
||||
using IronPython.Runtime;
|
||||
using Microsoft.AspNetCore.Authentication;
|
||||
using Microsoft.Extensions.Logging;
|
||||
using Microsoft.Extensions.Options;
|
||||
using Microsoft.Net.Http.Headers;
|
||||
using Microsoft.Scripting;
|
||||
|
||||
namespace MQTTnet.Server.Web
|
||||
{
|
||||
public class AuthenticationHandler : AuthenticationHandler<AuthenticationSchemeOptions>
|
||||
{
|
||||
private readonly ILogger<AuthenticationHandler> _logger;
|
||||
|
||||
public AuthenticationHandler(IOptionsMonitor<AuthenticationSchemeOptions> options, ILoggerFactory loggerFactory, UrlEncoder encoder, ISystemClock clock, ILogger<AuthenticationHandler> logger)
|
||||
: base(options, loggerFactory, encoder, clock)
|
||||
{
|
||||
_logger = logger ?? throw new ArgumentNullException(nameof(logger));
|
||||
}
|
||||
|
||||
protected override async Task<AuthenticateResult> HandleAuthenticateAsync()
|
||||
{
|
||||
await Task.CompletedTask;
|
||||
|
||||
if (!Request.Headers.ContainsKey(HeaderNames.Authorization))
|
||||
{
|
||||
return AuthenticateResult.Fail("Missing Authorization Header");
|
||||
}
|
||||
|
||||
try
|
||||
{
|
||||
var headerValue = Request.Headers[HeaderNames.Authorization];
|
||||
var parsedHeaderValue = AuthenticationHeaderValue.Parse(Request.Headers[HeaderNames.Authorization]);
|
||||
|
||||
var scheme = parsedHeaderValue.Scheme;
|
||||
var parameter = parsedHeaderValue.Parameter;
|
||||
string username = null;
|
||||
string password = null;
|
||||
|
||||
if (scheme.Equals("Basic", StringComparison.OrdinalIgnoreCase))
|
||||
{
|
||||
var credentialBytes = Convert.FromBase64String(parsedHeaderValue.Parameter);
|
||||
var credentials = Encoding.UTF8.GetString(credentialBytes).Split(':');
|
||||
username = credentials[0];
|
||||
password = credentials[1];
|
||||
}
|
||||
|
||||
var context = new PythonDictionary
|
||||
{
|
||||
["header_value"] = headerValue,
|
||||
["scheme"] = scheme,
|
||||
["parameter"] = parameter,
|
||||
["username"] = username,
|
||||
["password"] = password,
|
||||
["is_authenticated"] = false
|
||||
};
|
||||
|
||||
if (!ValidateUser(context))
|
||||
{
|
||||
return AuthenticateResult.Fail("Invalid credentials.");
|
||||
}
|
||||
|
||||
var claims = new[]
|
||||
{
|
||||
new Claim(ClaimTypes.NameIdentifier, context.get("username") as string ?? string.Empty)
|
||||
};
|
||||
|
||||
var identity = new ClaimsIdentity(claims, Scheme.Name);
|
||||
var principal = new ClaimsPrincipal(identity);
|
||||
var ticket = new AuthenticationTicket(principal, Scheme.Name);
|
||||
|
||||
return AuthenticateResult.Success(ticket);
|
||||
}
|
||||
catch (Exception exception)
|
||||
{
|
||||
_logger.LogWarning("Error while authenticating user.", exception);
|
||||
|
||||
return AuthenticateResult.Fail(exception);
|
||||
}
|
||||
}
|
||||
|
||||
private bool ValidateUser(PythonDictionary context)
|
||||
{
|
||||
var handlerPath = Path.Combine(AppDomain.CurrentDomain.BaseDirectory, "Web", "authorization_handler.py");
|
||||
if (!File.Exists(handlerPath))
|
||||
{
|
||||
return false;
|
||||
}
|
||||
|
||||
var code = File.ReadAllText(handlerPath);
|
||||
|
||||
var scriptEngine = IronPython.Hosting.Python.CreateEngine();
|
||||
//scriptEngine.Runtime.IO.SetOutput(new PythonIOStream(_logger.), Encoding.UTF8);
|
||||
|
||||
var scriptScope = scriptEngine.CreateScope();
|
||||
var scriptSource = scriptScope.Engine.CreateScriptSourceFromString(code, SourceCodeKind.File);
|
||||
var compiledCode = scriptSource.Compile();
|
||||
compiledCode.Execute(scriptScope);
|
||||
var function = scriptScope.Engine.Operations.GetMember<PythonFunction>(scriptScope, "handle_authenticate");
|
||||
scriptScope.Engine.Operations.Invoke(function, context);
|
||||
|
||||
return context.get("is_authenticated", false) as bool? == true;
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,20 @@
|
||||
using System;
|
||||
using System.IO;
|
||||
using System.Text;
|
||||
using Microsoft.AspNetCore.Http;
|
||||
|
||||
namespace MQTTnet.Server.Web
|
||||
{
|
||||
public static class Extensions
|
||||
{
|
||||
public static string ReadBodyAsString(this HttpRequest request)
|
||||
{
|
||||
if (request == null) throw new ArgumentNullException(nameof(request));
|
||||
|
||||
using (var reader = new StreamReader(request.Body, Encoding.UTF8))
|
||||
{
|
||||
return reader.ReadToEnd();
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,213 @@
|
||||
using System;
|
||||
using System.Collections.Generic;
|
||||
using System.Linq;
|
||||
using Microsoft.AspNetCore.Authentication;
|
||||
using Microsoft.AspNetCore.Builder;
|
||||
using Microsoft.AspNetCore.Hosting;
|
||||
using Microsoft.AspNetCore.Mvc;
|
||||
using Microsoft.Extensions.Configuration;
|
||||
using Microsoft.Extensions.DependencyInjection;
|
||||
using Microsoft.Net.Http.Headers;
|
||||
using Microsoft.OpenApi.Models;
|
||||
using Microsoft.Scripting.Utils;
|
||||
using MQTTnet.Server.Configuration;
|
||||
using MQTTnet.Server.Logging;
|
||||
using MQTTnet.Server.Mqtt;
|
||||
using MQTTnet.Server.Scripting;
|
||||
using MQTTnet.Server.Scripting.DataSharing;
|
||||
using Swashbuckle.AspNetCore.SwaggerUI;
|
||||
|
||||
namespace MQTTnet.Server.Web
|
||||
{
|
||||
public class Startup
|
||||
{
|
||||
public Startup(IConfiguration configuration)
|
||||
{
|
||||
var builder = new ConfigurationBuilder()
|
||||
.AddJsonFile("appsettings.json")
|
||||
.AddEnvironmentVariables();
|
||||
|
||||
Configuration = builder.Build();
|
||||
}
|
||||
|
||||
public IConfigurationRoot Configuration { get; }
|
||||
|
||||
public void Configure(
|
||||
IApplicationBuilder application,
|
||||
IHostingEnvironment environment,
|
||||
MqttServerService mqttServerService,
|
||||
PythonScriptHostService pythonScriptHostService,
|
||||
DataSharingService dataSharingService,
|
||||
MqttSettingsModel mqttSettings)
|
||||
{
|
||||
if (environment.IsDevelopment())
|
||||
{
|
||||
application.UseDeveloperExceptionPage();
|
||||
}
|
||||
else
|
||||
{
|
||||
application.UseHsts();
|
||||
}
|
||||
|
||||
application.UseCors(x => x
|
||||
.AllowAnyOrigin()
|
||||
.AllowAnyMethod()
|
||||
.AllowAnyHeader()
|
||||
.AllowCredentials());
|
||||
|
||||
application.UseAuthentication();
|
||||
|
||||
application.UseStaticFiles();
|
||||
|
||||
application.UseHttpsRedirection();
|
||||
application.UseMvc();
|
||||
|
||||
ConfigureWebSocketEndpoint(application, mqttServerService, mqttSettings);
|
||||
|
||||
dataSharingService.Configure();
|
||||
pythonScriptHostService.Configure();
|
||||
|
||||
mqttServerService.Configure();
|
||||
|
||||
application.UseSwagger(o => o.RouteTemplate = "/api/{documentName}/swagger.json");
|
||||
|
||||
application.UseSwaggerUI(o =>
|
||||
{
|
||||
o.RoutePrefix = "api";
|
||||
o.DocumentTitle = "MQTTnet.Server API";
|
||||
o.SwaggerEndpoint("/api/v1/swagger.json", "MQTTnet.Server API v1");
|
||||
o.DisplayRequestDuration();
|
||||
o.DocExpansion(DocExpansion.List);
|
||||
o.DefaultModelRendering(ModelRendering.Model);
|
||||
});
|
||||
}
|
||||
|
||||
public void ConfigureServices(IServiceCollection services)
|
||||
{
|
||||
services.AddCors();
|
||||
|
||||
services.AddMvc()
|
||||
.SetCompatibilityVersion(CompatibilityVersion.Version_2_2)
|
||||
.AddJsonOptions(options =>
|
||||
{
|
||||
options.SerializerSettings.Converters.Add(new Newtonsoft.Json.Converters.StringEnumConverter());
|
||||
});
|
||||
|
||||
ReadMqttSettings(services);
|
||||
|
||||
services.AddSingleton<PythonIOStream>();
|
||||
services.AddSingleton<PythonScriptHostService>();
|
||||
services.AddSingleton<DataSharingService>();
|
||||
|
||||
services.AddSingleton<MqttNetLoggerWrapper>();
|
||||
services.AddSingleton<CustomMqttFactory>();
|
||||
services.AddSingleton<MqttServerService>();
|
||||
services.AddSingleton<MqttServerStorage>();
|
||||
|
||||
services.AddSingleton<MqttClientConnectedHandler>();
|
||||
services.AddSingleton<MqttClientDisconnectedHandler>();
|
||||
services.AddSingleton<MqttClientSubscribedTopicHandler>();
|
||||
services.AddSingleton<MqttClientUnsubscribedTopicHandler>();
|
||||
services.AddSingleton<MqttConnectionValidator>();
|
||||
services.AddSingleton<MqttSubscriptionInterceptor>();
|
||||
services.AddSingleton<MqttApplicationMessageInterceptor>();
|
||||
|
||||
services.AddSwaggerGen(c =>
|
||||
{
|
||||
c.DescribeAllEnumsAsStrings();
|
||||
c.AddSecurityDefinition("Basic", new OpenApiSecurityScheme
|
||||
{
|
||||
Scheme = "Basic",
|
||||
Name = HeaderNames.Authorization,
|
||||
Type = SecuritySchemeType.Http,
|
||||
In = ParameterLocation.Header
|
||||
});
|
||||
c.AddSecurityRequirement(new OpenApiSecurityRequirement
|
||||
{
|
||||
[new OpenApiSecurityScheme { Name = "Basic" }] = new List<string>()
|
||||
});
|
||||
c.SwaggerDoc("v1", new OpenApiInfo
|
||||
{
|
||||
Title = "MQTTnet.Server API",
|
||||
Version = "v1",
|
||||
Description = "The public API for the MQTT broker MQTTnet.Server.",
|
||||
License = new OpenApiLicense
|
||||
{
|
||||
Name = "MIT",
|
||||
Url = new Uri("https://github.com/chkr1011/MQTTnet/blob/master/README.md")
|
||||
},
|
||||
Contact = new OpenApiContact
|
||||
{
|
||||
Name = "MQTTnet.Server",
|
||||
Email = string.Empty,
|
||||
Url = new Uri("https://github.com/chkr1011/MQTTnet")
|
||||
},
|
||||
});
|
||||
});
|
||||
|
||||
services.AddAuthentication("Basic").AddScheme<AuthenticationSchemeOptions, AuthenticationHandler>("Basic", null);
|
||||
}
|
||||
|
||||
private void ReadMqttSettings(IServiceCollection services)
|
||||
{
|
||||
var mqttSettings = new MqttSettingsModel();
|
||||
Configuration.Bind("MQTT", mqttSettings);
|
||||
services.AddSingleton(mqttSettings);
|
||||
|
||||
var scriptingSettings = new ScriptingSettingsModel();
|
||||
Configuration.Bind("Scripting", scriptingSettings);
|
||||
services.AddSingleton(scriptingSettings);
|
||||
}
|
||||
|
||||
private static void ConfigureWebSocketEndpoint(
|
||||
IApplicationBuilder application,
|
||||
MqttServerService mqttServerService,
|
||||
MqttSettingsModel mqttSettings)
|
||||
{
|
||||
if (mqttSettings?.WebSocketEndPoint?.Enabled != true)
|
||||
{
|
||||
return;
|
||||
}
|
||||
|
||||
if (string.IsNullOrEmpty(mqttSettings.WebSocketEndPoint.Path))
|
||||
{
|
||||
return;
|
||||
}
|
||||
|
||||
var webSocketOptions = new WebSocketOptions
|
||||
{
|
||||
KeepAliveInterval = TimeSpan.FromSeconds(mqttSettings.WebSocketEndPoint.KeepAliveInterval),
|
||||
ReceiveBufferSize = mqttSettings.WebSocketEndPoint.ReceiveBufferSize
|
||||
};
|
||||
|
||||
if (mqttSettings.WebSocketEndPoint.AllowedOrigins?.Any() == true)
|
||||
{
|
||||
webSocketOptions.AllowedOrigins.AddRange(mqttSettings.WebSocketEndPoint.AllowedOrigins);
|
||||
}
|
||||
|
||||
application.UseWebSockets(webSocketOptions);
|
||||
|
||||
application.Use(async (context, next) =>
|
||||
{
|
||||
if (context.Request.Path == mqttSettings.WebSocketEndPoint.Path)
|
||||
{
|
||||
if (context.WebSockets.IsWebSocketRequest)
|
||||
{
|
||||
using (var webSocket = await context.WebSockets.AcceptWebSocketAsync().ConfigureAwait(false))
|
||||
{
|
||||
await mqttServerService.RunWebSocketConnectionAsync(webSocket, context).ConfigureAwait(false);
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
context.Response.StatusCode = 400;
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
await next().ConfigureAwait(false);
|
||||
}
|
||||
});
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,10 @@
|
||||
def handle_authenticate(context):
|
||||
"""
|
||||
This function is invoked whenever a user tries to access protected HTTP resources.
|
||||
This function must exist and return a proper value. Otherwise the request is denied.
|
||||
"""
|
||||
|
||||
username = context["username"]
|
||||
password = context["password"]
|
||||
|
||||
context["is_authenticated"] = True # Change this to _False_ in case of invalid credentials.
|
||||
Reference in New Issue
Block a user