fubumvcarchive / fubumvc.authentication Goto Github PK

View Code? Open in Web Editor NEW

0.0 4.0 11.0 8.56 MB

Pluggable authentication for your FubuMVC application

Ruby 0.22% ASP 0.02% C# 65.58% JavaScript 31.11% CSS 3.07%

fubumvc.authentication's Introduction

FubuMVC.Authentication

Provides a pluggable authentication infrastructure for your FubuMVC application.

How do I use it?

Step 1. Simply install it via NuGet:

Install-Package FubuMVC.Authentication

Step 2. Implement the services

If you run as-is, the bottle will blow up on you (on purpose) telling you that you're missing two things: 1) IAuthenticationService and 2) IPrincipalBuilder.

You will need to implement and register both of these custom-tailored services.

Step 3. [Optional] Configuration

If you wish to configure how the Bottle is applied, you can do the following:

Import<ApplyAuthentication>(x => {
	// Explictly state which behavior chains to authenticate
	x.Include(chain => ...);
	
	// Explicitly state which behavior chains to exclude from authentication
	x.Exclude(chain => ...);
	
	// By default, you get ~/login and ~/logout (with extensibility points). Use this method to turn them off.
	// If you use the defaults, just create a view that is typed against FubuMVC.Authentication.LoginRequest.
	x.DoNotIncludeEndpoints();
});

fubumvc.authentication's People

Contributors

Watchers

Forkers

robertthegrey mtscout6 koiralav garylcoxjr ventaur-forks stevematney pedroliska dportzline83 awedekind dovetailsoftware bubdm

fubumvc.authentication's Issues

Add Url and ReturnUrl hidden fields to the default screen

Add an ST test for it.

Change up SimpleCookieTicketSource to have settings injected

Let the settings flow through and specify the cookie attributes (name, domain, etc.)

The Forms bottle needs to declare a dependency on FubuMVC.Core.View

This is to insure that the default login view is only ever used if there is not a custom login view for the application

Add diagnostic tracing to AuthenticationFilter & AuthenticationService

Had a bad case yesterday where it was hard to understand why the new Saml2 bottle wasn't working in combination with a custom authentication strategy. Just a little tracing that would surface on the request tracing page in diagnostics would help a lot.

Do something to clean up the cookies to make the remember me ST test be reliable

Windows authentication will need to be smart enough in its plugin to allow you to reject users

We'll need it on our current project. If the user doesn't have role XYZ, we won't allow them in.

Maybe do it by changing the signature of IWindowsPrincipalHandler

CookieTicketSource needs to do a full on HtmlDecode

I think the decode I found was HttpContext specific so the code in there is just flat out stupid. We need to do a complete decode before the base64 decryption or it's going to blow up in most situations under SelfHost.

FubuMVC.PersistedMembership.User.Get() needs to be graceful about nulls

Calling User.Get() when there's no T blows up. Need a Has() too.

Authentication being forgotten

After logging in, IMembershipRepository is being called as expected, MatchesCredentials is returning true, as soon as you hit a page that requires an authenticated user your redirected back to the login page. The FubuAuthTicket cookie is being created as expected.

Removing the ContentExtensions for FubuMVC 2.0 Support

Validation breaks when applied to Authentication

When using Validation and applying an OverridesFor to LoginRequest, the login landing page displays validation errors without ever having received a form submit.

Removing the old flat file membership for FubuMVC 2.0 Support

Clean up the mechanics so you can replace the IPrincipalBuilder when using WindowsAuthenticatino

Per this thread: https://groups.google.com/forum/?fromgroups=#!topic/fubumvc-devel/VqkVjEFDZkE

Authentication is woefully under-tested from end to end.

Go steal the old Storyteller tests for authentication from Firefly (where this code originated from anyway)

Needs to be easier to swap out the MembershipRepository

See this garbage from Portal:

            //TODO: since FubuMVC.Authentication hard codes the membership node to use MembershipRepository
            //there is no way to extend it, had to do it this way instead
            settings.Strategies.AddToEnd(new MembershipNode(typeof(OurMembershipRepository)));
            settings.Strategies.OfType<MembershipNode>()
                    .Where(x => x.MembershipType == typeof(MembershipAuthentication))
                    .ToArray()
                    .Each(x => x.Remove());

Change the signature of IPasswordHash to accept a User object? Change MembershipRepository

The persisted membership repository needs to get access to the existing User in order to apply Extend Health's super special password hashing

Convenience method to opt out of authentication on all routes

For some sites, opting into authentication for every route might not be the most ideal. In order to remove this functionality, you have to configure the bottle in a way that might not be the most intuitive:

Import<ApplyAuthentication>(authentication =>
{
    authentication.Include(chain => false);
    //Configure routes to include authentication
});

It would be nice to have an option to easily opt out of authentication from all routes and then configure the routes that need to be authenticated.

AuthResult

Success : bool
Continue : FubuContinuation

Log user's IP address in login auditing

From a conversation on the user list w/ Peter Wentzel: https://groups.google.com/forum/?fromgroups=#!topic/fubumvc-devel/43BZc0FGDJQ