Change configuration structure

Signed-off-by: Victor Chang <vicchang@nvidia.com>

Author: mocsharp

src/Authentication/Configurations/AuthenticationOptions.cs

@@ -44,7 +44,7 @@ public bool BypassAuth(ILogger logger)
             {
                 throw new InvalidOperationException("OpenId configuration is invalid.");
             }
-            if (OpenId.Claims is null || OpenId.Claims.RequiredUserClaims!.IsNullOrEmpty() || OpenId.Claims.RequiredAdminClaims!.IsNullOrEmpty())
+            if (OpenId.Claims is null || OpenId.Claims.UserClaims!.IsNullOrEmpty() || OpenId.Claims.AdminClaims!.IsNullOrEmpty())
             {
                 throw new InvalidOperationException("No claims defined for OpenId.");
             }

src/Authentication/Configurations/Claims.cs renamed to src/Authentication/Configurations/ClaimMappings.cs

@@ -18,21 +18,24 @@
 
 namespace Monai.Deploy.Security.Authentication.Configurations
 {
-    public class Claims
+    public class ClaimMappings
     {
-        [ConfigurationKeyName("RequiredUserClaims")]
-        public List<Claim>? RequiredUserClaims { get; set; }
+        [ConfigurationKeyName("UserClaims")]
+        public List<ClaimMapping>? UserClaims { get; set; }
 
-        [ConfigurationKeyName("RequiredAdminClaims")]
-        public List<Claim>? RequiredAdminClaims { get; set; }
+        [ConfigurationKeyName("AdminClaims")]
+        public List<ClaimMapping>? AdminClaims { get; set; }
     }
 
-    public class Claim
+    public class ClaimMapping
     {
-        [ConfigurationKeyName("user_roles")]
-        public string? UserRoles { get; set; }
+        [ConfigurationKeyName("claim")]
+        public string Claim { get; set; } = string.Empty;
+
+        [ConfigurationKeyName("role")]
+        public string Role { get; set; } = string.Empty;
 
         [ConfigurationKeyName("endpoints")]
-        public List<string>? Endpoints { get; set; }
+        public List<string>? Endpoints { get; set; } = default;
     }
 }

src/Authentication/Configurations/OpenIdOptions.cs

@@ -29,8 +29,8 @@ public class OpenIdOptions
         [ConfigurationKeyName("ClientId")]
         public string? ClientId { get; set; }
 
-        [ConfigurationKeyName("Claims")]
-        public Claims? Claims { get; set; }
+        [ConfigurationKeyName("ClaimMappings")]
+        public ClaimMappings? Claims { get; set; }
 
         [ConfigurationKeyName("Audiences")]
         public IList<string>? Audiences { get; set; }

src/Authentication/Extensions/AuthKeys.cs

@@ -25,6 +25,5 @@ public static class AuthKeys
 
         // Configuration Keys
         public const string OpenId = "OpenId";
-        public const string UserRoles = "user_roles";
     }
 }

src/Authentication/Extensions/HttpContextExtension.cs

@@ -27,22 +27,22 @@ public static class HttpContextExtension
         /// <param name="httpcontext"></param>
         /// <param name="requiredClaims"></param>
         /// <returns></returns>
-        public static List<string> GetValidEndpoints(this HttpContext httpcontext, List<Configurations.Claim> adminClaims, List<Configurations.Claim> userClaims)
+        public static List<string> GetValidEndpoints(this HttpContext httpcontext, List<Configurations.ClaimMapping> adminClaims, List<Configurations.ClaimMapping> userClaims)
         {
             Guard.Against.Null(adminClaims);
             Guard.Against.Null(userClaims);
 
             foreach (var claim in adminClaims!)
             {
-                if (httpcontext.User.HasClaim(AuthKeys.UserRoles, claim.UserRoles!))
+                if (httpcontext.User.HasClaim(claim.Claim, claim.Role))
                 {
                     return new List<string> { "all" };
                 }
             }
 
             foreach (var claim in userClaims!)
             {
-                if (httpcontext.User.HasClaim(AuthKeys.UserRoles, claim.UserRoles!))
+                if (httpcontext.User.HasClaim(claim.Claim, claim.Role))
                 {
                     return claim.Endpoints!;
                 }

src/Authentication/Middleware/EndpointAuthorizationMiddleware.cs

@@ -56,7 +56,7 @@ public async Task InvokeAsync(HttpContext httpcontext)
                 if (httpcontext.GetRouteValue("controller") is string controller)
                 {
                     _logger.UserAccessingController(httpcontext.User.Identity.Name, controller);
-                    var validEndpoints = httpcontext.GetValidEndpoints(_options.Value.OpenId!.Claims!.RequiredAdminClaims!, _options.Value.OpenId!.Claims!.RequiredUserClaims!);
+                    var validEndpoints = httpcontext.GetValidEndpoints(_options.Value.OpenId!.Claims!.AdminClaims!, _options.Value.OpenId!.Claims!.UserClaims!);
                     var result = validEndpoints.Any(e => e.Equals(controller, StringComparison.InvariantCultureIgnoreCase)) || validEndpoints.Contains("all");
 
                     if (result is false)

src/Authentication/Tests/MockJwtTokenHandler.cs

@@ -17,7 +17,6 @@
 using System.IdentityModel.Tokens.Jwt;
 using System.Text;
 using Microsoft.IdentityModel.Tokens;
-using Monai.Deploy.Security.Authentication.Extensions;
 using Claim = System.Security.Claims.Claim;
 
 namespace Monai.Deploy.Security.Authentication.Tests
@@ -30,7 +29,7 @@ public static class MockJwtTokenHandler
             public static SecurityKey SecurityKey { get; }
             public static SigningCredentials SigningCredentials { get; }
 
-            private static readonly JwtSecurityTokenHandler TokenHandler = new JwtSecurityTokenHandler();
+            private static readonly JwtSecurityTokenHandler TokenHandler = new();
 
             static MockJwtTokenHandler()
             {
@@ -40,7 +39,7 @@ static MockJwtTokenHandler()
 
             public static string GenerateJwtToken(string role)
             {
-                var claims = new[] { new Claim(AuthKeys.UserRoles, role) };
+                var claims = new[] { new Claim("user_roles", role) };
                 return TokenHandler.WriteToken(new JwtSecurityToken(Issuer, "monai-app", claims, null, DateTime.UtcNow.AddMinutes(20), SigningCredentials));
             }
         }

src/Authentication/Tests/test.auth.json

@@ -6,19 +6,24 @@
       "ServerRealmKey": "l9ZRlbMQBt9k1klUUrlWFuke8WbqnEde",
       "Audiences": [ "monai-app" ],
       "ClientId": "monai-app-test",
-      "Claims": {
-        "RequiredUserClaims": [
+      "ClaimMappings": {
+        "UserClaims": [
           {
-            "user_roles": "role-with-test",
+            "claim": "user_roles",
+            "role": "role-with-test",
             "endpoints": [ "test" ]
           },
           {
-            "user_roles": "role-without-test",
+            "claim": "user_roles",
+            "roles": "role-without-test",
             "endpoints": [ "no-test" ]
           }
         ],
-        "RequiredAdminClaims": [
-          { "user_roles": "monai-role-admin" }
+        "AdminClaims": [
+          {
+            "claim": "user_roles",
+            "role": "monai-role-admin"
+          }
         ]
       }
     }

src/Authentication/example.json

@@ -6,19 +6,23 @@
       "ServerRealmKey": "EncryptionKey",
       "ClientId": "monai-app",
       "Audiences": [ "monai-deploy" ],
-      "Claims": {
-        "RequiredUserClaims": [
+      "ClaimMappings": {
+        "UserClaims": [
           {
-            "user_roles": "monai-deploy-users",
-            "endpoints": [ "payloads", "workflows", "workflowinstances", "tasks" ]
+            "claim": "user_roles",
+            "role": "monai-deploy-user",
+            "endpoints": [ "test" ]
           },
           {
             "user_roles": "pacs-admins",
             "endpoints": [ "config" ]
           }
         ],
-        "RequiredAdminClaims": [
-          { "user_roles": "monai-role-admin" }
+        "AdminClaims": [
+          {
+            "claim": "user_roles",
+            "role": "monai-role-admin"
+          }
         ]
       }
     }