From 0a9815d97519316ac5912596aeb644108f4ae3af Mon Sep 17 00:00:00 2001 From: prestoncraw Date: Wed, 3 Jun 2026 15:43:57 -0400 Subject: [PATCH 1/6] Add public const SettingsSection --- .../AuthenticationProviders/OAuthAuthenticationProvider.cs | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/Gemstone.Security/AuthenticationProviders/OAuthAuthenticationProvider.cs b/src/Gemstone.Security/AuthenticationProviders/OAuthAuthenticationProvider.cs index 7d18a4bc..ad1d339b 100644 --- a/src/Gemstone.Security/AuthenticationProviders/OAuthAuthenticationProvider.cs +++ b/src/Gemstone.Security/AuthenticationProviders/OAuthAuthenticationProvider.cs @@ -90,6 +90,9 @@ private class ProviderClaim(string value, string description) : IProviderClaim public string LongDescription => string.Empty; } + //Constants + public const string SettingsSection = "Security.OpenIDConnect"; + #endregion #region [ Constructors ] @@ -161,7 +164,7 @@ private static ClaimType[] ClaimTypes /// public static void DefineSettings(Settings settings) { - dynamic section = settings["Security.OpenIDConnect"]; + dynamic section = settings[SettingsSection]; section.Scopes = ("profile", "Defines the scopes requested from the OpenID Connect provider in a comma sepperated list."); section.ClientId = ("ClientID", "Defines the client ID of the application."); From bd67d3365591dbc1b80d1cb4d7eacd8fa7d75516 Mon Sep 17 00:00:00 2001 From: prestoncraw Date: Fri, 5 Jun 2026 09:21:00 -0400 Subject: [PATCH 2/6] Add DefineSettings method to WindowsProvider --- .../WindowsAuthenticationProvider.cs | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) diff --git a/src/Gemstone.Security/AuthenticationProviders/WindowsAuthenticationProvider.cs b/src/Gemstone.Security/AuthenticationProviders/WindowsAuthenticationProvider.cs index 7fdf3a0e..cb421bb7 100644 --- a/src/Gemstone.Security/AuthenticationProviders/WindowsAuthenticationProvider.cs +++ b/src/Gemstone.Security/AuthenticationProviders/WindowsAuthenticationProvider.cs @@ -26,10 +26,10 @@ using System.DirectoryServices; using System.Linq; using System.Management; -using System.Runtime.CompilerServices; using System.Security.Claims; using System.Security.Principal; using System.Text.RegularExpressions; +using Gemstone.Configuration; using Microsoft.Extensions.DependencyInjection; namespace Gemstone.Security.AuthenticationProviders; @@ -57,6 +57,11 @@ public class WindowsAuthenticationProviderOptions public partial class WindowsAuthenticationProvider(WindowsAuthenticationProviderOptions options) : IAuthenticationProvider { #region [ Members ] + //Constants + /// + /// The section of the configuration file used to configure the provider when using the default options. + /// + public const string SettingsSection = "WindowsAuthentication"; // Nested Types private static class ClaimTypeAliases @@ -304,6 +309,18 @@ private static string Escape(string ldapValue) [GeneratedRegex(@"\\.|[()\0]")] private static partial Regex SpecialCharacterPattern(); + /// + /// Defines the settings used to configure the in the Configuration File. + /// + /// The settings to define. + public static void DefineSettings(Settings settings) + { + dynamic section = settings[SettingsSection]; + + section.LDAPPath = ("", "LDAP path to use for Windows Authentication"); + section.AllowLocalAccounts = (false, "Allow local accounts to authenticate with Windows Authentication"); + } + #endregion } From 1a70f91a5ea189ade0d77cd9b720b48e3c7079e1 Mon Sep 17 00:00:00 2001 From: prestoncraw Date: Fri, 5 Jun 2026 09:22:39 -0400 Subject: [PATCH 3/6] Add ExtendClaimPrincipal to IAuthenticationSetup --- .../AuthenticationProviders/IAuthenticationBuilder.cs | 7 +++++++ .../AuthenticationProviders/IAuthenticationSetup.cs | 8 ++++++++ 2 files changed, 15 insertions(+) diff --git a/src/Gemstone.Security/AuthenticationProviders/IAuthenticationBuilder.cs b/src/Gemstone.Security/AuthenticationProviders/IAuthenticationBuilder.cs index 669af0dd..9238b602 100644 --- a/src/Gemstone.Security/AuthenticationProviders/IAuthenticationBuilder.cs +++ b/src/Gemstone.Security/AuthenticationProviders/IAuthenticationBuilder.cs @@ -77,6 +77,11 @@ public IEnumerable GetProviderIdentities() return ProviderClaims.TryGetValue(providerIdentity, out List<(Claim, Claim)>? claims) ? claims.AsEnumerable() : []; } + + public void ExtendClaimPrincipal(ClaimsPrincipal claimsPrincipal, string providerIdentity) + { + //no default implementation, but this allows for the setup to extend the claim principle with additional claims or identities as needed + } } private class AuthenticationRuntime(IServiceCollection services, IAuthenticationSetup setup, Func providerLookup) : IAuthenticationRuntime @@ -106,6 +111,8 @@ public IEnumerable GetAssignedClaims(string providerIdentity, ClaimsPrinc string userIdentity = provider.GetIdentity(principal); + Setup.ExtendClaimPrincipal(principal, providerIdentity); + IEnumerable providerClaims = Setup .GetProviderClaims(providerIdentity) .Join(principal.Claims, ToKey, ToKey, (providerClaim, _) => providerClaim.Assigned) diff --git a/src/Gemstone.Security/AuthenticationProviders/IAuthenticationSetup.cs b/src/Gemstone.Security/AuthenticationProviders/IAuthenticationSetup.cs index e7fc8b25..56399259 100644 --- a/src/Gemstone.Security/AuthenticationProviders/IAuthenticationSetup.cs +++ b/src/Gemstone.Security/AuthenticationProviders/IAuthenticationSetup.cs @@ -44,4 +44,12 @@ public interface IAuthenticationSetup /// The identity of the authentication provider /// The list of mappings between provider claims and assigned claims. IEnumerable<(Claim Match, Claim Assigned)> GetProviderClaims(string providerIdentity); + + /// + /// Extends the given with additional claims or identities + /// based on the specified authentication provider. + /// + /// The claims principal to extend. + /// The identity of the authentication provider. + void ExtendClaimPrincipal(ClaimsPrincipal claimsPrincipal, string providerIdentity); } From a9c7ab3234352c968fa45589029cb6c4e59c3ed4 Mon Sep 17 00:00:00 2001 From: prestoncraw Date: Mon, 8 Jun 2026 16:18:47 -0400 Subject: [PATCH 4/6] Remove unecessary interface method in favor of implementing IClaimsTransformation --- .../AuthenticationProviders/IAuthenticationBuilder.cs | 2 -- .../AuthenticationProviders/IAuthenticationSetup.cs | 8 -------- 2 files changed, 10 deletions(-) diff --git a/src/Gemstone.Security/AuthenticationProviders/IAuthenticationBuilder.cs b/src/Gemstone.Security/AuthenticationProviders/IAuthenticationBuilder.cs index 9238b602..f3c04750 100644 --- a/src/Gemstone.Security/AuthenticationProviders/IAuthenticationBuilder.cs +++ b/src/Gemstone.Security/AuthenticationProviders/IAuthenticationBuilder.cs @@ -111,8 +111,6 @@ public IEnumerable GetAssignedClaims(string providerIdentity, ClaimsPrinc string userIdentity = provider.GetIdentity(principal); - Setup.ExtendClaimPrincipal(principal, providerIdentity); - IEnumerable providerClaims = Setup .GetProviderClaims(providerIdentity) .Join(principal.Claims, ToKey, ToKey, (providerClaim, _) => providerClaim.Assigned) diff --git a/src/Gemstone.Security/AuthenticationProviders/IAuthenticationSetup.cs b/src/Gemstone.Security/AuthenticationProviders/IAuthenticationSetup.cs index 56399259..e7fc8b25 100644 --- a/src/Gemstone.Security/AuthenticationProviders/IAuthenticationSetup.cs +++ b/src/Gemstone.Security/AuthenticationProviders/IAuthenticationSetup.cs @@ -44,12 +44,4 @@ public interface IAuthenticationSetup /// The identity of the authentication provider /// The list of mappings between provider claims and assigned claims. IEnumerable<(Claim Match, Claim Assigned)> GetProviderClaims(string providerIdentity); - - /// - /// Extends the given with additional claims or identities - /// based on the specified authentication provider. - /// - /// The claims principal to extend. - /// The identity of the authentication provider. - void ExtendClaimPrincipal(ClaimsPrincipal claimsPrincipal, string providerIdentity); } From f0f7ecfa31ec9657e8bb3b440583cd8fae26533c Mon Sep 17 00:00:00 2001 From: prestoncraw Date: Mon, 8 Jun 2026 16:29:18 -0400 Subject: [PATCH 5/6] Fix comments/labeling --- .../WindowsAuthenticationProvider.cs | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/src/Gemstone.Security/AuthenticationProviders/WindowsAuthenticationProvider.cs b/src/Gemstone.Security/AuthenticationProviders/WindowsAuthenticationProvider.cs index cb421bb7..8b6a829e 100644 --- a/src/Gemstone.Security/AuthenticationProviders/WindowsAuthenticationProvider.cs +++ b/src/Gemstone.Security/AuthenticationProviders/WindowsAuthenticationProvider.cs @@ -57,9 +57,10 @@ public class WindowsAuthenticationProviderOptions public partial class WindowsAuthenticationProvider(WindowsAuthenticationProviderOptions options) : IAuthenticationProvider { #region [ Members ] - //Constants + // Constants + /// - /// The section of the configuration file used to configure the provider when using the default options. + /// The section of the configuration file that could be used to configure the provider. /// public const string SettingsSection = "WindowsAuthentication"; @@ -310,15 +311,15 @@ private static string Escape(string ldapValue) private static partial Regex SpecialCharacterPattern(); /// - /// Defines the settings used to configure the in the Configuration File. + /// Defines the settings used to configure the in the Configuration File. /// /// The settings to define. public static void DefineSettings(Settings settings) { dynamic section = settings[SettingsSection]; - section.LDAPPath = ("", "LDAP path to use for Windows Authentication"); - section.AllowLocalAccounts = (false, "Allow local accounts to authenticate with Windows Authentication"); + section.LDAPPath = ("", "Root path from which LDAP searches should be performed"); + section.AllowLocalAccounts = (false, "Indicates whether the UI will also search local Users and Groups"); } #endregion From bf033647c37643a937e25f63a581c866ed35387c Mon Sep 17 00:00:00 2001 From: StephenCWills Date: Thu, 11 Jun 2026 11:16:32 -0400 Subject: [PATCH 6/6] Cleanup --- .../IAuthenticationBuilder.cs | 5 ----- .../OAuthAuthenticationProvider.cs | 6 +++++- .../WindowsAuthenticationProvider.cs | 15 ++++++++------- 3 files changed, 13 insertions(+), 13 deletions(-) diff --git a/src/Gemstone.Security/AuthenticationProviders/IAuthenticationBuilder.cs b/src/Gemstone.Security/AuthenticationProviders/IAuthenticationBuilder.cs index f3c04750..669af0dd 100644 --- a/src/Gemstone.Security/AuthenticationProviders/IAuthenticationBuilder.cs +++ b/src/Gemstone.Security/AuthenticationProviders/IAuthenticationBuilder.cs @@ -77,11 +77,6 @@ public IEnumerable GetProviderIdentities() return ProviderClaims.TryGetValue(providerIdentity, out List<(Claim, Claim)>? claims) ? claims.AsEnumerable() : []; } - - public void ExtendClaimPrincipal(ClaimsPrincipal claimsPrincipal, string providerIdentity) - { - //no default implementation, but this allows for the setup to extend the claim principle with additional claims or identities as needed - } } private class AuthenticationRuntime(IServiceCollection services, IAuthenticationSetup setup, Func providerLookup) : IAuthenticationRuntime diff --git a/src/Gemstone.Security/AuthenticationProviders/OAuthAuthenticationProvider.cs b/src/Gemstone.Security/AuthenticationProviders/OAuthAuthenticationProvider.cs index ad1d339b..b5266466 100644 --- a/src/Gemstone.Security/AuthenticationProviders/OAuthAuthenticationProvider.cs +++ b/src/Gemstone.Security/AuthenticationProviders/OAuthAuthenticationProvider.cs @@ -90,7 +90,11 @@ private class ProviderClaim(string value, string description) : IProviderClaim public string LongDescription => string.Empty; } - //Constants + // Constants + + /// + /// The section of the configuration file that could be used to configure the provider. + /// public const string SettingsSection = "Security.OpenIDConnect"; #endregion diff --git a/src/Gemstone.Security/AuthenticationProviders/WindowsAuthenticationProvider.cs b/src/Gemstone.Security/AuthenticationProviders/WindowsAuthenticationProvider.cs index 8b6a829e..c3473d3d 100644 --- a/src/Gemstone.Security/AuthenticationProviders/WindowsAuthenticationProvider.cs +++ b/src/Gemstone.Security/AuthenticationProviders/WindowsAuthenticationProvider.cs @@ -57,12 +57,6 @@ public class WindowsAuthenticationProviderOptions public partial class WindowsAuthenticationProvider(WindowsAuthenticationProviderOptions options) : IAuthenticationProvider { #region [ Members ] - // Constants - - /// - /// The section of the configuration file that could be used to configure the provider. - /// - public const string SettingsSection = "WindowsAuthentication"; // Nested Types private static class ClaimTypeAliases @@ -90,6 +84,13 @@ private class ProviderClaim(string value, string description) : IProviderClaim public string LongDescription => string.Empty; } + // Constants + + /// + /// The section of the configuration file that could be used to configure the provider. + /// + public const string SettingsSection = "WindowsAuthentication"; + #endregion #region [ Constructors ] @@ -313,7 +314,7 @@ private static string Escape(string ldapValue) /// /// Defines the settings used to configure the in the Configuration File. /// - /// The settings to define. + /// The instance in which to define the settings. public static void DefineSettings(Settings settings) { dynamic section = settings[SettingsSection];