Serialize and deserialize actor token in claims identity

src/Microsoft.IdentityModel.JsonWebTokens/JsonWebTokenHandler.CreateToken.cs

@@ -668,11 +668,16 @@ internal static void WriteJwsPayload(
             // Duplicates are resolved according to the following priority:
             // SecurityTokenDescriptor.{Audience/Audiences, Issuer, Expires, IssuedAt, NotBefore}, SecurityTokenDescriptor.Claims, SecurityTokenDescriptor.Subject.Claims
             // SecurityTokenDescriptor.Claims are KeyValuePairs<string,object>, whereas SecurityTokenDescriptor.Subject.Claims are System.Security.Claims.Claim and are processed differently.
-
+            bool isActorFound = false;
             if (tokenDescriptor.Claims != null && tokenDescriptor.Claims.Count > 0)
             {
                 foreach (KeyValuePair<string, object> kvp in tokenDescriptor.Claims)
                 {
+                    if (kvp.Key.Equals(tokenDescriptor.ActorClaimType, StringComparison.Ordinal))
+                    {
+                        isActorFound = true;
+                        continue;
+                    }
                     if (!descriptorClaimsAudienceChecked && kvp.Key.Equals(JwtRegisteredClaimNames.Aud, StringComparison.Ordinal))
                     {
                         descriptorClaimsAudienceChecked = true;
@@ -754,6 +759,8 @@ internal static void WriteJwsPayload(
                     JsonPrimitives.WriteObject(ref writer, kvp.Key, kvp.Value);
                 }
             }
+            if (isActorFound || tokenDescriptor.Subject?.Actor != null)
+                WriteActorToken(writer, tokenDescriptor, setDefaultTimesOnTokenCreation, tokenLifetimeInMinutes);
 
             AddSubjectClaims(ref writer, tokenDescriptor, audienceSet, issuerSet, ref expSet, ref iatSet, ref nbfSet);
 
@@ -1071,6 +1078,74 @@ internal static byte[] WriteJweHeader(SecurityTokenDescriptor tokenDescriptor)
                 }
             }
         }
+        internal static void WriteActorToken(
+            Utf8JsonWriter writer,
+            SecurityTokenDescriptor tokenDescriptor,
+            bool setDefaultTimesOnTokenCreation,
+            int tokenLifetimeInMinutes)
+        {
+            if (tokenDescriptor == null)
+                throw new ArgumentNullException(nameof(tokenDescriptor));
+
+            var actorTokenDescriptor = CreateActorTokenDescriptor(tokenDescriptor);
+            if (actorTokenDescriptor == null || actorTokenDescriptor.Subject == null)
+                return;
+
+            writer.WritePropertyName(tokenDescriptor.ActorClaimType);
+            WriteJwsPayload(ref writer, actorTokenDescriptor, setDefaultTimesOnTokenCreation, tokenLifetimeInMinutes);
+        }
+
+        private static void ValidateActorChainDepth(SecurityTokenDescriptor tokenDescriptor)
+        {
+            if (tokenDescriptor.ActorChainDepth >= tokenDescriptor.MaxActorChainLength)
+            {
+                throw LogHelper.LogExceptionMessage(
+                new SecurityTokenException(LogHelper.FormatInvariant(
+                    LogMessages.IDX14313,
+                    LogHelper.MarkAsNonPII(tokenDescriptor.ActorChainDepth),
+                    LogHelper.MarkAsNonPII(tokenDescriptor.MaxActorChainLength))));
+            }
+        }
+
+        private static SecurityTokenDescriptor CreateActorTokenDescriptor(SecurityTokenDescriptor tokenDescriptor)
+        {
+            SecurityTokenDescriptor actorTokenDescriptor = null;
+
+            if (tokenDescriptor.Claims?.TryGetValue(tokenDescriptor.ActorClaimType, out object actorValue) == true)
+            {
+                if (actorValue is not ClaimsIdentity actor)
+                {
+                    throw LogHelper.LogExceptionMessage(new SecurityTokenException(
+                        LogHelper.FormatInvariant(
+                            LogMessages.IDX14315,
+                            LogHelper.MarkAsNonPII(tokenDescriptor.ActorClaimType),
+                            LogHelper.MarkAsNonPII(actorValue?.GetType().ToString() ?? "null"))));
+                }
+
+                actorTokenDescriptor = new SecurityTokenDescriptor
+                {
+                    Subject = actor,
+                };
+
+            }
+            // Then check for actor in subject
+            else if (tokenDescriptor.Subject?.Actor != null)
+            {
+                actorTokenDescriptor = new SecurityTokenDescriptor
+                {
+                    Subject = tokenDescriptor.Subject.Actor,
+                };
+            }
+            if (actorTokenDescriptor != null)
+            {
+                ValidateActorChainDepth(tokenDescriptor);
+                actorTokenDescriptor.MaxActorChainLength = tokenDescriptor.MaxActorChainLength;
+                actorTokenDescriptor.ActorClaimType = tokenDescriptor.ActorClaimType;
+                actorTokenDescriptor.ActorChainDepth = tokenDescriptor.ActorChainDepth + 1;
+            }
+
+            return actorTokenDescriptor;
+        }
 
         internal static byte[] CompressToken(byte[] utf8Bytes, string compressionAlgorithm)
         {

src/Microsoft.IdentityModel.JsonWebTokens/JsonWebTokenHandler.cs

@@ -4,6 +4,7 @@
 using System;
 using System.Collections.Generic;
 using System.Security.Claims;
+using System.Text.Json;
 using System.Text.RegularExpressions;
 using System.Threading;
 using System.Threading.Tasks;
@@ -212,8 +213,8 @@ protected virtual ClaimsIdentity CreateClaimsIdentity(JsonWebToken jwtToken, Tok
 
         private ClaimsIdentity CreateClaimsIdentityWithMapping(JsonWebToken jwtToken, TokenValidationParameters validationParameters, string issuer)
         {
-            _ = validationParameters ?? throw LogHelper.LogArgumentNullException(nameof(validationParameters));
 
+            _ = validationParameters ?? throw LogHelper.LogArgumentNullException(nameof(validationParameters));
             ClaimsIdentity identity = validationParameters.CreateClaimsIdentity(jwtToken, issuer);
             foreach (Claim jwtClaim in jwtToken.Claims)
             {
@@ -222,19 +223,14 @@ private ClaimsIdentity CreateClaimsIdentityWithMapping(JsonWebToken jwtToken, To
                 if (!wasMapped)
                     claimType = jwtClaim.Type;
 
-                if (claimType == ClaimTypes.Actor)
+                if (claimType.Equals(validationParameters.ActorClaimType) || claimType.Equals("actort"))
                 {
                     if (identity.Actor != null)
                         throw LogHelper.LogExceptionMessage(new InvalidOperationException(LogHelper.FormatInvariant(
                                     LogMessages.IDX14112,
-                                    LogHelper.MarkAsNonPII(JwtRegisteredClaimNames.Actort),
+                                    LogHelper.MarkAsNonPII(claimType),
                                     jwtClaim.Value)));
-
-                    if (CanReadToken(jwtClaim.Value))
-                    {
-                        JsonWebToken actor = ReadToken(jwtClaim.Value) as JsonWebToken;
-                        identity.Actor = CreateClaimsIdentity(actor, validationParameters);
-                    }
+                    identity.Actor = CreateClaimsIdentityActor(jwtToken, jwtClaim.Value, validationParameters, claimType.Equals(validationParameters.ActorClaimType));
                 }
 
                 if (wasMapped)
@@ -287,16 +283,11 @@ private ClaimsIdentity CreateClaimsIdentityPrivate(JsonWebToken jwtToken, TokenV
             foreach (Claim jwtClaim in jwtToken.Claims)
             {
                 string claimType = jwtClaim.Type;
-                if (claimType == ClaimTypes.Actor)
+                if (claimType == validationParameters.ActorClaimType || claimType.Equals("actort"))
                 {
                     if (identity.Actor != null)
-                        throw LogHelper.LogExceptionMessage(new InvalidOperationException(LogHelper.FormatInvariant(LogMessages.IDX14112, LogHelper.MarkAsNonPII(JwtRegisteredClaimNames.Actort), jwtClaim.Value)));
-
-                    if (CanReadToken(jwtClaim.Value))
-                    {
-                        JsonWebToken actor = ReadToken(jwtClaim.Value) as JsonWebToken;
-                        identity.Actor = CreateClaimsIdentity(actor, validationParameters, issuer);
-                    }
+                        throw LogHelper.LogExceptionMessage(new InvalidOperationException(LogHelper.FormatInvariant(LogMessages.IDX14112, LogHelper.MarkAsNonPII(claimType), jwtClaim.Value)));
+                    identity.Actor = CreateClaimsIdentityActor(jwtToken, jwtClaim.Value, validationParameters, claimType.Equals(validationParameters.ActorClaimType));
                 }
 
                 if (jwtClaim.Properties.Count == 0)
@@ -621,5 +612,133 @@ private static TokenValidationResult ReadToken(string token, TokenValidationPara
                 IsValid = true
             };
         }
+
+        /// <summary>
+        /// Creates a ClaimsIdentity from an actor claim string.
+        /// </summary>
+        /// <param name="jwtToken"></param>
+        /// <param name="actorString">The actor claim string.</param>
+        /// <param name="tokenValidationParameters">The token validation parameters.</param>
+        /// <param name="isStandardAct">This tells us if we want to deserialize it as a JWT or Json Object. If this is set to true then we deserialize as JsonObject else as JWT </param>
+        /// <returns>A ClaimsIdentity representing the actor.</returns>
+        /// <exception cref="ArgumentNullException">Thrown if <paramref name="actorString"/> or <paramref name="tokenValidationParameters"/> is null.</exception>
+        private ClaimsIdentity CreateClaimsIdentityActor(
+            JsonWebToken jwtToken,
+            string actorString,
+            TokenValidationParameters tokenValidationParameters,
+            bool isStandardAct = false)
+        {
+            if (string.IsNullOrEmpty(actorString))
+                throw LogHelper.LogArgumentNullException(nameof(actorString));
+
+            if (tokenValidationParameters == null)
+                throw LogHelper.LogArgumentNullException(nameof(tokenValidationParameters));
+
+            if (isStandardAct)
+            {
+                if (jwtToken.TryGetPayloadValue<JsonElement>(tokenValidationParameters.ActorClaimType, out JsonElement actClaim))
+                {
+                    if (tokenValidationParameters.ActClaimRetrieverDelegate != null)
+                    {
+                        try
+                        {
+                            return tokenValidationParameters.ActClaimRetrieverDelegate(actClaim, tokenValidationParameters);
+                        }
+                        catch (Exception ex)
+                        {
+                            throw LogHelper.LogExceptionMessage(new SecurityTokenDecryptionFailedException(LogHelper.FormatInvariant(
+                                LogMessages.IDX14314,
+                                LogHelper.MarkAsNonPII(ex.ToString()))));
+                        }
+                    }
+                    else
+                    {
+                        return CreateActorClaimsIdentityFromJsonElement(actClaim, tokenValidationParameters);
+                    }
+                }
+
+            }
+            else
+            {
+                if (CanReadToken(actorString))
+                {
+                    JsonWebToken actor = ReadToken(actorString) as JsonWebToken;
+                    return CreateClaimsIdentity(actor, tokenValidationParameters);
+                }
+            }
+
+            return null;
+        }
+
+        /// <summary>
+        /// Creates a ClaimsIdentity from a JsonElement that represents an actor token.
+        /// </summary>
+        /// <param name="jsonElement">The JsonElement containing actor claims.</param>
+        /// <param name="tokenValidationParameters">These parameters have details like nested actor chain length and max permissible actor length</param>
+        /// <param name="issuer">The issuer for the claims.</param>
+        /// <returns>A ClaimsIdentity containing claims from the JsonElement.</returns>
+        public static ClaimsIdentity CreateActorClaimsIdentityFromJsonElement(
+            JsonElement jsonElement,
+            TokenValidationParameters tokenValidationParameters,
+            string issuer = null)
+        {
+            if (tokenValidationParameters == null)
+                throw LogHelper.LogArgumentNullException(nameof(tokenValidationParameters));
+
+            if (tokenValidationParameters.ActorChainDepth >= tokenValidationParameters.MaxActorChainLength)
+            {
+                throw LogHelper.LogExceptionMessage(
+                    new SecurityTokenException(LogHelper.FormatInvariant(
+                    LogMessages.IDX14313,
+                    LogHelper.MarkAsNonPII(tokenValidationParameters.ActorChainDepth),
+                    LogHelper.MarkAsNonPII(tokenValidationParameters.MaxActorChainLength))));
+            }
+
+            if (jsonElement.ValueKind != JsonValueKind.Object)
+                throw LogHelper.LogExceptionMessage(new ArgumentException("Actor token must be a JSON object"));
+
+            // Use CaseSensitiveClaimsIdentity for consistent behavior with the rest of the library
+            var identity = new CaseSensitiveClaimsIdentity();
+
+            issuer = issuer ?? ClaimsIdentity.DefaultIssuer;
+
+            foreach (var property in jsonElement.EnumerateObject())
+            {
+                string claimType = property.Name;
+                JsonElement value = property.Value;
+
+                // Special handling for nested actor claim
+                if (claimType == tokenValidationParameters.ActorClaimType)
+                {
+                    if (value.ValueKind == JsonValueKind.Object)
+                    {
+                        tokenValidationParameters.ActorChainDepth++;
+                        // Recursively create nested actor identity
+                        identity.Actor = CreateActorClaimsIdentityFromJsonElement(
+                            value, tokenValidationParameters, issuer);
+                    }
+                    continue;
+                }
+
+                // For all other claims, create and add them
+                if (value.ValueKind == JsonValueKind.Array)
+                {
+                    foreach (JsonElement element in value.EnumerateArray())
+                    {
+                        var claim = JsonClaimSet.CreateClaimFromJsonElement(claimType, issuer, element);
+                        if (claim != null)
+                            identity.AddClaim(claim);
+                    }
+                }
+                else
+                {
+                    var claim = JsonClaimSet.CreateClaimFromJsonElement(claimType, issuer, value);
+                    if (claim != null)
+                        identity.AddClaim(claim);
+                }
+            }
+
+            return identity;
+        }
     }
 }

src/Microsoft.IdentityModel.JsonWebTokens/LogMessages.cs

@@ -51,5 +51,8 @@ internal static class LogMessages
         internal const string IDX14310 = "IDX14310: JWE authentication tag is missing.";
         internal const string IDX14311 = "IDX14311: Unable to decode the authentication tag as a Base64Url encoded string.";
         internal const string IDX14312 = "IDX14312: Unable to decode the cipher text as a Base64Url encoded string.";
+        internal const string IDX14313 = "IDX14313: Unable to serialize/deserialize act claim. Maximum actor token depth reached. Current nesting depth is {0} while max depth set is {1}";
+        internal const string IDX14314 = "IDX14314: Unable to deserialize act claim. Exception faced while using custom delegate to deserialize act claim. Nested exception is :{0}";
+        internal const string IDX14315 = "IDX14315: Encountered an exception while processing the actor claim. Actor claim  {0} is not a claims identity. It is of type {1}.";
     }
 }

src/Microsoft.IdentityModel.JsonWebTokens/Microsoft.IdentityModel.JsonWebTokens.csproj

@@ -1,4 +1,4 @@
-<Project Sdk="Microsoft.NET.Sdk">
+<Project Sdk="Microsoft.NET.Sdk">
 
   <Import Project="..\..\build\common.props" />
 

src/Microsoft.IdentityModel.JsonWebTokens/PublicAPI.Unshipped.txt

@@ -1 +1,2 @@
-Microsoft.IdentityModel.JsonWebTokens.JsonWebTokenHandler.DecryptTokenWithConfigurationAsync(Microsoft.IdentityModel.JsonWebTokens.JsonWebToken jwtToken, Microsoft.IdentityModel.Tokens.TokenValidationParameters validationParameters, System.Threading.CancellationToken cancellationToken) -> System.Threading.Tasks.Task<string>
+static Microsoft.IdentityModel.JsonWebTokens.JsonWebTokenHandler.CreateActorClaimsIdentityFromJsonElement(System.Text.Json.JsonElement jsonElement, Microsoft.IdentityModel.Tokens.TokenValidationParameters tokenValidationParameters, string issuer = null) -> System.Security.Claims.ClaimsIdentity
+Microsoft.IdentityModel.JsonWebTokens.JsonWebTokenHandler.DecryptTokenWithConfigurationAsync(Microsoft.IdentityModel.JsonWebTokens.JsonWebToken jwtToken, Microsoft.IdentityModel.Tokens.TokenValidationParameters validationParameters, System.Threading.CancellationToken cancellationToken) -> System.Threading.Tasks.Task<string>

src/Microsoft.IdentityModel.Tokens/Delegates.cs

@@ -3,6 +3,7 @@
 
 using System;
 using System.Collections.Generic;
+using System.Security.Claims;
 using System.Text.Json;
 using System.Threading.Tasks;
 
@@ -194,4 +195,12 @@ namespace Microsoft.IdentityModel.Tokens
     /// <param name="claimValue">The claim value that was read and parsed from the reader.</param>
     /// <returns>True, if the claim value was read successfully; false otherwise.</returns>
     public delegate bool TryReadJwtClaim(ref Utf8JsonReader reader, JwtSegmentType jwtSegmentType, string claimName, out object claimValue);
+
+    /// <summary>
+    /// Delegate to validate the 'act' claim and create actor's ClaimsIdentity.
+    /// </summary>
+    /// <param name="actClaim">The JSON element representing the 'act' claim.</param>
+    /// <param name="tokenValidationParameters"> Opitonal validation parameters if needed</param>
+    /// <returns>A ClaimsIdentity representing the actor.</returns>
+    public delegate ClaimsIdentity ActClaimRetrieverDelegate(JsonElement actClaim, TokenValidationParameters tokenValidationParameters = null);
 }