| | | 1 | | <# |
| | | 2 | | .SYNOPSIS |
| | | 3 | | Signs in a user issuing an authentication cookie for the given scheme. |
| | | 4 | | .DESCRIPTION |
| | | 5 | | Wraps SignInAsync on the current HTTP context to create a cookie-based session. |
| | | 6 | | You can supply an existing ClaimsIdentity or provide claims via -Name, -Claim, or -ClaimTable. |
| | | 7 | | Optionally sets authentication properties like persistence and expiration. |
| | | 8 | | Designed for use inside Kestrun route script blocks where $Context is available. |
| | | 9 | | .PARAMETER Scheme |
| | | 10 | | Authentication scheme to use (default 'Cookies'). |
| | | 11 | | .PARAMETER Name |
| | | 12 | | Convenience parameter to add a ClaimTypes.Name claim. |
| | | 13 | | .PARAMETER Claims |
| | | 14 | | One or more pre-constructed System.Security.Claims.Claim objects to include. |
| | | 15 | | .PARAMETER Identity |
| | | 16 | | Existing ClaimsIdentity to use instead of constructing a new one. |
| | | 17 | | .PARAMETER AuthenticationProperties |
| | | 18 | | Existing AuthenticationProperties to use instead of constructing a new one. |
| | | 19 | | .PARAMETER ExpiresUtc |
| | | 20 | | Explicit expiration timestamp for the authentication ticket. |
| | | 21 | | .PARAMETER IssuedUtc |
| | | 22 | | Explicit issued timestamp for the authentication ticket. |
| | | 23 | | .PARAMETER IsPersistent |
| | | 24 | | Marks the cookie as persistent (survives browser session) if supported. |
| | | 25 | | .PARAMETER AllowRefresh |
| | | 26 | | Allows the authentication session to be refreshed (sliding expiration scenarios). |
| | | 27 | | .PARAMETER RedirectUri |
| | | 28 | | Sets the RedirectUri property on AuthenticationProperties. |
| | | 29 | | .PARAMETER Items |
| | | 30 | | Hashtable of string key-Value pairs to add to the Items collection on AuthenticationProperties. |
| | | 31 | | .PARAMETER Parameters |
| | | 32 | | Hashtable of string key-Value pairs to add to the Parameters collection on AuthenticationProperties. |
| | | 33 | | .PARAMETER PassThru |
| | | 34 | | Returns the created ClaimsPrincipal instead of no output. |
| | | 35 | | .PARAMETER WhatIf |
| | | 36 | | Shows what would happen if the command runs. The command is not run. |
| | | 37 | | .PARAMETER Confirm |
| | | 38 | | Prompts you for confirmation before running the command. The command is not run unless you respond affirmatively. |
| | | 39 | | .EXAMPLE |
| | | 40 | | Invoke-KrCookieSignIn -Name 'admin' |
| | | 41 | | .EXAMPLE |
| | | 42 | | Invoke-KrCookieSignIn -Scheme 'Cookies' -ClaimTable @{ role = 'admin'; dept = 'it' } -IsPersistent -ExpiresUtc (Get- |
| | | 43 | | .OUTPUTS |
| | | 44 | | System.Security.Claims.ClaimsPrincipal (when -PassThru specified) |
| | | 45 | | #> |
| | | 46 | | function Invoke-KrCookieSignIn { |
| | | 47 | | [KestrunRuntimeApi('Route')] |
| | | 48 | | [CmdletBinding(SupportsShouldProcess = $true, ConfirmImpact = 'Low', DefaultParameterSetName = 'Claims')] |
| | | 49 | | [OutputType([System.Security.Claims.ClaimsPrincipal])] |
| | | 50 | | param( |
| | | 51 | | [Parameter()] |
| | | 52 | | [string]$Scheme = 'Cookies', |
| | | 53 | | |
| | | 54 | | # Identity construction helpers |
| | | 55 | | [Parameter(ParameterSetName = 'SimpleIdentity')] |
| | | 56 | | [string]$Name, |
| | | 57 | | |
| | | 58 | | [Parameter(ParameterSetName = 'BuildIdentity')] |
| | | 59 | | [Parameter(ParameterSetName = 'AuthenticationPropertiesItems_BuildIdentity')] |
| | | 60 | | [Parameter(ParameterSetName = 'AuthenticationProperties_Claim')] |
| | | 61 | | [Parameter(ParameterSetName = 'Claims')] |
| | | 62 | | [System.Security.Claims.Claim[]]$Claims, |
| | | 63 | | |
| | | 64 | | |
| | | 65 | | [Parameter(ParameterSetName = 'Identity', Mandatory = $true)] |
| | | 66 | | [Parameter(ParameterSetName = 'AuthenticationPropertiesItems_Identity')] |
| | | 67 | | [Parameter(ParameterSetName = 'AuthenticationProperties_Identity')] |
| | | 68 | | [System.Security.Claims.ClaimsIdentity]$Identity, |
| | | 69 | | |
| | | 70 | | [Parameter(Mandatory = $true, ParameterSetName = 'AuthenticationProperties_Claim')] |
| | | 71 | | [Parameter(ParameterSetName = 'AuthenticationProperties_Identity')] |
| | | 72 | | [Microsoft.AspNetCore.Authentication.AuthenticationProperties]$AuthenticationProperties, |
| | | 73 | | # Session lifetimes |
| | | 74 | | [Parameter(ParameterSetName = 'AuthenticationPropertiesItems_BuildIdentity')] |
| | | 75 | | [Parameter(ParameterSetName = 'AuthenticationPropertiesItems_Identity')] |
| | | 76 | | [Parameter(ParameterSetName = 'SimpleIdentity_BuildIdentity')] |
| | | 77 | | [object]$ExpiresUtc, # accepts DateTimeOffset/DateTime/string/duration |
| | | 78 | | |
| | | 79 | | [Parameter(ParameterSetName = 'AuthenticationPropertiesItems_BuildIdentity')] |
| | | 80 | | [Parameter(ParameterSetName = 'AuthenticationPropertiesItems_Identity')] |
| | | 81 | | [Parameter(ParameterSetName = 'SimpleIdentity_BuildIdentity')] |
| | | 82 | | [object]$IssuedUtc, # same parsing |
| | | 83 | | |
| | | 84 | | # Flags |
| | | 85 | | [Parameter(ParameterSetName = 'AuthenticationPropertiesItems_BuildIdentity')] |
| | | 86 | | [Parameter(ParameterSetName = 'AuthenticationPropertiesItems_Identity')] |
| | | 87 | | [Parameter(ParameterSetName = 'SimpleIdentity_BuildIdentity')] |
| | | 88 | | [switch]$IsPersistent, |
| | | 89 | | [Parameter(ParameterSetName = 'AuthenticationPropertiesItems_BuildIdentity')] |
| | | 90 | | [Parameter(ParameterSetName = 'AuthenticationPropertiesItems_Identity')] |
| | | 91 | | [Parameter(ParameterSetName = 'SimpleIdentity_BuildIdentity')] |
| | | 92 | | [switch]$AllowRefresh, |
| | | 93 | | |
| | | 94 | | # Extras |
| | | 95 | | [Parameter(ParameterSetName = 'AuthenticationPropertiesItems_BuildIdentity')] |
| | | 96 | | [Parameter(ParameterSetName = 'AuthenticationPropertiesItems_Identity')] |
| | | 97 | | [Parameter(ParameterSetName = 'SimpleIdentity_BuildIdentity')] |
| | | 98 | | [string]$RedirectUri, |
| | | 99 | | [Parameter(ParameterSetName = 'AuthenticationPropertiesItems_BuildIdentity')] |
| | | 100 | | [Parameter(ParameterSetName = 'AuthenticationPropertiesItems_Identity')] |
| | | 101 | | [Parameter(ParameterSetName = 'SimpleIdentity_BuildIdentity')] |
| | | 102 | | [hashtable]$Items, |
| | | 103 | | [Parameter(ParameterSetName = 'AuthenticationPropertiesItems_BuildIdentity')] |
| | | 104 | | [Parameter(ParameterSetName = 'AuthenticationPropertiesItems_Identity')] |
| | | 105 | | [Parameter(ParameterSetName = 'SimpleIdentity_BuildIdentity')] |
| | | 106 | | [hashtable]$Parameters, |
| | | 107 | | |
| | | 108 | | [Parameter()] |
| | | 109 | | [switch]$PassThru |
| | | 110 | | ) |
| | | 111 | | # Only works inside a route script block where $Context is available |
| | 0 | 112 | | if ($null -ne $Context) { |
| | | 113 | | |
| | | 114 | | # Build or accept identity |
| | 0 | 115 | | if (-not $Identity) { |
| | 0 | 116 | | $Identity = [System.Security.Claims.ClaimsIdentity]::new($Scheme) |
| | | 117 | | } |
| | | 118 | | |
| | | 119 | | # Add Name claim if provided |
| | 0 | 120 | | if ($PSBoundParameters.ContainsKey('Name') -and (-not [string]::IsNullOrWhiteSpace($Name))) { |
| | 0 | 121 | | $ClaimType = [Kestrun.Claims.KestrunClaimExtensions]::ToClaimUri('Name') |
| | 0 | 122 | | $Identity.AddClaim([System.Security.Claims.Claim]::new($ClaimType, $Name)) |
| | | 123 | | } |
| | | 124 | | |
| | | 125 | | # Add any provided claims |
| | 0 | 126 | | if ($Claims) { |
| | 0 | 127 | | foreach ($claim in $Claims) { |
| | 0 | 128 | | $Identity.AddClaim($claim) |
| | | 129 | | } |
| | | 130 | | } |
| | | 131 | | |
| | | 132 | | # Create principal |
| | 0 | 133 | | $principal = [System.Security.Claims.ClaimsPrincipal]::new($Identity) |
| | | 134 | | |
| | 0 | 135 | | if ($PSBoundParameters -eq 'AuthenticationPropertiesItems_BuildIdentity') { |
| | 0 | 136 | | $AuthenticationProperties = [Microsoft.AspNetCore.Authentication.AuthenticationProperties]::new() |
| | | 137 | | |
| | 0 | 138 | | if ($PSBoundParameters.ContainsKey('ExpiresUtc') -and $ExpiresUtc) { |
| | 0 | 139 | | $authProps.ExpiresUtc = ConvertTo-DateTimeOffset $ExpiresUtc |
| | | 140 | | } |
| | 0 | 141 | | if ($PSBoundParameters.ContainsKey('IssuedUtc') -and $IssuedUtc) { |
| | 0 | 142 | | $authProps.IssuedUtc = ConvertTo-DateTimeOffset $IssuedUtc |
| | | 143 | | } |
| | 0 | 144 | | if ($PSBoundParameters.ContainsKey('IsPersistent')) { |
| | 0 | 145 | | $authProps.IsPersistent = [bool]$IsPersistent |
| | | 146 | | } |
| | 0 | 147 | | if ($PSBoundParameters.ContainsKey('AllowRefresh')) { |
| | 0 | 148 | | $authProps.AllowRefresh = [bool]$AllowRefresh |
| | | 149 | | } |
| | 0 | 150 | | if ($PSBoundParameters.ContainsKey('RedirectUri') -and $RedirectUri) { |
| | 0 | 151 | | $authProps.RedirectUri = $RedirectUri |
| | | 152 | | } |
| | 0 | 153 | | if ($PSBoundParameters.ContainsKey('Items') -and $Items) { |
| | 0 | 154 | | foreach ($k in $Items.Keys) { $authProps.Items[[string]$k] = [string]$Items[$k] } |
| | | 155 | | } |
| | 0 | 156 | | if ($PSBoundParameters.ContainsKey('Parameters') -and $Parameters) { |
| | 0 | 157 | | foreach ($k in $Parameters.Keys) { $authProps.Parameters[[string]$k] = $Parameters[$k] } |
| | | 158 | | } |
| | | 159 | | } |
| | | 160 | | |
| | | 161 | | # Sign in |
| | 0 | 162 | | if ($PSCmdlet.ShouldProcess($Scheme, 'SignIn')) { |
| | 0 | 163 | | [Microsoft.AspNetCore.Authentication.AuthenticationHttpContextExtensions]::SignInAsync( |
| | | 164 | | $Context.HttpContext, $Scheme, $principal, $AuthenticationProperties |
| | 0 | 165 | | ).GetAwaiter().GetResult() | Out-Null |
| | | 166 | | } |
| | | 167 | | |
| | | 168 | | # Return principal if requested |
| | 0 | 169 | | if ($PassThru) { |
| | 0 | 170 | | return $principal |
| | | 171 | | } |
| | | 172 | | } else { |
| | 0 | 173 | | Write-KrOutsideRouteWarning |
| | | 174 | | } |
| | | 175 | | } |