Obsolete and replace ISystemClock in Security, Identity #47472 (#47717)

Author: Tratcher

src/DefaultBuilder/test/Microsoft.AspNetCore.Tests/WebApplicationTests.cs

@@ -2505,7 +2505,7 @@ public async Task UsingCreateSlimBuilderWorksIfRegexConstraintAddedViaAddRouting
 
  private class UberHandler : AuthenticationHandler<AuthenticationSchemeOptions>
  {
- public UberHandler(IOptionsMonitor<AuthenticationSchemeOptions> options, ILoggerFactory logger, UrlEncoder encoder, ISystemClock clock) : base(options, logger, encoder, clock) { }
+ public UberHandler(IOptionsMonitor<AuthenticationSchemeOptions> options, ILoggerFactory logger, UrlEncoder encoder) : base(options, logger, encoder) { }
 
  protected override Task HandleChallengeAsync(AuthenticationProperties properties) => Task.CompletedTask;
 

src/Identity/Core/src/IdentityBuilderExtensions.cs

@@ -3,6 +3,8 @@
 
 using System.Diagnostics.CodeAnalysis;
 using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.DependencyInjection.Extensions;
+using Microsoft.Extensions.Options;
 
 namespace Microsoft.AspNetCore.Identity;
 
@@ -36,6 +38,7 @@ private static void AddSignInManagerDeps(this IdentityBuilder builder)
  builder.Services.AddHttpContextAccessor();
  builder.Services.AddScoped(typeof(ISecurityStampValidator), typeof(SecurityStampValidator<>).MakeGenericType(builder.UserType));
  builder.Services.AddScoped(typeof(ITwoFactorSecurityStampValidator), typeof(TwoFactorSecurityStampValidator<>).MakeGenericType(builder.UserType));
+ builder.Services.TryAddEnumerable(ServiceDescriptor.Singleton<IPostConfigureOptions<SecurityStampValidatorOptions>, PostConfigureSecurityStampValidatorOptions>());
  }
 
  /// <summary>
@@ -75,4 +78,20 @@ public static IdentityBuilder AddSignInManager(this IdentityBuilder builder)
  builder.Services.AddScoped(managerType, typeof(TSignInManager));
  return builder;
  }
+
+ // Set TimeProvider from DI on all options instances, if not already set by tests.
+ private sealed class PostConfigureSecurityStampValidatorOptions : IPostConfigureOptions<SecurityStampValidatorOptions>
+ {
+ public PostConfigureSecurityStampValidatorOptions(TimeProvider timeProvider)
+ {
+ TimeProvider = timeProvider;
+ }
+
+ private TimeProvider TimeProvider { get; }
+
+ public void PostConfigure(string? name, SecurityStampValidatorOptions options)
+ {
+ options.TimeProvider ??= TimeProvider;
+ }
+ }
 }

src/Identity/Core/src/IdentityServiceCollectionExtensions.cs

@@ -6,6 +6,7 @@
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Identity;
 using Microsoft.Extensions.DependencyInjection.Extensions;
+using Microsoft.Extensions.Options;
 
 namespace Microsoft.Extensions.DependencyInjection;
 
@@ -92,6 +93,7 @@ public static class IdentityServiceCollectionExtensions
  // No interface for the error describer so we can add errors without rev'ing the interface
  services.TryAddScoped<IdentityErrorDescriber>();
  services.TryAddScoped<ISecurityStampValidator, SecurityStampValidator<TUser>>();
+ services.TryAddEnumerable(ServiceDescriptor.Singleton<IPostConfigureOptions<SecurityStampValidatorOptions>, PostConfigureSecurityStampValidatorOptions>());
  services.TryAddScoped<ITwoFactorSecurityStampValidator, TwoFactorSecurityStampValidator<TUser>>();
  services.TryAddScoped<IUserClaimsPrincipalFactory<TUser>, UserClaimsPrincipalFactory<TUser, TRole>>();
  services.TryAddScoped<IUserConfirmation<TUser>, DefaultUserConfirmation<TUser>>();
@@ -124,4 +126,19 @@ public static IServiceCollection ConfigureApplicationCookie(this IServiceCollect
  /// <returns>The services.</returns>
  public static IServiceCollection ConfigureExternalCookie(this IServiceCollection services, Action<CookieAuthenticationOptions> configure)
  => services.Configure(IdentityConstants.ExternalScheme, configure);
+
+ private sealed class PostConfigureSecurityStampValidatorOptions : IPostConfigureOptions<SecurityStampValidatorOptions>
+ {
+ public PostConfigureSecurityStampValidatorOptions(TimeProvider timeProvider)
+ {
+ TimeProvider = timeProvider;
+ }
+
+ private TimeProvider TimeProvider { get; }
+
+ public void PostConfigure(string? name, SecurityStampValidatorOptions options)
+ {
+ options.TimeProvider ??= TimeProvider;
+ }
+ }
 }

src/Identity/Core/src/PublicAPI.Unshipped.txt

@@ -1,2 +1,7 @@
 #nullable enable
+Microsoft.AspNetCore.Identity.SecurityStampValidator<TUser>.SecurityStampValidator(Microsoft.Extensions.Options.IOptions<Microsoft.AspNetCore.Identity.SecurityStampValidatorOptions!>! options, Microsoft.AspNetCore.Identity.SignInManager<TUser!>! signInManager, Microsoft.Extensions.Logging.ILoggerFactory! logger) -> void
+Microsoft.AspNetCore.Identity.SecurityStampValidator<TUser>.TimeProvider.get -> System.TimeProvider!
+Microsoft.AspNetCore.Identity.SecurityStampValidatorOptions.TimeProvider.get -> System.TimeProvider?
+Microsoft.AspNetCore.Identity.SecurityStampValidatorOptions.TimeProvider.set -> void
+Microsoft.AspNetCore.Identity.TwoFactorSecurityStampValidator<TUser>.TwoFactorSecurityStampValidator(Microsoft.Extensions.Options.IOptions<Microsoft.AspNetCore.Identity.SecurityStampValidatorOptions!>! options, Microsoft.AspNetCore.Identity.SignInManager<TUser!>! signInManager, Microsoft.Extensions.Logging.ILoggerFactory! logger) -> void
 virtual Microsoft.AspNetCore.Identity.SignInManager<TUser>.IsTwoFactorEnabledAsync(TUser! user) -> System.Threading.Tasks.Task<bool>!

src/Identity/Core/src/SecurityStampValidator.cs

@@ -23,13 +23,34 @@ public class SecurityStampValidator<TUser> : ISecurityStampValidator where TUser
  /// <param name="signInManager">The <see cref="SignInManager{TUser}"/>.</param>
  /// <param name="clock">The system clock.</param>
  /// <param name="logger">The logger.</param>
+ [Obsolete("ISystemClock is obsolete, use TimeProvider on SecurityStampValidatorOptions instead.")]
  public SecurityStampValidator(IOptions<SecurityStampValidatorOptions> options, SignInManager<TUser> signInManager, ISystemClock clock, ILoggerFactory logger)
  {
  ArgumentNullException.ThrowIfNull(options);
  ArgumentNullException.ThrowIfNull(signInManager);
  SignInManager = signInManager;
  Options = options.Value;
- Clock = clock;
+ TimeProvider = Options.TimeProvider ?? TimeProvider.System;
+ Clock = new TimeProviderClock(TimeProvider);
+ Logger = logger.CreateLogger(GetType());
+ }
+
+ /// <summary>
+ /// Creates a new instance of <see cref="SecurityStampValidator{TUser}"/>.
+ /// </summary>
+ /// <param name="options">Used to access the <see cref="IdentityOptions"/>.</param>
+ /// <param name="signInManager">The <see cref="SignInManager{TUser}"/>.</param>
+ /// <param name="logger">The logger.</param>
+ public SecurityStampValidator(IOptions<SecurityStampValidatorOptions> options, SignInManager<TUser> signInManager, ILoggerFactory logger)
+ {
+ ArgumentNullException.ThrowIfNull(options);
+ ArgumentNullException.ThrowIfNull(signInManager);
+ SignInManager = signInManager;
+ Options = options.Value;
+ TimeProvider = Options.TimeProvider ?? TimeProvider.System;
+#pragma warning disable CS0618 // Type or member is obsolete
+ Clock = new TimeProviderClock(TimeProvider);
+#pragma warning restore CS0618 // Type or member is obsolete
  Logger = logger.CreateLogger(GetType());
  }
 
@@ -46,8 +67,14 @@ public SecurityStampValidator(IOptions<SecurityStampValidatorOptions> options, S
  /// <summary>
  /// The <see cref="ISystemClock"/>.
  /// </summary>
+ [Obsolete("ISystemClock is obsolete, use TimeProvider instead.")]
  public ISystemClock Clock { get; }
 
+ /// <summary>
+ /// The <see cref="System.TimeProvider"/>.
+ /// </summary>
+ public TimeProvider TimeProvider { get; }
+
  /// <summary>
  /// Gets the <see cref="ILogger"/> used to log messages.
  /// </summary>
@@ -87,7 +114,7 @@ protected virtual async Task SecurityStampVerified(TUser user, CookieValidatePri
  {
  // On renewal calculate the new ticket length relative to now to avoid
  // extending the expiration.
- context.Properties.IssuedUtc = Clock.UtcNow;
+ context.Properties.IssuedUtc = TimeProvider.GetUtcNow();
  }
  }
 
@@ -108,11 +135,7 @@ protected virtual async Task SecurityStampVerified(TUser user, CookieValidatePri
  /// <returns>The <see cref="Task"/> that represents the asynchronous validation operation.</returns>
  public virtual async Task ValidateAsync(CookieValidatePrincipalContext context)
  {
- var currentUtc = DateTimeOffset.UtcNow;
- if (Clock != null)
- {
- currentUtc = Clock.UtcNow;
- }
+ var currentUtc = TimeProvider.GetUtcNow();
  var issuedUtc = context.Properties.IssuedUtc;
 
  // Only validate if enough time has elapsed

src/Identity/Core/src/SecurityStampValidatorOptions.cs

@@ -20,4 +20,9 @@ public class SecurityStampValidatorOptions
  /// Invoked when the default security stamp validator replaces the user's ClaimsPrincipal in the cookie.
  /// </summary>
  public Func<SecurityStampRefreshingPrincipalContext, Task>? OnRefreshingPrincipal { get; set; }
+
+ /// <summary>
+ /// Gives control over the timestamps for testing purposes.
+ /// </summary>
+ public TimeProvider? TimeProvider { get; set; }
 }

src/Identity/Core/src/TimeProviderClock.cs

@@ -0,0 +1,33 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+
+namespace Microsoft.AspNetCore.Authentication;
+
+/// <summary>
+/// Provides access to the normal system clock with precision in seconds.
+/// </summary>
+#pragma warning disable CS0618 // Type or member is obsolete
+internal class TimeProviderClock : ISystemClock
+#pragma warning restore CS0618 // Type or member is obsolete
+{
+ private readonly TimeProvider _timeProvider;
+
+ internal TimeProviderClock() : this(TimeProvider.System) { }
+
+ internal TimeProviderClock(TimeProvider timeProvider)
+ {
+ ArgumentNullException.ThrowIfNull(timeProvider);
+ _timeProvider = timeProvider;
+ }
+
+ public DateTimeOffset UtcNow
+ {
+ get
+ {
+ // the clock measures whole seconds only, to have integral expires_in results, and
+ // because milliseconds do not round-trip serialization formats
+ var utcNowPrecisionSeconds = new DateTime((_timeProvider.GetUtcNow().Ticks / TimeSpan.TicksPerSecond) * TimeSpan.TicksPerSecond, DateTimeKind.Utc);
+ return new DateTimeOffset(utcNowPrecisionSeconds);
+ }
+ }
+}

src/Identity/Core/src/TwoFactorSecurityStampValidator.cs

@@ -22,9 +22,19 @@ public class TwoFactorSecurityStampValidator<TUser> : SecurityStampValidator<TUs
  /// <param name="signInManager">The <see cref="SignInManager{TUser}"/>.</param>
  /// <param name="clock">The system clock.</param>
  /// <param name="logger">The logger.</param>
+ [Obsolete("ISystemClock is obsolete, use TimeProvider on SecurityStampValidatorOptions instead.")]
  public TwoFactorSecurityStampValidator(IOptions<SecurityStampValidatorOptions> options, SignInManager<TUser> signInManager, ISystemClock clock, ILoggerFactory logger) : base(options, signInManager, clock, logger)
  { }
 
+ /// <summary>
+ /// Creates a new instance of <see cref="SecurityStampValidator{TUser}"/>.
+ /// </summary>
+ /// <param name="options">Used to access the <see cref="IdentityOptions"/>.</param>
+ /// <param name="signInManager">The <see cref="SignInManager{TUser}"/>.</param>
+ /// <param name="logger">The logger.</param>
+ public TwoFactorSecurityStampValidator(IOptions<SecurityStampValidatorOptions> options, SignInManager<TUser> signInManager, ILoggerFactory logger) : base(options, signInManager, logger)
+ { }
+
  /// <summary>
  /// Verifies the principal's security stamp, returns the matching user if successful
  /// </summary>