Add server-side OpenID Connect sessions

.ai/skills/scheduled-task.md

@@ -135,6 +135,7 @@ public class ScheduleTask : BaseEntity
 | `GenerateSitemapXmlTask` | `"Generate sitemap XML file"` | 10080 min | false |
 | `EndAuctionsTask` | `"End of the auctions"` | 60 min | false |
 | `CancelOrderScheduledTask` | `"Cancel unpaid and pending orders"` | 1440 min | false |
+| `DeleteOidcSessionsScheduleTask` | `"Delete OpenID Connect sessions"` | 1440 min | true |
 
 ## Expected Output
 Produce one of these results:

src/Business/Grand.Business.Authentication/Services/CookieAuthenticationService.cs

@@ -7,6 +7,7 @@
 using Grand.Infrastructure.Configuration;
 using Microsoft.AspNetCore.Authentication;
 using Microsoft.AspNetCore.Http;
+using Microsoft.Extensions.Logging;
 using System.Security.Claims;
 
 namespace Grand.Business.Authentication.Services;
@@ -26,20 +27,26 @@ public class CookieAuthenticationService : IGrandAuthenticationService
     /// <param name="groupService">Group service</param>
     /// <param name="httpContextAccessor">HTTP context accessor</param>
     /// <param name="securityConfig">SecurityConfig</param>
+    /// <param name="oidcSessionService">Server-side sessions of provider sign-ins</param>
+    /// <param name="logger">Logger</param>
     public CookieAuthenticationService(
         CustomerSettings customerSettings,
         ICustomerService customerService,
         IGroupService groupService,
         IHttpContextAccessor httpContextAccessor,
         ICookieOptionsFactory cookieOptionsFactory,
-        SecurityConfig securityConfig)
+        SecurityConfig securityConfig,
+        IOidcSessionService oidcSessionService,
+        ILogger<CookieAuthenticationService> logger)
     {
         _customerSettings = customerSettings;
         _customerService = customerService;
         _groupService = groupService;
         _httpContextAccessor = httpContextAccessor;
         _cookieOptionsFactory = cookieOptionsFactory;
         _securityConfig = securityConfig;
+        _oidcSessionService = oidcSessionService;
+        _logger = logger;
     }
 
     #endregion
@@ -63,6 +70,8 @@ public CookieAuthenticationService(
     private readonly ICookieOptionsFactory _cookieOptionsFactory;
 
     private readonly SecurityConfig _securityConfig;
+    private readonly IOidcSessionService _oidcSessionService;
+    private readonly ILogger<CookieAuthenticationService> _logger;
 
     #endregion
 
@@ -77,6 +86,44 @@ public virtual async Task SignIn(Customer customer, bool isPersistent)
     {
         ArgumentNullException.ThrowIfNull(customer);
 
+        //a re-sign-in of the same customer (password, e-mail or username change) keeps the server-side
+        //session of a provider sign-in, so idle/max lifetime, revalidation and back-channel logout still apply
+        await SignIn(customer, isPersistent, await CurrentOidcSessionIdOf(customer));
+    }
+
+    private async Task<string> CurrentOidcSessionIdOf(Customer customer)
+    {
+        if (_httpContextAccessor.HttpContext == null || string.IsNullOrEmpty(customer.Id))
+            return null;
+
+        var authenticateResult = await _httpContextAccessor.HttpContext.AuthenticateAsync(
+            GrandCookieAuthenticationDefaults.AuthenticationScheme);
+        if (authenticateResult?.Succeeded != true)
+            return null;
+
+        var customerId = authenticateResult.Principal?.FindFirst(claim =>
+            claim.Type == CustomerIdClaimType &&
+            claim.Issuer.Equals(_securityConfig.CookieClaimsIssuer, StringComparison.InvariantCultureIgnoreCase))?.Value;
+
+        return customerId == customer.Id ? OidcSessionId(authenticateResult.Principal) : null;
+    }
+
+    /// <summary>
+    ///     Sign in with a session started at the identity provider
+    /// </summary>
+    /// <param name="customer">Customer</param>
+    /// <param name="isPersistent">Whether the authentication session is persisted across multiple requests</param>
+    /// <param name="oidcSessionId">Id of the OidcSession; null or empty = an ordinary sign-in</param>
+    public virtual async Task SignIn(Customer customer, bool isPersistent, string oidcSessionId)
+    {
+        ArgumentNullException.ThrowIfNull(customer);
+
+        //the same customer signing in through the provider again: the cookie that referenced the previous session is
+        //replaced, so that session would never be used or ended again
+        if (!string.IsNullOrEmpty(oidcSessionId) &&
+            await CurrentOidcSessionIdOf(customer) is { Length: > 0 } previous && previous != oidcSessionId)
+            await EndOidcSession(previous);
+
         //create claims for customer's username and email
         var claims = new List<Claim>();
 
@@ -109,6 +156,11 @@ public virtual async Task SignIn(Customer customer, bool isPersistent)
                 _securityConfig.CookieClaimsIssuer));
         }
 
+        //the server-side session of a provider sign-in: ending it ends this cookie
+        if (!string.IsNullOrEmpty(oidcSessionId))
+            claims.Add(new Claim(OidcSessionDefaults.SessionIdClaimType, oidcSessionId, ClaimValueTypes.String,
+                _securityConfig.CookieClaimsIssuer));
+
         //create principal for the present scheme of authentication
         var userIdentity = new ClaimsIdentity(claims, GrandCookieAuthenticationDefaults.AuthenticationScheme);
         var userPrincipal = new ClaimsPrincipal(userIdentity);
@@ -137,6 +189,12 @@ public virtual async Task SignOut()
         //and then sign out customer from the present scheme of authentication
         if (_httpContextAccessor.HttpContext != null)
         {
+            var authenticateResult = await _httpContextAccessor.HttpContext.AuthenticateAsync(
+                GrandCookieAuthenticationDefaults.AuthenticationScheme);
+            var oidcSessionId = authenticateResult?.Succeeded == true ? OidcSessionId(authenticateResult.Principal) : null;
+            if (!string.IsNullOrEmpty(oidcSessionId))
+                await EndOidcSession(oidcSessionId);
+
             await _httpContextAccessor.HttpContext.SignOutAsync(GrandCookieAuthenticationDefaults
                 .AuthenticationScheme);
             //sign out also from other schema
@@ -215,8 +273,32 @@ private async Task<bool> IsValidCustomer(Customer customer, ClaimsPrincipal prin
         if (!customer.Active || customer.Deleted || !await _groupService.IsRegistered(customer))
             return false;
 
+        //a provider sign-in: the server-side session decides (ended, idle, refused by the provider)
+        var oidcSessionId = OidcSessionId(principal);
+        if (!string.IsNullOrEmpty(oidcSessionId) && !await _oidcSessionService.Validate(oidcSessionId, customer))
+            return false;
+
         return true;
     }
+
+    private async Task EndOidcSession(string sessionId)
+    {
+        try
+        {
+            await _oidcSessionService.End(sessionId, OidcSessionEndReason.SignOut);
+        }
+        catch (Exception ex)
+        {
+            //the cookie that referenced it is replaced anyway; the record goes with the cleanup task
+            _logger.LogWarning(ex, "Could not end the OpenID Connect session {SessionId}", sessionId);
+        }
+    }
+
+    private string OidcSessionId(ClaimsPrincipal principal) =>
+        principal?.FindFirst(claim =>
+            claim.Type == OidcSessionDefaults.SessionIdClaimType &&
+            claim.Issuer.Equals(_securityConfig.CookieClaimsIssuer, StringComparison.InvariantCultureIgnoreCase))?.Value;
+
     /// <summary>
     ///     Get customer cookie
     /// </summary>

src/Business/Grand.Business.Authentication/Services/OidcCustomerResolver.cs

@@ -1,4 +1,5 @@
 using Grand.Business.Core.Events.Customers;
+using Grand.Business.Core.Extensions;
 using Grand.Business.Core.Interfaces.Authentication;
 using Grand.Business.Core.Interfaces.Common.Configuration;
 using Grand.Business.Core.Interfaces.Common.Directory;
@@ -451,7 +452,6 @@ private async Task<bool> HasTwoFactor(Customer customer, string storeId) =>
     private async Task<bool> RequiresPassword(Customer customer, string storeId) =>
         await IsBackOfficeAccount(customer) || await HasTwoFactor(customer, storeId);
 
-    private async Task<bool> IsBackOfficeAccount(Customer customer) =>
-        !string.IsNullOrEmpty(customer.VendorId) || !string.IsNullOrEmpty(customer.StaffStoreId) ||
-        await _permissionService.Authorize(StandardPermission.ManageAccessAdminPanel, customer);
+    private Task<bool> IsBackOfficeAccount(Customer customer) =>
+        _permissionService.IsBackOfficeAccount(customer);
 }