OpenId Connect authentication for new management API

[kjac]

Prerequisites

• I have added steps to test this contribution in the description below

Description

This PR is the foundation for bringing in OpenId Connect as authentication for the new back-office. It is by no means feature complete, but it is fully functional as an MVP implementation. All known remaining tasks can be found in the backlog under Management API - Authentication To-do, including tasks for all TODOs in the code for this PR.

Since we're building the new back-office alongside the current, this new authentication scheme can co-exist with the current cookie based one for a foreseeable future.

We have chosen OpenIddict as the framework for building our OpenId Connect server. For authorization we'll be using the Authorization Code Flow with Proof Key for Code Exchange (PKCE), which is the recommended flow for modern single page applications. It looks something like this:

As per the OpenId Connect standard (and as illustrated above), the server will host its own authentication/login screen seperate from the client. For the time being we'll reuse the existing login dialog with a small tweak (see login.controller.js), which means we won't be blocked by having to create a new client application for login right away - we can create that down the road, thus also properly plan for handling 2FA and 3rd party login providers from the get-go.

Testing this PR

Remember to build the client before testing!

Umbraco back-office

First and foremost make sure you can still login to the back-office as per usual.

Swagger UI

1. Protect an endpoint from the new management API - e.g. add [Authorize(Policy = $"New{AuthorizationPolicies.SectionAccessForMediaTree}")] to MediaTreeControllerBase.
   • Note: $"New{AuthorizationPolicies.SectionAccessForMediaTree}" is one of the new policies that are created for OpenIddict as a proof-of-concept for testing. All policies will have to be reworked as part of finishing up the entire feature.
2. Verify that you can authorize against the endpoint using Swagger UI:
   

Postman

1. Configure a Postman request as follows to create new access tokens using the back-office authorization and token endpoints:
   • "Token Name": Whatever you fancy
   • "Grant Type": Authorization Code (With PKCE)
   • Tick "Authorize using browser"
   • "Auth URL": https://localhost:44331/umbraco/management/api/v1.0/security/back-office/authorize
   • "Access Token URL": https://localhost:44331/umbraco/management/api/v1.0/security/back-office/token
   • "Client ID": umbraco-postman
   • Leave "Client Secret" empty
   • "Code Challenge Method": SHA-256
   • "Code Verifier": Whatever you fancy
   • Leave "Scope" and "State" empty
   • "Client Authentication": Send client credentials in body
2. Hit "Get New Access Token" and verify that you can complete the authorization flow:
   
3. Verify that you can use the obtained access token to authenticate yourself against the protected endpoint from the Swagger test.

Simulated client login

As we do not yet have an actual client to test with, we will make do with simulating the flow in a few manual steps.

1. Make sure you're logged out of Umbraco (use an incognito browser if needed).
2. Call the authorize endpoint in a browser using these magic parameters: https://localhost:44331/umbraco/management/api/v1.0/security/back-office/authorize?client_id=umbraco-back-office&scope=offline_access&response_type=code&code_challenge=WZRHGrsBESr8wYFZ9sx0tPURuZgG2lmzyvWpwXPKz8U&code_challenge_method=S256
   • If the parameters look familiar, it's because they are basically the same as was configured in the Postman test above. In this case, the code_challenge is a hashed and encoded version of the code verifier "12345".
3. You will be redirected to the Umbraco login screen - log in.
4. You will be met by a "page not found" screen. The page URL will contain a code parameter - copy that.
   
5. Use Postman to obtain an access and a refresh token using the token endpoint
   • The token endpoint URL is (still): https://localhost:44331/umbraco/management/api/v1.0/security/back-office/token
   • The request must be a POST using "x-www-form-urlencoded" parameters:
     • "grant_type": authorization_code
     • "client_id": umbraco-back-office
     • "code": The code parameter from the page URL above
     • "code_verifier": 12345
       
6. Verify that you can use the obtained access token to authenticate yourself against the protected endpoint from the Swagger test.
7. Verify that you can obtain a new access token using the refresh token obtained from the token endpoint.
   • You can reuse the Postman request from above, as it still a POST request to the same token endpoint.
   • The parameters should be:
     • "grant_type": refresh_token
     • "client_id": umbraco-back-office
     • "refresh_token": The value of the obtained refresh token
8. Verify that you can use the new access token to authenticate yourself against the protected endpoint.
   • At this point both access tokens will actually work, as old access tokens are not revoked when obtaining new ones. This is by design.
     

[Zeegaan]

Found some small nitpicky things, the rest LGTM 👍

[kjac]

@Zeegaan done done and done 😄

[Zeegaan]

Looks good and tests out great 🎉