Add and validate custom claims to Simple Web Tokens

Development

Perform the following:

1. Override the SWTFactory class and register it into the ObjectFactory.
   The following example demonstrates how to use the Global.asax file:

   	using System;
   	using System.Security.Claims;
   	using Telerik.Microsoft.Practices.Unity;
   	using Telerik.Sitefinity.Abstractions;
   	using Telerik.Sitefinity.Security.Claims.SWT;
   	namespace SitefinityWebApp
   	{
   	public class Global : System.Web.HttpApplication
   	{
   	protected void Application_Start(object sender, EventArgs e)
   	{
   	Telerik.Sitefinity.Authentication.AuthenticationModule.Initialized += AuthenticationModule_Initialized;
   	}
   	private void AuthenticationModule_Initialized(object sender, EventArgs e)
   	{
   	ObjectFactory.Container.RegisterType<SWTFactory, CustomSWTFactory>(new ContainerControlledLifetimeManager());
   	}
   	private class CustomSWTFactory : SWTFactory
   	{
   	public override SimpleWebToken Build(ClaimsPrincipal principal, string realm)
   	{
   	// Create a custom claim
   	var myClaim = new Claim("MyClaim", "123456789");
   	// Add it to the Claims Identity
   	((ClaimsIdentity)principal.Identity).AddClaim(myClaim);
   	// Call the base login to build the token with the modified principal
   	return base.Build(principal, realm);
   	}
   	}
   	}
   	}

   view raw CustomSWTSecurityTokenHandler_Global.asax.cs hosted with ❤ by GitHub
2. Override the SWTSecurityTokenHandler in the following way:

   	using System;
   	using System.Collections.ObjectModel;
   	using System.IdentityModel.Tokens;
   	using System.Linq;
   	using System.Security.Claims;
   	using Telerik.Sitefinity.Security.Claims.SWT;
   	namespace SitefinityWebApp.Security
   	{
   	public class CustomSWTSecurityTokenHandler : SWTSecurityTokenHandler
   	{
   	public override ReadOnlyCollection<ClaimsIdentity> ValidateToken(SecurityToken token)
   	{
   	// Get the token
   	var swtToken = token as SimpleWebToken;
   	if (swtToken == null)
   	{
   	throw new InvalidOperationException("Token is not a SimpleWebToken");
   	}
   	// Get the custom claim and validate it
   	var myClaim = swtToken.Claims.FirstOrDefault(c => c.Type == "MyClaim");
   	if (myClaim == null)
   	{
   	throw new UnauthorizedAccessException("Unauthorized");
   	}
   	// Call the base validation logic
   	return base.ValidateToken(token);
   	}
   	}
   	}

   view raw CustomSWTSecurityTokenHandler.cs hosted with ❤ by GitHub
3. Register the handler in the web.config, in the following way:

   	<system.identityModel>
   	<identityConfiguration>
   	<securityTokenHandlers>
   	<add type="SitefinityWebApp.Security.CustomSWTSecurityTokenHandler, SitefinityWebApp" />
   	</securityTokenHandlers>
   	</identityConfiguration>
   	</system.identityModel>

   view raw CustomSWTSecurityTokenHandler_web.config.xml hosted with ❤ by GitHub