ApiSecurityConfiguration.cs

using Microsoft.AspNetCore.Authentication.JwtBearer;
using Microsoft.Extensions.Configuration;
using Microsoft.Extensions.DependencyInjection;
using Microsoft.Extensions.Options;
using Microsoft.IdentityModel.Tokens;
using System;
using System.Collections.Generic;
using System.IdentityModel.Tokens.Jwt;
using System.Security.Claims;
using System.Security.Principal;
using System.Text;
using Trivelum.API.Models;

namespace Trivelum.API.Configurations
{
    public static class ApiSecurityConfiguration
    {
        private static byte[] secretKey;
        private static TokenDescriptor tokenDescriptor;

        public static void AddApiSecurity(this IServiceCollection services, IConfiguration configuration)
        {
            if (services == null) throw new ArgumentNullException(nameof(services));

            tokenDescriptor = new TokenDescriptor();
            new ConfigureFromConfigurationOptions<TokenDescriptor>(
                    configuration.GetSection("JwtTokenOptions"))
                .Configure(tokenDescriptor);
            services.AddSingleton(tokenDescriptor);

            secretKey = Encoding.ASCII.GetBytes(configuration["JwtTokenOptions:SecretKey"]);

            services.AddAuthentication(options =>
            {
                options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
                options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
            })
            .AddJwtBearer(bearerOptions =>
            {
                bearerOptions.RequireHttpsMetadata = false;
                bearerOptions.SaveToken = true;

                bearerOptions.TokenValidationParameters = new TokenValidationParameters
                {
                    IssuerSigningKey = new SymmetricSecurityKey(secretKey),
                    ValidAudience = tokenDescriptor.Audience,
                    ValidIssuer = tokenDescriptor.Issuer,

                    ValidateIssuerSigningKey = true,
                    //ValidateIssuer = false,
                    //ValidateAudience = false,
                    ValidateLifetime = true,
                    ClockSkew = TimeSpan.FromMinutes(10) // Considerar possível diferença de data e hora entre servidores
                };
            });

            services.AddAuthorization(options =>
            {
                options.AddPolicy("Turista", policy => { policy.RequireClaim("turista", "1"); });
                options.AddPolicy("Agencia", policy => { policy.RequireClaim("agencia", "1"); });
                options.AddPolicy("Agente", policy => { policy.RequireClaim("agente", "1"); });
                options.AddPolicy("Autenticado", policy => { policy.RequireAuthenticatedUser(); });

                //options.AddPolicy("Bearer", new AuthorizationPolicyBuilder()
                //    .AddAuthenticationSchemes(JwtBearerDefaults.AuthenticationScheme)
                //    .RequireAuthenticatedUser().Build());
            });
        }

        public static string GerarToken(UsuarioViewModel usuarioViewModel)
        {
            var tokenHandler = new JwtSecurityTokenHandler();
            var allClaims = new List<Claim>();
            allClaims.Add(new Claim(JwtRegisteredClaimNames.Sub, usuarioViewModel.Id.ToString()));
            allClaims.Add(new Claim(JwtRegisteredClaimNames.Jti, Guid.NewGuid().ToString()));

            switch (usuarioViewModel.TipoUsuario)
            {
                case TipoUsuario.Turista:
                    {
                        allClaims.Add(new Claim("turista", "1"));
                        break;
                    }
                case TipoUsuario.Agencia:
                    {
                        allClaims.Add(new Claim("agencia", "1"));
                        break;
                    }
                case TipoUsuario.GuiaTurismo:
                    {
                        allClaims.Add(new Claim("agente", "1"));
                        break;
                    }
                case TipoUsuario.Responsavel:
                    {
                        allClaims.Add(new Claim("agente", "1"));
                        break;
                    }
            }

            var minutesValid = tokenDescriptor.MinutesValid;

            if (usuarioViewModel.TipoUsuario == TipoUsuario.Turista || usuarioViewModel.TipoUsuario == TipoUsuario.GuiaTurismo || usuarioViewModel.TipoUsuario == TipoUsuario.Responsavel)
                minutesValid = 525600;

            var securityToken = new SecurityTokenDescriptor
            {
                Audience = tokenDescriptor.Audience,
                Issuer = tokenDescriptor.Issuer,
                Subject = new ClaimsIdentity(
                    new GenericIdentity(usuarioViewModel.Id.ToString(), "Login"),
                    allClaims
                ),
                NotBefore = DateTime.UtcNow.AddMinutes(-15),
                Expires = DateTime.UtcNow.AddMinutes(minutesValid),
                SigningCredentials = new SigningCredentials(new SymmetricSecurityKey(secretKey), SecurityAlgorithms.HmacSha256Signature),
            };

            var token = tokenHandler.CreateToken(securityToken);
            return tokenHandler.WriteToken(token);
        }
    }

    public class TokenDescriptor
    {
        public string Audience { get; set; }
        public string Issuer { get; set; }
        public int MinutesValid { get; set; }
    }
}