NFC-99 Web eID for mobile support

.github/workflows/coverity-analysis.yml

@@ -23,7 +23,7 @@ jobs:
       - name: Setup dotnet
         uses: actions/setup-dotnet@v4
         with:
-          dotnet-version: 6.0.x # SDK Version to use.
+          dotnet-version: 10.0.x # SDK Version to use.
 
       - name: Cache Nuget packages
         uses: actions/cache@v4

.github/workflows/dotnet-build-example.yml

@@ -24,7 +24,7 @@ jobs:
       - name: Setup dotnet
         uses: actions/setup-dotnet@v4
         with:
-          dotnet-version: 8.0.x # SDK Version to use.
+          dotnet-version: 10.0.x # SDK Version to use.
 
       - name: Cache Nuget packages      
         uses: actions/cache@v4

.github/workflows/dotnet-build-linux.yml

@@ -20,7 +20,7 @@ jobs:
       - name: Setup dotnet
         uses: actions/setup-dotnet@v4
         with:
-          dotnet-version: 8.0.x # SDK Version to use.
+          dotnet-version: 10.0.x # SDK Version to use.
 
       - name: Cache Nuget packages
         uses: actions/cache@v4

.github/workflows/dotnet-build-windows.yml

@@ -20,7 +20,7 @@ jobs:
       - name: Setup dotnet
         uses: actions/setup-dotnet@v4
         with:
-          dotnet-version: 8.0.x # SDK Version to use.
+          dotnet-version: 10.0.x # SDK Version to use.
 
       - name: Setup MSBuild
         uses: microsoft/setup-msbuild@v1.1
@@ -45,4 +45,4 @@ jobs:
         run: msbuild src/WebEid.Security.sln /t:Build /p:Configuration=Release
 
       - name: Test
-        run: vstest.console.exe src/WebEid.Security.Tests/bin/Release/net8.0/WebEID.Security.Tests.dll
+        run: vstest.console.exe src/WebEid.Security.Tests/bin/Release/net10.0/WebEID.Security.Tests.dll

.github/workflows/sonarcloud-analysis.yml

@@ -20,7 +20,7 @@ jobs:
       - name: Setup dotnet
         uses: actions/setup-dotnet@v4
         with:
-          dotnet-version: 6.0.x # SDK Version to use.
+          dotnet-version: 10.0.x # SDK Version to use.
 
       - name: Set up JDK 21
         uses: actions/setup-java@v4

README.md

@@ -1,6 +1,6 @@
 # web-eid-authtoken-validation-dotnet
 
-![European Regional Development Fund](https://raw.githubusercontent.com/open-eid/DigiDoc4-Client/master/client/images/EL_Regionaalarengu_Fond.png)
+<img src="example/src/WebEid.AspNetCore.Example/wwwroot/img/eu-fund-flags.jpg" width="300" alt="European Regional Development Fund">
 
 Web eID enables usage of European Union electronic identity (eID) smart cards for secure authentication and digital signing of documents on the web using public-key cryptography.
 
@@ -302,6 +302,116 @@ When using standard [ASP.NET cookie authentication](https://docs.microsoft.com/e
     }
     ```
 
+- Similarly, the `MobileAuthInitController` generates a challenge nonce and returns the mobile deep-link for starting the Web eID Mobile authentication flow, and the `MobileAuthLoginController` handles the mobile login request by validating the returned authentication token and creating the authentication cookie.
+    ```cs
+    using System;
+    using System.Text;
+    using Microsoft.AspNetCore.Mvc;
+    using Microsoft.Extensions.Options;
+    using System.Text.Json;
+    using System.Text.Json.Serialization;
+    using Options;
+    using Security.Challenge;
+
+    [ApiController]
+    [Route("auth/mobile")]
+    public class MobileAuthInitController(
+        IChallengeNonceGenerator nonceGenerator,
+        IOptions<WebEidMobileOptions> mobileOptions
+    ) : ControllerBase
+    {
+        private const string WebEidMobileAuthPath = "auth";
+        private const string MobileLoginPath = "/auth/mobile/login";
+
+        [HttpPost("init")]
+        public IActionResult Init()
+        {
+            var challenge = nonceGenerator.GenerateAndStoreNonce(TimeSpan.FromMinutes(5));
+            var challengeBase64 = challenge.Base64EncodedNonce;
+
+            var loginUri = $"{Request.Scheme}://{Request.Host}{MobileLoginPath}";
+
+            var payload = new AuthPayload
+            {
+                Challenge = challengeBase64,
+                LoginUri = loginUri,
+                GetSigningCertificate = mobileOptions.Value.RequestSigningCert ? true : null
+            };
+
+            var json = JsonSerializer.Serialize(payload);
+            var encodedPayload = Convert.ToBase64String(Encoding.UTF8.GetBytes(json));
+
+            var authUri = BuildAuthUri(encodedPayload);
+
+            return Ok(new AuthUri
+            {
+                AuthUriValue = authUri
+            });
+        }
+    ```
+
+    ```cs
+    using Microsoft.AspNetCore.Mvc;
+    using System.Text.Json;
+    using Dto;
+    using Security.Challenge;
+    using Security.Validator;
+    using System.Security.Claims;
+    using System.Threading.Tasks;
+    using Microsoft.AspNetCore.Authentication;
+    using Microsoft.AspNetCore.Authentication.Cookies;
+    using Security.Util;
+
+    [ApiController]
+    [Route("auth/mobile")]
+    public class MobileAuthLoginController(
+        IAuthTokenValidator authTokenValidator,
+        IChallengeNonceStore challengeNonceStore
+    ) : ControllerBase
+    {
+        [HttpPost("login")]
+        public async Task<IActionResult> MobileLogin([FromBody] AuthenticateRequestDto dto)
+        {
+            if (dto?.AuthToken == null)
+            {
+                return BadRequest(new { error = "Missing auth_token" });
+            }
+
+            var parsedToken = dto.AuthToken;
+            var certificate = await authTokenValidator.Validate(
+                parsedToken,
+                challengeNonceStore.GetAndRemove().Base64EncodedNonce);
+
+            var identity = new ClaimsIdentity(CookieAuthenticationDefaults.AuthenticationScheme);
+
+            identity.AddClaim(new Claim(ClaimTypes.GivenName, certificate.GetSubjectGivenName()));
+            identity.AddClaim(new Claim(ClaimTypes.Surname, certificate.GetSubjectSurname()));
+            identity.AddClaim(new Claim(ClaimTypes.NameIdentifier, certificate.GetSubjectIdCode()));
+            identity.AddClaim(new Claim(ClaimTypes.Name, certificate.GetSubjectCn()));
+
+            if (!string.IsNullOrEmpty(parsedToken.UnverifiedSigningCertificate))
+            {
+                identity.AddClaim(new Claim("signingCertificate", parsedToken.UnverifiedSigningCertificate));
+            }
+
+            if (parsedToken.SupportedSignatureAlgorithms != null)
+            {
+                identity.AddClaim(new Claim(
+                    "supportedSignatureAlgorithms",
+                    JsonSerializer.Serialize(parsedToken.SupportedSignatureAlgorithms)));
+            }
+
+            await HttpContext.SignInAsync(
+                CookieAuthenticationDefaults.AuthenticationScheme,
+                new ClaimsPrincipal(identity),
+                new AuthenticationProperties { IsPersistent = false });
+
+            return Ok(new { redirect = "/welcome" });
+        }
+    }
+    ```
+
+
 # Table of contents
 
 * [Introduction](#introduction)

example/README.md

@@ -1,6 +1,6 @@
 # Web eID ASP.NET example
 
-![European Regional Development Fund](https://github.com/open-eid/DigiDoc4-Client/blob/master/client/images/EL_Regionaalarengu_Fond.png)
+<img src="src/WebEid.AspNetCore.Example/wwwroot/img/eu-fund-flags.jpg" width="300" alt="European Regional Development Fund">
 
 This project is an example ASP.NET web application that shows how to implement strong authentication and digital signing with electronic ID smart cards using Web eID.
 
@@ -83,8 +83,8 @@ Set up the `libdigidocpp` library as follows:
 
 1.  Install the _libdigidocpp-4.0.0.8301.x64.msi_ package or higher. The installation packages are available from  [https://github.com/open-eid/libdigidocpp/releases](https://github.com/open-eid/libdigidocpp/releases).
 2.  Copy the C# source files from the `libdigidocpp` installation folder `include\digidocpp_csharp` to the `src\WebEid.AspNetCore.Example\DigiDoc` folder.
-3.  Copy all files from the `libdigidocpp` installation folder to the example application build output folder `bin\Debug\net8.0` (after building, see next step).
-   * Windows: Also copy folder `schema` from `libdigidocpp` installation folder to the example application build output folder `bin\Debug\net8.0`
+3.  Copy all files from the `libdigidocpp` installation folder to the example application build output folder `bin\Debug\net10.0` (after building, see next step).
+   * Windows: Also copy folder `schema` from `libdigidocpp` installation folder to the example application build output folder `bin\Debug\net10.0`
 4.  When running in the `Development` profile, create an empty file named `EE_T.xml` for TSL cache as described in the [_Using test TSL lists_](https://github.com/open-eid/libdigidocpp/wiki/Using-test-TSL-lists#preconditions) section of the `libdigidocpp` wiki.
 
 #### For Ubuntu Linux
@@ -115,7 +115,7 @@ Set up the `libdigidocpp` library as follows:
 
 1.  Install the *libdigidocpp_4.0.0.1460.pkg* package or higher. The installation packages are available from  [https://github.com/open-eid/libdigidocpp/releases](https://github.com/open-eid/libdigidocpp/releases).
 2.  Copy the C# source files from `/Library/libdigidocpp/include/digidocpp_csharp` directory to `src/WebEid.AspNetCore.Example/DigiDoc` directory.
-3.  Go to `bin/Debug/net8.0` directory and create symbolic link to `/Library/libdigidocpp/lib/libdigidoc_csharp.dylib` library:
+3.  Go to `bin/Debug/net10.0` directory and create symbolic link to `/Library/libdigidocpp/lib/libdigidoc_csharp.dylib` library:
     ```cmd
     ln -s /Library/libdigidocpp/lib/libdigidoc_csharp.dylib
     ```
@@ -124,7 +124,7 @@ Further information is available in the [libdigidocpp example C# application sou
 
 ### 5. Build the application
 
-You need to have the [.NET 8.0 SDK](https://dotnet.microsoft.com/en-us/download/dotnet/8.0) installed for building the application package.
+You need to have the [.NET 10.0 SDK](https://dotnet.microsoft.com/en-us/download/dotnet/10.0) installed for building the application package.
 Build the application by running the following command in a terminal window under the `src` directory:
 
 ```cmd
@@ -163,7 +163,8 @@ The `src\WebEid.AspNetCore.Example` directory contains the ASP.NET application s
     -   digital signing,
 -   `DigiDoc`: contains the C# binding files of the `libdigidocpp` library; these files must be copied from the `libdigidocpp` installation directory `\include\digidocpp_csharp`,
 -   `Pages`: Razor pages,
--   `Signing`: Web eID signing service implementation that uses `libdigidocpp`.
+-   `Services`: Web eID signing service implementation that uses `libdigidocpp`.
+-   `Options`: strongly-typed configuration classes for mobile Web eID settings such as `BaseRequestUri` and `RequestSigningCert` (when set to false, initiates a separate signing-certificate flow to demo requesting the certificate without prior authentication, as the signing certificate normally comes from the authentication flow).
 
 ## More information
 
@@ -183,13 +184,13 @@ This section covers the steps required to build the application on an Ubuntu Lin
 
 Before you begin, ensure you have the following installed on your system:
 
-- .NET SDK 8.0
+- .NET SDK 10.0
 - libdigidocpp-csharp
 
 You can install them using the following command:
 
 ```sh
-sudo apt install dotnet-sdk-8.0 libdigidocpp-csharp
+sudo apt install dotnet-sdk-10.0 libdigidocpp-csharp
 ```
 
 Note: Before installing `libdigidocpp-csharp` you have to have added the RIA repository as a package source. See [For Ubuntu Linux section](#for-ubuntu-linux) for information.
@@ -219,7 +220,7 @@ To build the application, follow these steps:
 4. Update the `OriginUrl` in the `appsettings.json` to match your production environment:
 
     ```sh
-    sed -i 's#"OriginUrl": "https://localhost:44391"#"OriginUrl": "https://example.com"#' WebEid.AspNetCore.Example/bin/Release/net6.0/publish/appsettings.json
+    sed -i 's#"OriginUrl": "https://localhost:44391"#"OriginUrl": "https://example.com"#' WebEid.AspNetCore.Example/bin/Release/net10.0/publish/appsettings.json
     ```
 
 ### Building the Docker image

example/src/.dockerignore

@@ -24,4 +24,4 @@
 LICENSE
 README.md
 
-!WebEid.AspNetCore.Example/bin/Release/net8.0/publish/
+!WebEid.AspNetCore.Example/bin/Release/net10.0/publish/

example/src/Dockerfile

@@ -13,7 +13,7 @@ RUN echo "deb [signed-by=/usr/share/keyrings/ria-repository.gpg] https://install
     apt-get clean && \
     rm -rf /var/lib/apt/lists
 
-COPY ./WebEid.AspNetCore.Example/bin/Release/net8.0/publish/ .
+COPY ./WebEid.AspNetCore.Example/bin/Release/net10.0/publish/ .
 
 ENV ASPNETCORE_ENVIRONMENT=Production
 

example/src/WebEid.AspNetCore.Example/Controllers/Api/AuthController.cs

@@ -22,13 +22,16 @@ namespace WebEid.AspNetCore.Example.Controllers.Api
     using Microsoft.AspNetCore.Authentication;
     using Microsoft.AspNetCore.Authentication.Cookies;
     using Microsoft.AspNetCore.Mvc;
+    using Microsoft.AspNetCore.Http;
     using Security.Util;
     using Security.Validator;
     using System.Collections.Generic;
     using System.Security.Claims;
+    using System.Text.Json;
     using System.Threading.Tasks;
     using Security.Challenge;
     using WebEid.AspNetCore.Example.Dto;
+    using WebEid.Security.AuthToken;
     using System;
 
     [Route("[controller]")]
@@ -44,44 +47,73 @@ public AuthController(IAuthTokenValidator authTokenValidator, IChallengeNonceSto
             this.challengeNonceStore = challengeNonceStore;
         }
 
-        [HttpPost]
-        [Route("login")]
-        public async Task Login([FromBody] AuthenticateRequestDto authToken)
+        [HttpPost("login")]
+        public async Task<IActionResult> Login([FromBody] AuthenticateRequestDto dto)
         {
-            var certificate = await this.authTokenValidator.Validate(authToken.AuthToken, this.challengeNonceStore.GetAndRemove().Base64EncodedNonce);
+            try
+            {
+                await SignInUser(dto?.AuthToken);
+                return Ok();
+            }
+            catch (ArgumentNullException)
+            {
+                return BadRequest(new { error = "Missing auth_token" });
+            }
+        }
+
+        [HttpPost("logout")]
+        public async Task Logout()
+        {
+            RemoveUserContainerFile();
+            await HttpContext.SignOutAsync(CookieAuthenticationDefaults.AuthenticationScheme);
+        }
+
+        private async Task SignInUser(WebEidAuthToken authToken)
+        {
+            if (authToken == null)
+            {
+                throw new ArgumentNullException(nameof(authToken), "authToken must not be null");
+            }
 
-            List<Claim> claims = new();
+            var certificate = await authTokenValidator.Validate(authToken, challengeNonceStore.GetAndRemove().Base64EncodedNonce);
+            var claims = new List<Claim>();
 
             AddNewClaimIfCertificateHasData(claims, ClaimTypes.GivenName, certificate.GetSubjectGivenName);
             AddNewClaimIfCertificateHasData(claims, ClaimTypes.Surname, certificate.GetSubjectSurname);
             AddNewClaimIfCertificateHasData(claims, ClaimTypes.NameIdentifier, certificate.GetSubjectIdCode);
             AddNewClaimIfCertificateHasData(claims, ClaimTypes.Name, certificate.GetSubjectCn);
 
-            var claimsIdentity = new ClaimsIdentity(claims, CookieAuthenticationDefaults.AuthenticationScheme);
+            var signingCertificate = authToken.UnverifiedSigningCertificates != null &&
+                                     authToken.UnverifiedSigningCertificates.Count > 0
+                ? authToken.UnverifiedSigningCertificates[0]
+                : null;
 
-            var authProperties = new AuthenticationProperties
+            if (signingCertificate != null && !string.IsNullOrEmpty(signingCertificate.Certificate))
             {
-                AllowRefresh = true
-            };
+                claims.Add(new Claim(
+                    "signingCertificate",
+                    signingCertificate.Certificate));
+            }
+
+            if (signingCertificate?.SupportedSignatureAlgorithms != null)
+            {
+                claims.Add(new Claim(
+                    "supportedSignatureAlgorithms",
+                    JsonSerializer.Serialize(signingCertificate.SupportedSignatureAlgorithms)));
+            }
+
+            var identity = new ClaimsIdentity(claims, CookieAuthenticationDefaults.AuthenticationScheme);
 
             await HttpContext.SignInAsync(
                 CookieAuthenticationDefaults.AuthenticationScheme,
-                new ClaimsPrincipal(claimsIdentity),
-                authProperties);
+                new ClaimsPrincipal(identity),
+                new AuthenticationProperties { AllowRefresh = true });
 
             // Assign a unique ID within the session to enable the use of a unique temporary container name across successive requests.
             // A unique temporary container name is required to facilitate simultaneous signing from multiple browsers.
             SetUniqueIdInSession();
         }
 
-        [HttpGet]
-        [Route("logout")]
-        public async Task Logout()
-        {
-            RemoveUserContainerFile();
-            await HttpContext.SignOutAsync(CookieAuthenticationDefaults.AuthenticationScheme);
-        }
-
         private static void AddNewClaimIfCertificateHasData(List<Claim> claims, string claimType, Func<string> dataGetter) 
         {
             var claimData = dataGetter();