Feature/dfe entra sso (#157)

Author: FrostyApeOne

DfE.ExternalApplications.Web.sln

@@ -1,7 +1,7 @@
 
 Microsoft Visual Studio Solution File, Format Version 12.00
-# Visual Studio Version 17
-VisualStudioVersion = 17.10.35122.118
+# Visual Studio Version 18
+VisualStudioVersion = 18.4.11605.240 stable
 MinimumVisualStudioVersion = 10.0.40219.1
 Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "DfE.ExternalApplications.Web", "src\DfE.ExternalApplications.Web\DfE.ExternalApplications.Web.csproj", "{CA38CBED-6681-4A44-BEC8-832D5171D59F}"
 EndProject

src/DfE.ExternalApplications.Application/DfE.ExternalApplications.Application.csproj

@@ -7,9 +7,10 @@
   </PropertyGroup>
 
   <ItemGroup>
-	  <PackageReference Include="GovUK.Dfe.ExternalApplications.Api.Client" Version="0.1.42-prerelease-7" />
+	  <PackageReference Include="GovUK.Dfe.ExternalApplications.Api.Client" Version="0.1.43" />
     <PackageReference Include="Microsoft.AspNetCore.Http.Features" Version="2.3.0" />
     <PackageReference Include="Microsoft.AspNetCore.Mvc.Abstractions" Version="2.3.0" />
+    <PackageReference Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="9.0.0" />
   </ItemGroup>
 
   <ItemGroup>

src/DfE.ExternalApplications.Web/DfE.ExternalApplications.Web.csproj

@@ -11,7 +11,7 @@
 	</PropertyGroup>
 
 	<ItemGroup>
-		<PackageReference Include="GovUK.Dfe.CoreLibs.Security" Version="1.1.21-prerelease-15" />
+		<PackageReference Include="GovUK.Dfe.CoreLibs.Security" Version="1.1.25-prerelease-11" />
 		<PackageReference Include="GovUk.Frontend.AspNetCore" Version="3.2.2" />
 		<PackageReference Include="HtmlSanitizer" Version="9.0.892" />
 		<PackageReference Include="Markdig" Version="0.42.0" />

src/DfE.ExternalApplications.Web/Program.cs

@@ -26,6 +26,7 @@
 using Microsoft.AspNetCore.Mvc.ViewFeatures;
 using Microsoft.AspNetCore.ResponseCompression;
 using System.Diagnostics.CodeAnalysis;
+using GovUK.Dfe.CoreLibs.Security.EntraSso;
 using GovUK.Dfe.CoreLibs.Security.TokenRefresh.Extensions;
 using System.IO.Compression;
 using DfE.ExternalApplications.Infrastructure.Consumers;
@@ -146,6 +147,12 @@ static void BindNestedConfiguration(ConfigurationManager config, string parentKe
 var testAuthOptions = configuration.GetSection(TestAuthenticationOptions.SectionName).Get<TestAuthenticationOptions>();
 var isTestAuthEnabled = testAuthOptions?.Enabled ?? false;
 
+// Configure Entra SSO options
+builder.Services.Configure<EntraSsoOptions>(
+    configuration.GetSection(EntraSsoOptions.SectionName));
+var entraSsoOptions = configuration.GetSection(EntraSsoOptions.SectionName).Get<EntraSsoOptions>();
+var isEntraSsoEnabled = entraSsoOptions?.Enabled ?? false;
+
 // Configure token settings for test authentication
 // This is needed when test auth is enabled
 if ((isTestAuthEnabled) && testAuthOptions != null)
@@ -299,7 +306,30 @@ static void BindNestedConfiguration(ConfigurationManager config, string parentKe
         options => { })
     .AddScheme<InternalServiceAuthenticationSchemeOptions, InternalServiceAuthenticationHandler>(
         InternalServiceAuthenticationHandler.SchemeName,
-        options => { });
+        options => { })
+    .AddEntraSso(configuration, sectionName: EntraSsoDefaults.ConfigurationSection, new OpenIdConnectEvents
+    {
+        OnRemoteFailure = context =>
+        {
+            var error = context.Failure?.Message ?? "Unknown error";
+
+            if (error.Contains("message.State", StringComparison.OrdinalIgnoreCase))
+            {
+                context.Response.Redirect("/");
+                context.HandleResponse();
+                return Task.CompletedTask;
+            }
+
+            return Task.CompletedTask;
+        },
+
+        OnAuthenticationFailed = context =>
+        {
+            context.HandleResponse();
+            context.Response.Redirect("/error?message=" + Uri.EscapeDataString(context.Exception.Message));
+            return Task.CompletedTask;
+        }
+    });
 
 // Use DynamicAuthenticationSchemeProvider to route per request
 // Checks for Internal Service Auth (forwarder pattern)
@@ -332,6 +362,7 @@ static void BindNestedConfiguration(ConfigurationManager config, string parentKe
 builder.Services.AddScoped<OidcAuthenticationStrategy>();
 builder.Services.AddScoped<TestAuthenticationStrategy>();
 builder.Services.AddScoped<InternalAuthenticationStrategy>();
+builder.Services.AddScoped<EntraSsoAuthenticationStrategy>();
 builder.Services.AddScoped<IAuthenticationSchemeStrategy, CompositeAuthenticationSchemeStrategy>();
 
 // Register activity-based token refresh services

src/DfE.ExternalApplications.Web/Security/CompositeAuthenticationSchemeStrategy.cs

@@ -10,53 +10,55 @@ namespace DfE.ExternalApplications.Web.Security;
 
 /// <summary>
 /// Chooses the appropriate authentication strategy per-request.
-/// - TestAuth when globally enabled or the request is a valid Cypress request (and toggle allowed)
-/// - OIDC otherwise
+/// Priority: Internal Auth > Test Auth > Entra SSO (when enabled) > DfE Sign-In OIDC
 /// </summary>
 public class CompositeAuthenticationSchemeStrategy(
     ILogger<CompositeAuthenticationSchemeStrategy> logger,
     IHttpContextAccessor httpContextAccessor,
     IOptions<TestAuthenticationOptions> testAuthOptions,
+    IOptions<EntraSsoOptions> entraSsoOptions,
     IConfiguration configuration,
     OidcAuthenticationStrategy oidcStrategy,
     TestAuthenticationStrategy testStrategy,
     InternalAuthenticationStrategy internalStrategy,
+    EntraSsoAuthenticationStrategy entraSsoStrategy,
     [FromKeyedServices("internal")] ICustomRequestChecker internalRequestChecker
     ) : IAuthenticationSchemeStrategy
 {
     private bool IsTestEnabled() => testAuthOptions.Value.Enabled;
 
+    private bool IsEntraSsoEnabled() => entraSsoOptions.Value.Enabled;
+
     private bool IsInternalAuthRequest()
     {
         var ctx = httpContextAccessor.HttpContext;
         if (ctx == null) return false;
-        // Request checker may be null in some DI graphs; treat as false
         return internalRequestChecker != null && internalRequestChecker.IsValidRequest(ctx);
     }
 
     private IAuthenticationSchemeStrategy Select()
     {
         var ctx = httpContextAccessor.HttpContext;
         var path = ctx?.Request.Path.ToString() ?? "unknown";
-        var isTestEnabled = IsTestEnabled();
-        var isInternalAuth = IsInternalAuthRequest();
 
-        if (isInternalAuth)
+        if (IsInternalAuthRequest())
         {
-            logger.LogDebug(
-                "Selecting InternalAuthenticationStrategy for {Path}.",
-                path);
+            logger.LogDebug("Selecting InternalAuthenticationStrategy for {Path}.", path);
             return internalStrategy;
         }
 
-        if (isTestEnabled)
+        if (IsTestEnabled())
         {
-            logger.LogDebug(
-                "Selecting TestAuthenticationStrategy for {Path}. TestEnabled: {TestEnabled}",
-                path, isTestEnabled);
+            logger.LogDebug("Selecting TestAuthenticationStrategy for {Path}.", path);
             return testStrategy;
         }
-        
+
+        if (IsEntraSsoEnabled())
+        {
+            logger.LogDebug("Selecting EntraSsoAuthenticationStrategy for {Path}.", path);
+            return entraSsoStrategy;
+        }
+
         logger.LogDebug("Selecting OidcAuthenticationStrategy for {Path}", path);
         return oidcStrategy;
     }
@@ -75,5 +77,3 @@ public Task<bool> RefreshExternalIdpTokenAsync(HttpContext context)
     public string? GetUserId(HttpContext context)
         => Select().GetUserId(context);
 }
-
-

src/DfE.ExternalApplications.Web/Security/DynamicAuthenticationSchemeProvider.cs

@@ -1,5 +1,6 @@
 using DfE.ExternalApplications.Web.Authentication;
 using GovUK.Dfe.CoreLibs.Security.Configurations;
+using GovUK.Dfe.CoreLibs.Security.EntraSso;
 using GovUK.Dfe.CoreLibs.Security.Interfaces;
 using Microsoft.AspNetCore.Authentication;
 using Microsoft.AspNetCore.Authentication.Cookies;
@@ -16,13 +17,14 @@ namespace DfE.ExternalApplications.Web.Security;
 /// Priority order:
 /// 1. If X-Service-Email header present: Uses Internal Service Auth (header-based forwarder)
 /// 2. If TestAuthentication.Enabled is true: Uses Test scheme for all
-/// 3. If AllowToggle is true AND request is from Cypress: Uses Test scheme
-/// 4. Otherwise: Uses OIDC (Cookies + OIDC challenge/sign-out)
+/// 3. If EntraSso.Enabled is true: Uses Entra SSO scheme
+/// 4. Otherwise: Uses DfE Sign-In OIDC (Cookies + OIDC challenge/sign-out)
 /// </summary>
 public class DynamicAuthenticationSchemeProvider(
     IOptions<AuthenticationOptions> options,
     IHttpContextAccessor httpContextAccessor,
     IOptions<TestAuthenticationOptions> testAuthOptions,
+    IOptions<EntraSsoOptions> entraSsoOptions,
     IConfiguration configuration)
     : AuthenticationSchemeProvider(options)
 {
@@ -33,7 +35,6 @@ private bool IsTestAuthGloballyEnabled()
 
     private bool ShouldUseTestAuth()
     {
-        // Always use test auth if globally enabled
         if (IsTestAuthGloballyEnabled())
         {
             return true;
@@ -42,88 +43,83 @@ private bool ShouldUseTestAuth()
         return false;
     }
 
+    private bool IsEntraSsoEnabled()
+    {
+        return entraSsoOptions.Value.Enabled;
+    }
+
     private bool IsInternalServiceRequest()
     {
         var httpContext = httpContextAccessor.HttpContext;
         if (httpContext == null) return false;
 
-        // Only engage Internal Service Auth if X-Service-Email header is present
         return httpContext.Request.Headers.ContainsKey("x-service-email");
     }
 
+    private string GetDefaultIdpScheme()
+    {
+        return IsEntraSsoEnabled()
+            ? EntraSsoDefaults.AuthenticationScheme
+            : OpenIdConnectDefaults.AuthenticationScheme;
+    }
+
     public override Task<AuthenticationScheme?> GetDefaultAuthenticateSchemeAsync()
     {
-        // PRIORITY 1: Internal Service Authentication (check header first - fastest)
         if (IsInternalServiceRequest())
         {
             return GetSchemeAsync(InternalServiceAuthenticationHandler.SchemeName);
         }
 
-        // PRIORITY 2: Test Authentication (if enabled or Cypress)
         if (ShouldUseTestAuth())
         {
             return GetSchemeAsync(TestAuthenticationHandler.SchemeName);
         }
 
-        // PRIORITY 3: Default to OIDC (Cookies)
         return GetSchemeAsync(CookieAuthenticationDefaults.AuthenticationScheme);
     }
 
     public override Task<AuthenticationScheme?> GetDefaultChallengeSchemeAsync()
     {
-        // Internal Service requests don't challenge - they authenticate directly
         if (IsInternalServiceRequest())
         {
             return GetSchemeAsync(InternalServiceAuthenticationHandler.SchemeName);
         }
 
-        // Test Auth uses its own challenge
         if (ShouldUseTestAuth())
         {
             return GetSchemeAsync(TestAuthenticationHandler.SchemeName);
         }
 
-        // Regular users: OIDC challenge (login page)
-        return GetSchemeAsync(OpenIdConnectDefaults.AuthenticationScheme);
+        return GetSchemeAsync(GetDefaultIdpScheme());
     }
 
     public override Task<AuthenticationScheme?> GetDefaultForbidSchemeAsync()
     {
-        // Don't call GetDefaultChallengeSchemeAsync here as it might trigger recursion
-        // Instead, inline the logic with the cached result
-        
-        // Internal Service requests
         if (IsInternalServiceRequest())
         {
             return GetSchemeAsync(InternalServiceAuthenticationHandler.SchemeName);
         }
 
-        // Test Auth
         if (ShouldUseTestAuth())
         {
             return GetSchemeAsync(TestAuthenticationHandler.SchemeName);
         }
 
-        // Regular users: OIDC
-        return GetSchemeAsync(OpenIdConnectDefaults.AuthenticationScheme);
+        return GetSchemeAsync(GetDefaultIdpScheme());
     }
 
     public override Task<AuthenticationScheme?> GetDefaultSignInSchemeAsync()
     {
-        // Always use Cookies for sign-in
         return GetSchemeAsync(CookieAuthenticationDefaults.AuthenticationScheme);
     }
 
     public override Task<AuthenticationScheme?> GetDefaultSignOutSchemeAsync()
     {
         if (ShouldUseTestAuth())
         {
-            // Test auth signs out cookies only
             return GetSchemeAsync(CookieAuthenticationDefaults.AuthenticationScheme);
         }
-        // OIDC sign-out triggers federated sign-out
-        return GetSchemeAsync(OpenIdConnectDefaults.AuthenticationScheme);
+
+        return GetSchemeAsync(GetDefaultIdpScheme());
     }
 }
-
-