feat(auth): support built-in OAuth methods

src/Directory.Packages.props

@@ -50,6 +50,8 @@
     <PackageVersion Include="Microsoft.Extensions.Diagnostics.Testing" Version="10.7.0" />
     <PackageVersion Include="Microsoft.Extensions.FileProviders.Embedded" Version="10.0.9" />
     <PackageVersion Include="Microsoft.Extensions.Hosting.WindowsServices" Version="10.0.9" />
+    <PackageVersion Include="Microsoft.IdentityModel.JsonWebTokens" Version="8.19.2" />
+    <PackageVersion Include="Microsoft.IdentityModel.Protocols.OpenIdConnect" Version="8.19.2" />
     <PackageVersion Include="Microsoft.IO.RecyclableMemoryStream" Version="3.0.1" />
     <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="18.7.0" />
     <PackageVersion Include="Mono.Posix.NETStandard" Version="1.0.0" />

src/EventStore.ClusterNode/ClusterVNodeHostedService.cs

@@ -14,6 +14,7 @@
 using EventStore.Core;
 using EventStore.Core.Authentication;
 using EventStore.Core.Authentication.InternalAuthentication;
+using EventStore.Core.Authentication.OAuth;
 using EventStore.Core.Authentication.PassthroughAuthentication;
 using EventStore.Core.Authorization;
 using EventStore.Core.Certificates;
@@ -246,10 +247,18 @@ AuthenticationProviderFactory GetAuthenticationProviderFactory()
 				return new AuthenticationProviderFactory(_ => new PassthroughAuthenticationProviderFactory());
 			}
 
-			var authenticationTypeToPlugin = new Dictionary<string, AuthenticationProviderFactory> {
+			var authenticationMethodFactories = new Dictionary<string, AuthenticationProviderFactory> {
 				{
-					"internal", new AuthenticationProviderFactory(components =>
+					AuthenticationMethodNames.LegacyInternal, new AuthenticationProviderFactory(components =>
 						new InternalAuthenticationProviderFactory(components, _options.DefaultUser))
+				},
+				{
+					AuthenticationMethodNames.Password, new AuthenticationProviderFactory(components =>
+						new InternalAuthenticationProviderFactory(components, _options.DefaultUser))
+				},
+				{
+					AuthenticationMethodNames.OAuth, new AuthenticationProviderFactory(_ =>
+						new OAuthAuthenticationProviderFactory(_options.Auth.OAuth))
 				}
 			};
 
@@ -261,7 +270,7 @@ AuthenticationProviderFactory GetAuthenticationProviderFactory()
 					Log.Information(
 						"Loaded authentication plugin: {plugin} version {version} (Command Line: {commandLine})",
 						potentialPlugin.Name, potentialPlugin.Version, commandLine);
-					authenticationTypeToPlugin.Add(commandLine,
+					authenticationMethodFactories.Add(commandLine,
 						new AuthenticationProviderFactory(_ =>
 							potentialPlugin.GetAuthenticationProviderFactory(authenticationConfig)));
 				}
@@ -271,14 +280,22 @@ AuthenticationProviderFactory GetAuthenticationProviderFactory()
 				}
 			}
 
-			return authenticationTypeToPlugin.TryGetValue(_options.Auth.AuthenticationType.ToLowerInvariant(),
-				out var factory)
-				? factory
-				: throw new ApplicationInitializationException(
-					$"The authentication type {_options.Auth.AuthenticationType} is not recognised. If this is supposed " +
-					$"to be provided by an authentication plugin, confirm the plugin DLL is located in {Locations.PluginsDirectory}." +
-					Environment.NewLine +
-					$"Valid options for authentication are: {string.Join(", ", authenticationTypeToPlugin.Keys)}.");
+			var methods = AuthenticationMethodNames.FromOptions(_options.Auth);
+			foreach (var method in methods)
+			{
+				if (!authenticationMethodFactories.ContainsKey(method))
+				{
+					throw new ApplicationInitializationException(
+						$"The authentication method {method} is not recognised. If this is supposed " +
+						$"to be provided by an authentication plugin, confirm the plugin DLL is located in {Locations.PluginsDirectory}." +
+						Environment.NewLine +
+						$"Valid options for authentication are: {string.Join(", ", authenticationMethodFactories.Keys)}.");
+				}
+			}
+
+			return new AuthenticationProviderFactory(components =>
+				new CompositeAuthenticationProviderFactory(methods.Select(method =>
+					authenticationMethodFactories[method].GetFactory(components)).ToArray()));
 		}
 
 		static ClusterVNodeOptions LoadSubsystemsPlugins(PluginLoader pluginLoader, ClusterVNodeOptions options)

src/EventStore.ClusterNode/Components/Services/ConfigurationBrowserService.cs

@@ -5,6 +5,7 @@
 using EventStore.Common.Options;
 using EventStore.Common.Utils;
 using EventStore.Core;
+using EventStore.Core.Authentication;
 using EventStore.Core.Data;
 using EventStore.Core.Services;
 using EventStore.Core.Util;
@@ -22,7 +23,7 @@ public ConfigurationPage Read()
 		var features = new[] {
 			new ConfigurationFeature("Projections", options.Projection.RunProjections != ProjectionType.None || options.DevMode.Dev),
 			new ConfigurationFeature("User management",
-				options.Auth.AuthenticationType == Opts.AuthenticationTypeDefault && !options.Application.AuthDisabled())
+				AuthenticationMethodNames.IncludesPassword(options.Auth) && !options.Application.AuthDisabled())
 		};
 
 		var subsystems = hostedService.EnabledNodeSubsystems
@@ -44,7 +45,7 @@ public ConfigurationPage Read()
 			canInspectRuntimeDetails ? new IPEndPoint(options.Interface.NodeIp, options.Interface.NodePort).ToString() : "",
 			canInspectRuntimeDetails ? options.Database.Db : "",
 			canInspectRuntimeDetails ? options.Database.DbLogFormat.ToString() : "",
-			canInspectRuntimeDetails ? options.Auth.AuthenticationType : "",
+			canInspectRuntimeDetails ? string.Join(", ", AuthenticationMethodNames.FromOptions(options.Auth)) : "",
 			canInspectRuntimeDetails ? options.Auth.AuthorizationType : "",
 			options.Application.Insecure,
 			options.Application.TlsDisabled(),

src/EventStore.Core.Tests/Authentication/CompositeAuthenticationProviderTests.cs

@@ -0,0 +1,57 @@
+using System.Collections.Generic;
+using System.Security.Claims;
+using System.Threading.Tasks;
+using EventStore.Core.Authentication;
+using EventStore.Plugins.Authentication;
+using Microsoft.AspNetCore.Http;
+using NUnit.Framework;
+
+namespace EventStore.Core.Tests.Authentication;
+
+[TestFixture]
+public class CompositeAuthenticationProviderTests
+{
+	[Test]
+	public async Task routes_bearer_requests_to_bearer_provider()
+	{
+		var basicProvider = new RecordingAuthenticationProvider(["Basic"]);
+		var bearerProvider = new RecordingAuthenticationProvider(["Bearer"]);
+		var provider = new CompositeAuthenticationProvider([basicProvider, bearerProvider]);
+		var request = new HttpAuthenticationRequest(new DefaultHttpContext(), "jwt-token");
+
+		provider.Authenticate(request);
+		await request.AuthenticateAsync();
+
+		Assert.AreEqual(0, basicProvider.Calls);
+		Assert.AreEqual(1, bearerProvider.Calls);
+	}
+
+	[Test]
+	public async Task routes_password_requests_to_basic_provider()
+	{
+		var basicProvider = new RecordingAuthenticationProvider(["Basic"]);
+		var bearerProvider = new RecordingAuthenticationProvider(["Bearer"]);
+		var provider = new CompositeAuthenticationProvider([basicProvider, bearerProvider]);
+		var request = new HttpAuthenticationRequest(new DefaultHttpContext(), "admin", "changeit");
+
+		provider.Authenticate(request);
+		await request.AuthenticateAsync();
+
+		Assert.AreEqual(1, basicProvider.Calls);
+		Assert.AreEqual(0, bearerProvider.Calls);
+	}
+
+	private sealed class RecordingAuthenticationProvider(IReadOnlyList<string> schemes) : AuthenticationProviderBase
+	{
+		public int Calls { get; private set; }
+
+		public override void Authenticate(AuthenticationRequest authenticationRequest)
+		{
+			Calls++;
+			authenticationRequest.Authenticated(
+				new ClaimsPrincipal(new ClaimsIdentity([new Claim(ClaimTypes.Name, "test")], "test")));
+		}
+
+		public override IReadOnlyList<string> GetSupportedAuthenticationSchemes() => schemes;
+	}
+}

src/EventStore.Core.Tests/Authentication/OAuthAuthenticationProviderTests.cs

@@ -0,0 +1,101 @@
+using System;
+using System.Linq;
+using System.Security.Claims;
+using System.Threading;
+using System.Threading.Tasks;
+using EventStore.Core.Authentication.OAuth;
+using EventStore.Core.Services;
+using EventStore.Plugins.Authentication;
+using Microsoft.AspNetCore.Http;
+using Microsoft.IdentityModel.JsonWebTokens;
+using Microsoft.IdentityModel.Tokens;
+using NUnit.Framework;
+
+namespace EventStore.Core.Tests.Authentication;
+
+[TestFixture]
+public class OAuthAuthenticationProviderTests
+{
+	[Test]
+	public async Task authenticates_valid_bearer_token_and_maps_roles()
+	{
+		var signingKey = new SymmetricSecurityKey(Guid.NewGuid().ToByteArray().Concat(Guid.NewGuid().ToByteArray()).ToArray());
+		var token = CreateToken(signingKey, audience: "eventstore");
+		var provider = new OAuthAuthenticationProvider(
+			new()
+			{
+				Issuer = "https://login.example.test",
+				Audiences = ["eventstore"],
+				NameClaimType = "sub",
+				RoleClaimType = "roles"
+			},
+			logFailedAuthenticationAttempts: false,
+			_ => new ValueTask<TokenValidationParameters>(CreateValidationParameters(signingKey)));
+
+		var request = new HttpAuthenticationRequest(new DefaultHttpContext(), token);
+		provider.Authenticate(request);
+
+		var (status, principal) = await request.AuthenticateAsync();
+
+		Assert.AreEqual(HttpAuthenticationRequestStatus.Authenticated, status);
+		Assert.AreEqual("alice", principal.Identity?.Name);
+		Assert.That(principal.HasClaim(ClaimTypes.Role, SystemRoles.Admins), Is.True);
+	}
+
+	[Test]
+	public async Task rejects_token_with_wrong_audience()
+	{
+		var signingKey = new SymmetricSecurityKey(Guid.NewGuid().ToByteArray().Concat(Guid.NewGuid().ToByteArray()).ToArray());
+		var token = CreateToken(signingKey, audience: "other-service");
+		var provider = new OAuthAuthenticationProvider(
+			new()
+			{
+				Issuer = "https://login.example.test",
+				Audiences = ["eventstore"],
+				NameClaimType = "sub",
+				RoleClaimType = "roles"
+			},
+			logFailedAuthenticationAttempts: false,
+			_ => new ValueTask<TokenValidationParameters>(CreateValidationParameters(signingKey)));
+
+		var request = new HttpAuthenticationRequest(new DefaultHttpContext(), token);
+		provider.Authenticate(request);
+
+		var (status, _) = await request.AuthenticateAsync();
+
+		Assert.AreEqual(HttpAuthenticationRequestStatus.Unauthenticated, status);
+	}
+
+	private static string CreateToken(SecurityKey signingKey, string audience)
+	{
+		var descriptor = new SecurityTokenDescriptor
+		{
+			Issuer = "https://login.example.test",
+			Audience = audience,
+			Subject = new ClaimsIdentity([
+				new Claim("sub", "alice"),
+				new Claim("roles", SystemRoles.Admins)
+			]),
+			NotBefore = DateTime.UtcNow.AddMinutes(-1),
+			Expires = DateTime.UtcNow.AddMinutes(5),
+			SigningCredentials = new SigningCredentials(signingKey, SecurityAlgorithms.HmacSha256)
+		};
+
+		return new JsonWebTokenHandler().CreateToken(descriptor);
+	}
+
+	private static TokenValidationParameters CreateValidationParameters(SecurityKey signingKey) =>
+		new()
+		{
+			ValidateIssuer = true,
+			ValidIssuer = "https://login.example.test",
+			ValidateAudience = true,
+			ValidAudiences = ["eventstore"],
+			ValidateIssuerSigningKey = true,
+			IssuerSigningKey = signingKey,
+			ValidateLifetime = true,
+			ClockSkew = TimeSpan.Zero,
+			NameClaimType = "sub",
+			RoleClaimType = "roles"
+		};
+}

src/EventStore.Core.Tests/Services/Transport/Http/Authentication/authentication_middleware_should.cs

@@ -1,4 +1,5 @@
 using System.Collections.Generic;
+using System.Linq;
 using System.Security.Claims;
 using System.Threading.Tasks;
 using EventStore.Core.Services.Transport.Http;
@@ -50,6 +51,22 @@ public async Task rewrite_anonymous_redirects_without_a_user_agent_to_unauthoriz
 		Assert.AreEqual("X-Basic realm=\"ESDB\"", context.Response.Headers.WWWAuthenticate);
 	}
 
+	[Test]
+	public async Task includes_every_supported_authentication_scheme_in_challenge()
+	{
+		var context = new DefaultHttpContext();
+		var middleware = new AuthenticationMiddleware(
+			[],
+			new TestAuthenticationProvider(["Basic", "Bearer"]));
+
+		await middleware.InvokeAsync(context, _ => Task.CompletedTask);
+
+		Assert.That(context.Response.Headers.WWWAuthenticate.ToArray(), Is.EqualTo(new[] {
+			"X-Basic realm=\"ESDB\"",
+			"X-Bearer realm=\"ESDB\""
+		}));
+	}
+
 	[Test]
 	public async Task preserve_authenticated_redirects_for_non_browser_requests()
 	{
@@ -101,11 +118,11 @@ public bool Authenticate(HttpContext context, out HttpAuthenticationRequest requ
 		}
 	}
 
-	private sealed class TestAuthenticationProvider : AuthenticationProviderBase
+	private sealed class TestAuthenticationProvider(IReadOnlyList<string> schemes = null) : AuthenticationProviderBase
 	{
 		public override void Authenticate(AuthenticationRequest authenticationRequest) =>
 			throw new System.NotImplementedException();
 
-		public override IReadOnlyList<string> GetSupportedAuthenticationSchemes() => ["Basic"];
+		public override IReadOnlyList<string> GetSupportedAuthenticationSchemes() => schemes ?? ["Basic"];
 	}
 }

src/EventStore.Core.XUnit.Tests/Authentication/AuthenticationMethodNamesTests.cs

@@ -0,0 +1,30 @@
+using EventStore.Core.Authentication;
+using FluentAssertions;
+using Xunit;
+
+namespace EventStore.Core.XUnit.Tests.Authentication;
+
+public class AuthenticationMethodNamesTests
+{
+	[Fact]
+	public void defaults_to_password_method()
+	{
+		AuthenticationMethodNames.FromOptions(new()).Should().Equal(AuthenticationMethodNames.Password);
+	}
+
+	[Fact]
+	public void maps_legacy_internal_to_password()
+	{
+		AuthenticationMethodNames.FromOptions(new() { AuthenticationType = "internal" })
+			.Should()
+			.Equal(AuthenticationMethodNames.Password);
+	}
+
+	[Fact]
+	public void normalizes_multiple_methods()
+	{
+		AuthenticationMethodNames.FromOptions(new() { Methods = ["Password", "OAuth", "oauth"] })
+			.Should()
+			.Equal(AuthenticationMethodNames.Password, AuthenticationMethodNames.OAuth);
+	}
+}

src/EventStore.Core/Authentication/AuthenticationMethodNames.cs

@@ -0,0 +1,40 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+
+namespace EventStore.Core.Authentication;
+
+public static class AuthenticationMethodNames
+{
+	public const string LegacyInternal = "internal";
+	public const string Password = "password";
+	public const string OAuth = "oauth";
+
+	public static IReadOnlyList<string> FromOptions(ClusterVNodeOptions.AuthOptions options)
+	{
+		if (!IsLegacyInternal(options.AuthenticationType))
+		{
+			return [Normalize(options.AuthenticationType)];
+		}
+
+		var methods = options.Methods
+			.Where(method => !string.IsNullOrWhiteSpace(method))
+			.Select(Normalize)
+			.Distinct(StringComparer.OrdinalIgnoreCase)
+			.ToArray();
+
+		return methods.Length == 0 ? [Password] : methods;
+	}
+
+	public static bool IncludesPassword(ClusterVNodeOptions.AuthOptions options) =>
+		FromOptions(options).Any(IsPassword);
+
+	public static string Normalize(string method) =>
+		IsLegacyInternal(method) ? Password : method.Trim().ToLowerInvariant();
+
+	public static bool IsPassword(string method) =>
+		string.Equals(Normalize(method), Password, StringComparison.OrdinalIgnoreCase);
+
+	private static bool IsLegacyInternal(string method) =>
+		string.Equals(method?.Trim(), LegacyInternal, StringComparison.OrdinalIgnoreCase);
+}