update wilson version and add key issuer validation (#2325)

AzureAD · Jul 13, 2023 · bbd6a73 · bbd6a73
1 parent bd99dcd
commit bbd6a73
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 1 deletion.
diff --git a/Directory.Build.props b/Directory.Build.props
@@ -63,7 +63,7 @@
   </PropertyGroup>
 
   <PropertyGroup Label="Common dependency versions">
-    <IdentityModelVersion>6.30.0</IdentityModelVersion>
+    <IdentityModelVersion>6.32.0</IdentityModelVersion>
     <MicrosoftIdentityClientVersion>4.54.1</MicrosoftIdentityClientVersion>
     <FxCopAnalyzersVersion>3.3.0</FxCopAnalyzersVersion>
     <SystemTextEncodingsWebVersion>4.7.2</SystemTextEncodingsWebVersion>

diff --git a/...t.Identity.Web/WebApiExtensions/MicrosoftIdentityWebApiAuthenticationBuilderExtensions.cs b/...t.Identity.Web/WebApiExtensions/MicrosoftIdentityWebApiAuthenticationBuilderExtensions.cs
@@ -15,6 +15,7 @@
 using Microsoft.Extensions.Options;
 using Microsoft.Identity.Web.Resource;
 using Microsoft.IdentityModel.Tokens;
+using Microsoft.IdentityModel.Validators;
 
 namespace Microsoft.Identity.Web
 {
@@ -216,6 +217,8 @@ private static void AddMicrosoftIdentityWebApiImplementation(
                         microsoftIdentityIssuerValidatorFactory.GetAadIssuerValidator(options.Authority).Validate;
                     }
 
+                    mergedOptions.TokenValidationParameters.EnableAadSigningKeyIssuerValidation();
+
                     // If you provide a token decryption certificate, it will be used to decrypt the token
                     // TODO use the credential loader
                     if (mergedOptions.TokenDecryptionCredentials != null)