updates to id web to support authentication handlers than JwtBearer #1493
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,58 @@ | ||
| // Copyright (c) Microsoft Corporation. All rights reserved. | ||
| // Licensed under the MIT License. | ||
|
|
||
| using System; | ||
| using System.Collections.Concurrent; | ||
| using System.Collections.Generic; | ||
| using System.Net.Http; | ||
|
|
||
| namespace Microsoft.Identity.Web.Resource | ||
| { | ||
| /// <summary> | ||
| /// Factory class for creating the AadIssuerValidator per authority. | ||
| /// </summary> | ||
| public class AadIssuerValidatorFactory | ||
| { | ||
| /// <summary> | ||
| /// Initializes a new instance of the <see cref="AadIssuerValidatorFactory"/> class. | ||
| /// </summary> | ||
| /// <param name="httpClient">Optional HttpClient to use to retrieve the endpoint metadata (can be null).</param> | ||
| public AadIssuerValidatorFactory( | ||
| HttpClient? httpClient = null) | ||
| { | ||
| HttpClient = httpClient; | ||
| } | ||
|
|
||
| private readonly IDictionary<string, AadIssuerValidator> _issuerValidators = new ConcurrentDictionary<string, AadIssuerValidator>(); | ||
|
|
||
| private HttpClient? HttpClient { get; } | ||
|
|
||
| /// <summary> | ||
| /// Gets an <see cref="AadIssuerValidator"/> for an authority. | ||
| /// </summary> | ||
| /// <param name="aadAuthority">The authority to create the validator for, e.g. https://login.microsoftonline.com/. </param> | ||
| /// <returns>A <see cref="AadIssuerValidator"/> for the aadAuthority.</returns> | ||
| /// <exception cref="ArgumentNullException">if <paramref name="aadAuthority"/> is null or empty.</exception> | ||
| public AadIssuerValidator GetAadIssuerValidator(string aadAuthority) | ||
| { | ||
| if (string.IsNullOrEmpty(aadAuthority)) | ||
| { | ||
| throw new ArgumentNullException(nameof(aadAuthority)); | ||
| } | ||
|
|
||
| Uri.TryCreate(aadAuthority, UriKind.Absolute, out Uri? authorityUri); | ||
| string authorityHost = authorityUri?.Authority ?? new Uri(IssuerValidatorConstants.FallbackAuthority).Authority; | ||
|
|
||
| if (_issuerValidators.TryGetValue(authorityHost, out AadIssuerValidator? aadIssuerValidator)) | ||
| { | ||
| return aadIssuerValidator; | ||
| } | ||
|
|
||
| _issuerValidators[authorityHost] = new AadIssuerValidator( | ||
| HttpClient, | ||
| aadAuthority); | ||
|
|
||
| return _issuerValidators[authorityHost]; | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
File renamed without changes.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,31 @@ | ||
| // Copyright (c) Microsoft Corporation. All rights reserved. | ||
| // Licensed under the MIT License. | ||
|
|
||
| namespace Microsoft.Identity.Web | ||
| { | ||
| /// <summary> | ||
| /// General constants for Microsoft Identity Web Issuer Validator. | ||
| /// </summary> | ||
| internal class IssuerValidatorConstants | ||
| { | ||
| public const string Organizations = "organizations"; | ||
| public const string Common = "common"; | ||
| public const string OidcEndpoint = "/.well-known/openid-configuration"; | ||
| public const string FallbackAuthority = "https://login.microsoftonline.com/"; | ||
|
|
||
| /// <summary> | ||
| /// Old TenantId claim: "http://schemas.microsoft.com/identity/claims/tenantid". | ||
| /// </summary> | ||
| public const string TenantId = "http://schemas.microsoft.com/identity/claims/tenantid"; | ||
|
|
||
| /// <summary> | ||
| /// New Tenant Id claim: "tid". | ||
| /// </summary> | ||
| public const string Tid = "tid"; | ||
|
|
||
| /// <summary> | ||
| /// Tfp claim: "tfp". | ||
| /// </summary> | ||
| public const string Tfp = "tfp"; | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,17 @@ | ||
| // Copyright (c) Microsoft Corporation. All rights reserved. | ||
| // Licensed under the MIT License. | ||
|
|
||
| namespace Microsoft.Identity.Web | ||
| { | ||
| internal class IssuerValidatorErrorMessage | ||
| { | ||
| // Token Validation IDW10300 = "IDW10300:" | ||
| public const string IssuerMetadataUrlIsRequired = "IDW10301: Azure AD Issuer metadata address URL is required. "; | ||
| public const string NoMetadataDocumentRetrieverProvided = "IDW10302: No metadata document retriever is provided. "; | ||
| public const string IssuerDoesNotMatchValidIssuers = "IDW10303: Issuer: '{0}', does not match any of the valid issuers provided for this application. "; | ||
| public const string B2CTfpIssuerNotSupported = "IDW10304: Microsoft Identity Web does not support a B2C issuer with 'tfp' in the URI. See https://aka.ms/ms-id-web/b2c-issuer for details. "; | ||
|
|
||
| // Protocol IDW10400 = "IDW10400:" | ||
| public const string TenantIdClaimNotPresentInToken = "IDW10401: Neither `tid` nor `tenantId` claim is present in the token obtained from Microsoft identity platform. "; | ||
| } | ||
| } |
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
If TVP.ValidIssuer(s) is empty, AadIssuerV1/2 will be populated only once (no refresh). Is this an issue?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
are you suggesting a refresh after a certain amount of time to check if the metadata has changed?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yes. Not sure if the lack of refresh could be the issue (not expecting issuer to change). Code might be broken if the issuer on the metadata changes so that it doesn't contain {tenantId}, and refresh wouldn't help there.