Skip to content

Handle tailing slashes in configured Authority and Instance #278

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 4 commits into from
Feb 9, 2020
Merged

Handle tailing slashes in configured Authority and Instance #278

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
f7d36be
Updated references to 3.1.1
Feb 3, 2020
6923d78
Handle tailing slash and 'v2.0' in configured Authority value in AddP…
Feb 3, 2020
bb67b33
Only add api:// to valid audiences if given as Client Id (not beginni…
Feb 3, 2020
17d122e
Handle optional configured ending slash for Instance.
Feb 4, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions Microsoft.Identity.Web/Microsoft.Identity.Web.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,7 @@
</ItemGroup>

<ItemGroup Label="Build Tools" Condition="$([MSBuild]::IsOsPlatform('Windows'))">
<PackageReference Include="Microsoft.SourceLink.GitHub" Version="1.0.0-beta2-18618-05" PrivateAssets="All" />
<PackageReference Include="Microsoft.SourceLink.GitHub" Version="1.0.0" PrivateAssets="All" />
</ItemGroup>


Expand All @@ -53,9 +53,9 @@
</PropertyGroup>

<ItemGroup>
<PackageReference Include="Microsoft.AspNetCore.Authentication.AzureAD.UI" Version="3.0.0" />
<PackageReference Include="Microsoft.AspNetCore.Authentication.AzureADB2C.UI" Version="3.0.0" />
<PackageReference Include="Microsoft.Extensions.DependencyInjection" Version="3.0.1" />
<PackageReference Include="Microsoft.AspNetCore.Authentication.AzureAD.UI" Version="3.1.1" />
<PackageReference Include="Microsoft.AspNetCore.Authentication.AzureADB2C.UI" Version="3.1.1" />
<PackageReference Include="Microsoft.Extensions.DependencyInjection" Version="3.1.1" />
<PackageReference Include="Microsoft.Identity.Client" Version="4.8.1" />
</ItemGroup>
</Project>
3 changes: 3 additions & 0 deletions Microsoft.Identity.Web/TokenAcquisition.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -264,6 +264,9 @@ private IConfidentialClientApplication BuildConfidentialClientApplication()
request.PathBase,
azureAdOptions.CallbackPath ?? string.Empty);

if (!applicationOptions.Instance.EndsWith("/"))
applicationOptions.Instance += "/";

string authority = $"{applicationOptions.Instance}{applicationOptions.TenantId}/";

var app = ConfidentialClientApplicationBuilder
Expand Down
18 changes: 11 additions & 7 deletions Microsoft.Identity.Web/WebApiServiceCollectionExtensions.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,13 +53,17 @@ public static IServiceCollection AddProtectedWebApi(
configuration.Bind(configSectionName, options);

// This is an Microsoft identity platform Web API
options.Authority += "/v2.0";
var authority = options.Authority.Trim().TrimEnd('/');
if (!authority.EndsWith("v2.0"))
authority += "/v2.0";
options.Authority = authority;

// The valid audiences are both the Client ID (options.Audience) and api://{ClientID}
options.TokenValidationParameters.ValidAudiences = new string[]
{
options.Audience, $"api://{options.Audience}"
};
// The valid audience could be given as Client Id or as Uri. If it does not start with 'api://', this variant is added to the list of valid audiences.
var validAudiences = new List<string> { options.Audience };
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

new List [](start = 37, length = 16)

I think we should do a HashSet<string> here instead of a List<string>

if (!options.Audience.StartsWith("api://", StringComparison.OrdinalIgnoreCase))
validAudiences.Add($"api://{options.Audience}");

options.TokenValidationParameters.ValidAudiences = validAudiences;

// Instead of using the default validation (validating against a single tenant, as we do in line of business apps),
// we inject our own multi-tenant validation logic (which even accepts both v1.0 and v2.0 tokens)
Expand Down Expand Up @@ -127,4 +131,4 @@ public static IServiceCollection AddProtectedApiCallsWebApis(
return services;
}
}
}
}