Skip to content

Jennyf/b2cwebapi #296

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 6 commits into from
Feb 16, 2020
Merged

Jennyf/b2cwebapi #296

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
b931371
Merge pull request #286 from Azure-Samples/jmprieur/webappwebapib2c
jennyf19 Feb 10, 2020
5cc9253
Fixing a build break
jmprieur Feb 15, 2020
9e83c74
Merging
jmprieur Feb 15, 2020
81c281e
Fixing the configuration and a problem brought bad a by merge by jmpr…
jmprieur Feb 16, 2020
2962513
add uitid to the claims for b2c
jennyf19 Feb 16, 2020
41c3eae
Merge branch 'jennyf/b2cwebapi' of https://github.com/Azure-Samples/a…
jennyf19 Feb 16, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 0 additions & 3 deletions .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,9 +39,6 @@
/2-WebApp-graph-user/2-2-TokenCache/.vs
/2-WebApp-graph-user/2-2-TokenCache/bin
/2-WebApp-graph-user/2-2-TokenCache/obj
/2-WebApp-graph-user/2-3-Best-Practices/.vs
/2-WebApp-graph-user/2-3-Best-Practices/bin
/2-WebApp-graph-user/2-3-Best-Practices/obj
/2-WebApp-graph-user/2-3-Multi-Tenant/.vs
/2-WebApp-graph-user/2-3-Multi-Tenant/bin
/2-WebApp-graph-user/2-3-Multi-Tenant/obj
Expand Down
6 changes: 3 additions & 3 deletions 4-WebApp-your-API/Client/Properties/launchSettings.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,8 +3,8 @@
"windowsAuthentication": false,
"anonymousAuthentication": true,
"iisExpress": {
"applicationUrl": "https://localhost:44316/",
"sslPort": 44316
"applicationUrl": "https://localhost:5000/",
"sslPort": 5000
}
},
"profiles": {
Expand All @@ -14,7 +14,7 @@
"environmentVariables": {
"ASPNETCORE_ENVIRONMENT": "Development"
},
"applicationUrl": "https://localhost:44316"
"applicationUrl": "https://localhost:5000"
}
}
}
2 changes: 1 addition & 1 deletion 4-WebApp-your-API/Client/Startup.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,7 @@ public void ConfigureServices(IServiceCollection services)
services.AddOptions();

services.AddAuthentication(OpenIdConnectDefaults.AuthenticationScheme)
.AddSignIn("AzureAdB2C", Configuration, options => Configuration.Bind("AzureAdB2C", options));
.AddSignIn("AzureAdB2C", Configuration, options => Configuration.Bind("AzureAdB2C", options), subscribeToOpenIdConnectMiddlewareDiagnosticsEvents:true);

// This is required to be instantiated before the OpenIdConnectOptions starts getting configured.
// By default, the claims mapping will map claim names in the old format to accommodate older SAML applications.
Expand Down
5 changes: 3 additions & 2 deletions 4-WebApp-your-API/Client/appsettings.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,12 +1,13 @@
{
"AzureAdB2C": {
"Instance": "https://fabrikamb2c.b2clogin.com",
"ClientId": "90c0fe63-bcf2-44d5-8fb7-b8bbc0b29dc6",
"ClientId": "fdb91ff5-5ce6-41f3-bdbd-8267c817015d",
"Domain": "fabrikamb2c.onmicrosoft.com",
"SignedOutCallbackPath": "/signout/B2C_1_susi",
"SignUpSignInPolicyId": "b2c_1_susi",
"ResetPasswordPolicyId": "b2c_1_reset",
"EditProfilePolicyId": "b2c_1_edit_profile" // Optional profile editing policy
"EditProfilePolicyId": "b2c_1_edit_profile", // Optional profile editing policy
"ClientSecret": "X330F3#92!z614M4"
//"CallbackPath": "/signin/B2C_1_sign_up_in" // defaults to /signin-oidc
},
"AzureAd": {
Expand Down
6 changes: 6 additions & 0 deletions 4-WebApp-your-API/WebApp-OpenIDConnect-DotNet.sln
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,8 @@ Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "Microsoft.Identity.Web", ".
EndProject
Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "Microsoft.Identity.Web.UI", "..\Microsoft.Identity.Web.UI\Microsoft.Identity.Web.UI.csproj", "{A2B0D2D4-6799-4B6F-AC51-F0F0A6CA1E89}"
EndProject
Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "Microsoft.Identity.Web.Test", "..\Microsoft.Identity.Web.Test\Microsoft.Identity.Web.Test.csproj", "{C4827ACC-3765-46C2-8D86-ACFCEB175A11}"
EndProject
Global
GlobalSection(SolutionConfigurationPlatforms) = preSolution
Debug|Any CPU = Debug|Any CPU
Expand All @@ -39,6 +41,10 @@ Global
{A2B0D2D4-6799-4B6F-AC51-F0F0A6CA1E89}.Debug|Any CPU.Build.0 = Debug|Any CPU
{A2B0D2D4-6799-4B6F-AC51-F0F0A6CA1E89}.Release|Any CPU.ActiveCfg = Release|Any CPU
{A2B0D2D4-6799-4B6F-AC51-F0F0A6CA1E89}.Release|Any CPU.Build.0 = Release|Any CPU
{C4827ACC-3765-46C2-8D86-ACFCEB175A11}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
{C4827ACC-3765-46C2-8D86-ACFCEB175A11}.Debug|Any CPU.Build.0 = Debug|Any CPU
{C4827ACC-3765-46C2-8D86-ACFCEB175A11}.Release|Any CPU.ActiveCfg = Release|Any CPU
{C4827ACC-3765-46C2-8D86-ACFCEB175A11}.Release|Any CPU.Build.0 = Release|Any CPU
EndGlobalSection
GlobalSection(SolutionProperties) = preSolution
HideSolutionNode = FALSE
Expand Down
13 changes: 10 additions & 3 deletions Microsoft.Identity.Web.Test/WebApiServiceCollectionExtensionsTests.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,24 +46,31 @@ public void TestAuthority()
public void TestAudience()
{
JwtBearerOptions options = new JwtBearerOptions();
MicrosoftIdentityOptions microsoftIdentityOptions = new MicrosoftIdentityOptions() { ClientId = Guid.NewGuid().ToString() };

// Act and Assert
options.Audience = "https://localhost";
WebApiServiceCollectionExtensions.EnsureValidAudiencesContainsApiGuidIfGuidProvided(options);
WebApiServiceCollectionExtensions.EnsureValidAudiencesContainsApiGuidIfGuidProvided(options, microsoftIdentityOptions);
Assert.True(options.TokenValidationParameters.ValidAudiences.Count() == 1);
Assert.True(options.TokenValidationParameters.ValidAudiences.First() == "https://localhost");

options.Audience = "api://1EE5A092-0DFD-42B6-88E5-C517C0141321";
WebApiServiceCollectionExtensions.EnsureValidAudiencesContainsApiGuidIfGuidProvided(options);
WebApiServiceCollectionExtensions.EnsureValidAudiencesContainsApiGuidIfGuidProvided(options, microsoftIdentityOptions);
Assert.True(options.TokenValidationParameters.ValidAudiences.Count() == 1);
Assert.True(options.TokenValidationParameters.ValidAudiences.First() == "api://1EE5A092-0DFD-42B6-88E5-C517C0141321");

options.Audience = "1EE5A092-0DFD-42B6-88E5-C517C0141321";
WebApiServiceCollectionExtensions.EnsureValidAudiencesContainsApiGuidIfGuidProvided(options);
WebApiServiceCollectionExtensions.EnsureValidAudiencesContainsApiGuidIfGuidProvided(options, microsoftIdentityOptions);
Assert.True(options.TokenValidationParameters.ValidAudiences.Count() == 2);
Assert.Contains("api://1EE5A092-0DFD-42B6-88E5-C517C0141321", options.TokenValidationParameters.ValidAudiences);
Assert.Contains("1EE5A092-0DFD-42B6-88E5-C517C0141321", options.TokenValidationParameters.ValidAudiences);

options.Audience = null;
WebApiServiceCollectionExtensions.EnsureValidAudiencesContainsApiGuidIfGuidProvided(options, microsoftIdentityOptions);
Assert.True(options.TokenValidationParameters.ValidAudiences.Count() == 2);
Assert.Contains($"api://{microsoftIdentityOptions.ClientId}", options.TokenValidationParameters.ValidAudiences);
Assert.Contains($"{microsoftIdentityOptions.ClientId}", options.TokenValidationParameters.ValidAudiences);

}
}
}
1 change: 1 addition & 0 deletions Microsoft.Identity.Web/ClaimConstants.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,7 @@ public static class ClaimConstants
public const string TenantId = "http://schemas.microsoft.com/identity/claims/tenantid";
public const string Tid = "tid";
public const string ClientInfo = "client_info";
public const string UniqueObjectIdentifier = "utid";
// Older scope claim
public const string Scope = "http://schemas.microsoft.com/identity/claims/scope";
// Newer scope claim
Expand Down
9 changes: 2 additions & 7 deletions Microsoft.Identity.Web/ClaimsPrincipalExtensions.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ public static string GetMsalAccountId(this ClaimsPrincipal claimsPrincipal)
!string.IsNullOrWhiteSpace(userFlowId))
{
// B2C pattern: {oid}-{userFlow}.{tid}
return $"{nameIdentifierId}-{userFlowId}.{tenantId}";
return $"{nameIdentifierId}.{tenantId}";
}
else if (!string.IsNullOrWhiteSpace(userObjectId) && !string.IsNullOrWhiteSpace(tenantId))
{
Expand Down Expand Up @@ -152,12 +152,7 @@ public static string GetUserFlowId(this ClaimsPrincipal claimsPrincipal)
/// <returns>Name identifier ID (sub) of the identity, or <c>null</c> if it cannot be found</returns>
public static string GetNameIdentifierId(this ClaimsPrincipal claimsPrincipal)
{
string sub = claimsPrincipal.FindFirstValue(ClaimConstants.Sub);
if (string.IsNullOrEmpty(sub))
{
sub = claimsPrincipal.FindFirstValue(ClaimTypes.NameIdentifier);
}
return sub;
return claimsPrincipal.FindFirstValue(ClaimConstants.UniqueObjectIdentifier);
}
}
}
24 changes: 15 additions & 9 deletions Microsoft.Identity.Web/WebApiServiceCollectionExtensions.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -171,10 +171,8 @@ public static AuthenticationBuilder AddProtectedWebApi(

// The valid audience could be given as Client Id or as Uri.
// If it does not start with 'api://', this variant is added to the list of valid audiences.
EnsureValidAudiencesContainsApiGuidIfGuidProvided(options);
EnsureValidAudiencesContainsApiGuidIfGuidProvided(options, microsoftIdentityOptions);

options.TokenValidationParameters.ValidAudiences = GetValidAudiences(options, microsoftIdentityOptions);

// If the developer registered an IssuerValidator, do not overwrite it
if (options.TokenValidationParameters.IssuerValidator == null)
{
Expand Down Expand Up @@ -270,13 +268,21 @@ internal static void EnsureAuthorityIsV2_0(JwtBearerOptions options)
/// </summary>
/// <param name="options">Jwt bearer options for which to ensure that
/// api://GUID is a valid audience</param>
internal static void EnsureValidAudiencesContainsApiGuidIfGuidProvided(JwtBearerOptions options)
internal static void EnsureValidAudiencesContainsApiGuidIfGuidProvided(JwtBearerOptions options, MicrosoftIdentityOptions msIdentityOptions)
{
var validAudiences = new List<string> { options.Audience };
if (!options.Audience.StartsWith("api://", StringComparison.OrdinalIgnoreCase)
&& Guid.TryParse(options.Audience, out _))
validAudiences.Add($"api://{options.Audience}");

var validAudiences = new List<string>();
if (!string.IsNullOrWhiteSpace(options.Audience))
{
validAudiences.Add(options.Audience);
if (!options.Audience.StartsWith("api://", StringComparison.OrdinalIgnoreCase)
&& Guid.TryParse(options.Audience, out _))
validAudiences.Add($"api://{options.Audience}");
}
else
{
validAudiences.Add(msIdentityOptions.ClientId);
validAudiences.Add($"api://{msIdentityOptions.ClientId}");
}
options.TokenValidationParameters.ValidAudiences = validAudiences;
}
}
Expand Down
1 change: 1 addition & 0 deletions Microsoft.Identity.Web/WebAppServiceCollectionExtensions.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -122,6 +122,7 @@ public static IServiceCollection AddWebAppCallsProtectedWebApi(
if (clientInfoFromServer != null)
{
context.Principal.Identities.FirstOrDefault().AddClaim(new Claim(ClaimConstants.Tid, clientInfoFromServer.UniqueTenantIdentifier));
context.Principal.Identities.FirstOrDefault().AddClaim(new Claim(ClaimConstants.UniqueObjectIdentifier, clientInfoFromServer.UniqueObjectIdentifier));
}
}
}
Expand Down