Altinn / Altinn/altinn-authentication

Logging to trace the use of scope "skatteetaten:mvameldinginnsending"

Open
#1,671 1 comment 0 reactions 0 assignees View on GitHub
Etter19JuniRelease
Dominant language
C#
Stars
8
Forks
6
Avg merge
2d 21h
Merged PRs (30d)
21

Description

# Beskrivelse

This summer, we decided that switching to an Altinn token is only allowed if the request contains an Altinn scope. During implementation, we discovered that several MVA scopes did not request the Altinn scope (such as instances.read/write). To provide more time for migration, we temporarily allowed partner scopes as well.
Now, the goal is to identify if there are still any clients using partner scopes instead of Altinn scopes, as we plan to remove this exception. We need logging for cases where a partner scope is used without an Altinn scope. The log should include information from the token, especially the consumer or supplier fields, so we can contact the relevant organization.
This is related to Altinn apps not checking scopes, which means users can perform any action with an Altinn token. By enforcing the use of instance scopes, users will be prompted accordingly.

It should look something like
```
if (!HasAltinnScope(scope) && !HasPartnerScope(scope))
{
_logger.LogInformation("Missing scope");
return Forbid();
}
else if (!HasAltinnScope(scope) && HasPartnerScope(scope))
{
_logger.LogInformation("Still using partner scope");
// Log consumer/supplier orgnr for follow-up
}
```

# To do's

- [ ] Log information/error (what is easy to filter in appinsights) on using the partner scope
- [ ] Fetch the statistics of usage after logimplementation

Contributor guide

No contributing guide indexed for this repository

Research direction

No file or test is named. Locate the authentication flow that validates Altinn and partner scopes, then inspect how consumer or supplier fields are read from the token and how App Insights logs are emitted. Done means partner-scope use without an Altinn scope is clearly filterable and the requested token organization data is included.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
authentication, security
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.