Altinn / Altinn/altinn-authentication
Logging to trace the use of scope "skatteetaten:mvameldinginnsending"
- Dominant language
- C#
- Stars
- 8
- Forks
- 6
- Avg merge
- 2d 21h
- Merged PRs (30d)
- 21
Description
# Beskrivelse
This summer, we decided that switching to an Altinn token is only allowed if the request contains an Altinn scope. During implementation, we discovered that several MVA scopes did not request the Altinn scope (such as instances.read/write). To provide more time for migration, we temporarily allowed partner scopes as well.
Now, the goal is to identify if there are still any clients using partner scopes instead of Altinn scopes, as we plan to remove this exception. We need logging for cases where a partner scope is used without an Altinn scope. The log should include information from the token, especially the consumer or supplier fields, so we can contact the relevant organization.
This is related to Altinn apps not checking scopes, which means users can perform any action with an Altinn token. By enforcing the use of instance scopes, users will be prompted accordingly.
It should look something like
```
if (!HasAltinnScope(scope) && !HasPartnerScope(scope))
{
_logger.LogInformation("Missing scope");
return Forbid();
}
else if (!HasAltinnScope(scope) && HasPartnerScope(scope))
{
_logger.LogInformation("Still using partner scope");
// Log consumer/supplier orgnr for follow-up
}
```
# To do's
- [ ] Log information/error (what is easy to filter in appinsights) on using the partner scope
- [ ] Fetch the statistics of usage after logimplementation
Contributor guide
No contributing guide indexed for this repository
Research direction
No file or test is named. Locate the authentication flow that validates Altinn and partner scopes, then inspect how consumer or supplier fields are read from the token and how App Insights logs are emitted. Done means partner-scope use without an Altinn scope is clearly filterable and the requested token organization data is included.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp
- Domain
- authentication, security
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100