Azure-Samples / Azure-Samples/ms-identity-msal-java-samples

Spring Tutorial-4/Auth-II - Group PreAuthorization mysteriously fails with valid Group ID claims in ID Token.

Aperta
#27 3 commenti 0 reazioni 0 assegnatari Vedi su GitHub
untriaged
Lingua principale
Java
Stelle
79
Fork
82
Metriche di merge delle PR
Nessuna PR unita negli ultimi 30g

Descrizione

> Please provide us with the following information:
> ---------------------------------------------------------------

### This issue is for a: (mark with an `x`)
```
- [ ] bug report -> please search issues before submitting
- [ ] feature request
- [x] documentation issue or request
- [ ] regression (a behavior that used to work and stopped in a new release)
```

### Minimal steps to reproduce
> 4. Spring Framework Web App Tutorial/3-Authorization-II -
1. Run application and log in.
2. Observe ID Token Details and confirm that groups claim contains the AdminGroupId and the UserGroupId.
3. Confirm that PreAuthorization annotations have the 'correct' Group IDs
4. Click Admins Only.

### Any log messages given by the failure
> None observed

### Expected/desired behavior
> Expected: "Excellent! ..."
> Observed: "Sorry! ..."

### OS and Version?
> macOS Big Sur

### Versions
> Java version 11

### Mention any other details that might be useful
@GetMapping(path = "/admin_only")
@PreAuthorize("hasAuthority('48ca69cc-8f4f-4bd2-b12f-xxxxxxxxxxxx')")
Does not work.

Changing the PreAuthorization to hasRole() and Prefixing the group id with "ROLE_" as documented [here](https://microsoft.github.io/spring-cloud-azure/docs/4.0.0-beta.2/reference/html/index.html) appears to be working:

The roles example works as expected.

> ---------------------------------------------------------------
> Thanks! We'll be in touch soon.

Guida per i contributori

Nessuna guida per i contributori indicizzata per questo repository

Direzione di ricerca

Start with the Spring Framework Web App Tutorial/3-Authorization-II flow and the `/admin_only` endpoint shown in the report. Compare the ID token groups claim and its `@PreAuthorize` annotation with the documented roles example, then verify that the tutorial's documented authorization behavior matches the observed result.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Valutazione

Stack tecnologico
java, spring
Ambito
authorization, documentation
Tipo di issue
Documentazione
Difficoltà
3/5
Tempo stimato
1-2 giorni
Stato di attività
Ferma
Chiarezza
Abbastanza chiara
Idoneità per principianti
35/100

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.