Azure / Azure/static-web-apps

Support periods (.) in custom role names with custom authentication

Open
#692 3 comments 0 reactions 0 assignees View on GitHub
AuthN/Z
Dominant language
No language data
Stars
346
Forks
67
PR merge metrics
No merged PRs in 30d

Description

**Describe the bug**

Adding a role restriction to the routes element in staticwebapp.config.json when the role contains a period (.) fails with the following error:

```
Encountered an issue while validating staticwebapp.config.json: The name of the role Folder.Create.All contains an invalid character.
```

In AAD, it's customary for roles, including app roles, to contain periods, such as in "User.Read." I created an API that reads the roles assigned to the logged in user for the application used by Static Web Apps authentication.

**To Reproduce**

1. In the AAD app registration, define a custom role with periods in the role name.
2. Assign a user to the custom app role.
3. Configure staticwebapp.config.json as shown in the snippet below.
4. Deploy a custom API (/api/Roles) that retrieves custom roles from the claims and returns them.
4. Deploy the app.

Excerpt from staticwebapp.config.json:

```json
"auth": {
"rolesSource": "/api/Roles",
"identityProviders": {
"azureActiveDirectory": {
"registration": {
"openIdIssuer": "https://login.microsoftonline.com/__AZURE_TENANT_ID__/v2.0",
"clientIdSettingName": "AZURE_CLIENT_ID",
"clientSecretSettingName": "AZURE_CLIENT_SECRET"
}
}
}
},
...
{
"route": "/api/TopLevelFolders",
"methods": [
"POST"
],
"allowedRoles": [
"Folder.Create.All"
]
}
```

**Expected behavior**

Custom role names should be able to contain periods to match the common convention found in AAD.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.