Azure / Azure/static-web-apps

Add access token to user details endpoint (/.auth/me)

Open
#794 105 comments 71 reactions 0 assignees View on GitHub
AuthN/Z enhancement
Dominant language
No language data
Stars
346
Forks
67
PR merge metrics
No merged PRs in 30d

Description

**Is your feature request related to a problem? Please describe.**
I'm using a custom identity provider and have the rolesSource set in the staticwebapp.config. Whenever a user logs in, a request gets sent to "/api/GetRoles" to assign roles to a user. All of this works perfectly and whenever I go to "/.auth/me" I have access to the roles, claims etc of the user.

The problem I'm facing is that the access token seems to be missing from the user details endpoint, and it's not a case of my identity provider not supplying the access token. I've setup azure application insights to inspect the request sent to "/api/GetRoles", and the principal sent in the body of the request clearly contains the access token. It's frustrating that the only place the access token is accessible, is an endpoint that must return "roles" and is not accessible after the initial call when a user logs in.

**Describe the solution you'd like**
I would like for the access token to be present whenever I send a request to the user details endpoint (/.auth/me).

**Describe alternatives you've considered**
I tried setting up a function called GetAccessToken that would retrieve the access token from the "x-ms-client-principal" header, but whenever I made a request to /api/GetAccessToken, the only information available in the "x-ms-client-principal" header is an object with the following properties:
- IdentityProvider
- UserId
- UserDetails
- UserRoles

There is unfortunately no access to claims or the access token in this client principal, like there is in the request body of the "/api/GetRoles" call.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.