CommunityToolkit / CommunityToolkit/Graph-Controls

MsalProvider.cs ctors convert scope strings to lowercase but should not do that!

Offen
#185 1 Kommentar 1 Reaktion 0 zugewiesene Personen Auf GitHub ansehen
Area: Providers bug :bug:
Vorherrschende Sprache
C#
Sterne
156
Forks
38
PR-Merge-Kennzahlen
Keine gemergten PRs in 30 T.

Beschreibung

Toolkit Version 7.1.1

MsalProvider.cs Contructors convert the scope arrays to lowercase:

`Scopes = scopes.Select(s => s.ToLower()).ToArray() ?? new string[] { string.Empty };`

It should not do this because OpenID specs define scopes as CASE SENSITIVE.
https://openid.net/specs/openid-connect-core-1_0.html#ScopeClaims
"_Multiple scope values MAY be used by creating a space delimited, **case sensitive** list of ASCII scope values_."

https://tools.ietf.org/html/rfc6749#section-3.3
"_The value of the scope parameter is expressed as a list of space-delimited, **case-sensitive** strings. The strings are defined by the authorization server. If the value contains multiple space-delimited strings, their order does not matter, and each string adds an additional access range to the requested scope._"

I'm running an .NET Core 6 Azure Web App Api with an case sensitive scope in the AAD app registration. Using standard MSAL PublicClientApplication runs fine with that. Using the MsalProvider wrapper of the community toolkit breaks this, because the "lowercased" scope is not accepted by Microsoft.IdentityModel.Tokens.SecurityToken:

_IDX10214: Audience validation failed. Audiences: 'https://abce.de/webapp-abcd.azurewebsites.net'. Did not match: validationParameters.ValidAudience: 'https://abce.de/WebApp-abce.azurewebsites.net'_

Please not the uppercase 'W' in the scope.

**Earlier versions of MSAL also had that bug and fixed it:**
https://github.com/AzureAD/microsoft-authentication-library-for-objc/issues/395
https://github.com/AzureAD/microsoft-authentication-library-for-js/issues/1922

Best Regards,
Torsten

Beitragsleitfaden

Für dieses Repository ist kein Beitragsleitfaden indexiert

Bewertung

Dieses Issue wurde noch nicht bewertet.

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.