Allow acr_values and ui_locales to be specified in OpenIdConnectOptions
- Dominant language
- C#
- Stars
- 38.4k
- Forks
- 10.9k
- Avg merge
- 2d 5h
- Merged PRs (30d)
- 276
Description
## Background and Motivation
Currently to set the `acr_values` and `ui_locales` parameters in the authorization request (https://openid.net/specs/openid-connect-core-1_0.html section 3.1.2.1. Authentication Request), we need to use the `OnRedirectToIdentityProvider` event like:
```cs
var builder = WebApplication.CreateBuilder(args);
builder.Services.AddAuthentication().AddOpenIdConnect(options =>
{
options.Events.OnRedirectToIdentityProvider = context =>
{
context.ProtocolMessage.AcrValues = "tenant:abc";
context.ProtocolMessage.UiLocales = "en-us"
return Task.CompletedTask;
};
});
```
It would be interesting to add these two properties directly in `OpenIdConnectOptions`.
The mapping should be easy (here https://github.com/dotnet/aspnetcore/blob/main/src/Security/Authentication/OpenIdConnect/src/OpenIdConnectHandler.cs#L382) as these two properties already exist in the OpenIdConnectMessage (https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/blob/dev/src/Microsoft.IdentityModel.Protocols.OpenIdConnect/OpenIdConnectMessage.cs)
## Proposed API
```diff
namespace Microsoft.AspNetCore.Authentication.OpenIdConnect;
public class OpenIdConnectOptions : RemoteAuthenticationOptions
{
+ public string? AcrValues { get; set; }
+ public string? UiLocales { get; set; }
}
```
## Usage Examples
```cs
var builder = WebApplication.CreateBuilder(args);
builder.Services.AddAuthentication().AddOpenIdConnect(options =>
{
options.AcrValues = "tenant:abc";
options.UiLocales = "en-us";
});
```
## Alternative Designs
We can maybe rely on the new `AdditionalAuthorizationParameters` proposed in https://github.com/dotnet/aspnetcore/issues/39243 to set these two parameters but should we reserve this property only for non standard OAuth/OpenID parameters?
## Risks
Nothing I can think of now.
cc @Tratcher @martincostello
Contributor guide
Assessment
This issue has not been assessed yet.