dotnet / dotnet/aspnetcore

Allow acr_values and ui_locales to be specified in OpenIdConnectOptions

Open
#39,503 6 comments 4 reactions 0 assignees View on GitHub
api-suggestion area-auth
Dominant language
C#
Stars
38.4k
Forks
10.9k
Avg merge
2d 5h
Merged PRs (30d)
276

Description

## Background and Motivation

Currently to set the `acr_values` and `ui_locales` parameters in the authorization request (https://openid.net/specs/openid-connect-core-1_0.html section 3.1.2.1. Authentication Request), we need to use the `OnRedirectToIdentityProvider` event like:

```cs
var builder = WebApplication.CreateBuilder(args);
builder.Services.AddAuthentication().AddOpenIdConnect(options =>
{
options.Events.OnRedirectToIdentityProvider = context =>
{
context.ProtocolMessage.AcrValues = "tenant:abc";
context.ProtocolMessage.UiLocales = "en-us"
return Task.CompletedTask;
};
});
```

It would be interesting to add these two properties directly in `OpenIdConnectOptions`.

The mapping should be easy (here https://github.com/dotnet/aspnetcore/blob/main/src/Security/Authentication/OpenIdConnect/src/OpenIdConnectHandler.cs#L382) as these two properties already exist in the OpenIdConnectMessage (https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/blob/dev/src/Microsoft.IdentityModel.Protocols.OpenIdConnect/OpenIdConnectMessage.cs)

## Proposed API

```diff
namespace Microsoft.AspNetCore.Authentication.OpenIdConnect;

public class OpenIdConnectOptions : RemoteAuthenticationOptions
{
+ public string? AcrValues { get; set; }
+ public string? UiLocales { get; set; }
}

```

## Usage Examples

```cs
var builder = WebApplication.CreateBuilder(args);
builder.Services.AddAuthentication().AddOpenIdConnect(options =>
{
options.AcrValues = "tenant:abc";
options.UiLocales = "en-us";
});
```

## Alternative Designs

We can maybe rely on the new `AdditionalAuthorizationParameters` proposed in https://github.com/dotnet/aspnetcore/issues/39243 to set these two parameters but should we reserve this property only for non standard OAuth/OpenID parameters?

## Risks

Nothing I can think of now.

cc @Tratcher @martincostello

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.