dotnet / dotnet/aspnetcore

Improve observability of Microsoft.IdentityModel logs

Open
#54,424 2 comments 11 reactions 1 assignee Claimed by @halter73 View on GitHub
area-auth blocked enhancement feature-observability
Dominant language
C#
Stars
38.4k
Forks
10.9k
Avg merge
2d 6h
Merged PRs (30d)
290

Description

If you use an authentication handler from Microsoft.Identity.Web, it will [wire up](https://github.com/AzureAD/microsoft-identity-web/blob/0f1095cede2529a9311392ef3405448bb35d44f7/src/Microsoft.Identity.Web/WebApiExtensions/MicrosoftIdentityWebApiAuthenticationBuilderExtensions.cs#L172) Microsoft.IdentityModel logs [with Microsoft.Extensions.Logging](https://github.com/AzureAD/microsoft-identity-web/blob/0f1095cede2529a9311392ef3405448bb35d44f7/src/Microsoft.Identity.Web.TokenAcquisition/MicrosoftIdentityBaseAuthenticationBuilder.cs#L63) using [IdentityLoggerAdapter](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/blob/3f504620646bff24e22a41ee636baecb47b6937b/src/Microsoft.IdentityModel.LoggingExtensions/IdentityLoggerAdapter.cs). The authentication handlers we ship out of this repo (JwtBearerHandler, OpenIdConnectHander, and WsFederationHandler) don't do this.

Currently, to get logs from IdentityModel like "IDX10214: Audience validation failed." from the JwtBearerHandler into your ASP.NET Core loggers, you have to do something like the following after adding a new package reference to Microsoft.IdentityModel.LoggingExtensions:

```csharp
var loggerFactory = app.Services.GetRequiredService();
var logger = loggerFactory.CreateLogger("IdentityLogger");
LogHelper.Logger = new IdentityLoggerAdapter(logger);
```

Setting the static LogHelper.Logger property the way Microsoft.Identity.Web does in methods like AddJwtBearer is far from ideal. We should work with the Identity team to add APIs to components like JsonWebTokenHandler and ConfigurationManager so they log to a non-static IIdentityLogger provided by our authentication handlers.

This could be used to improve the Microsoft.Identity.Web integration with ASP.NET Core logging as well by allowing log messages to be scoped to the handler that is logging and include things like the whether the log came from AddMicrosoftIdentityWebApp or AddMicrosoftIdentityWebApi.

@jennyf19 @keegan-caruso

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.