Improve observability of Microsoft.IdentityModel logs
- Dominant language
- C#
- Stars
- 38.4k
- Forks
- 10.9k
- Avg merge
- 2d 6h
- Merged PRs (30d)
- 290
Description
If you use an authentication handler from Microsoft.Identity.Web, it will [wire up](https://github.com/AzureAD/microsoft-identity-web/blob/0f1095cede2529a9311392ef3405448bb35d44f7/src/Microsoft.Identity.Web/WebApiExtensions/MicrosoftIdentityWebApiAuthenticationBuilderExtensions.cs#L172) Microsoft.IdentityModel logs [with Microsoft.Extensions.Logging](https://github.com/AzureAD/microsoft-identity-web/blob/0f1095cede2529a9311392ef3405448bb35d44f7/src/Microsoft.Identity.Web.TokenAcquisition/MicrosoftIdentityBaseAuthenticationBuilder.cs#L63) using [IdentityLoggerAdapter](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/blob/3f504620646bff24e22a41ee636baecb47b6937b/src/Microsoft.IdentityModel.LoggingExtensions/IdentityLoggerAdapter.cs). The authentication handlers we ship out of this repo (JwtBearerHandler, OpenIdConnectHander, and WsFederationHandler) don't do this.
Currently, to get logs from IdentityModel like "IDX10214: Audience validation failed." from the JwtBearerHandler into your ASP.NET Core loggers, you have to do something like the following after adding a new package reference to Microsoft.IdentityModel.LoggingExtensions:
```csharp
var loggerFactory = app.Services.GetRequiredService();
var logger = loggerFactory.CreateLogger("IdentityLogger");
LogHelper.Logger = new IdentityLoggerAdapter(logger);
```
Setting the static LogHelper.Logger property the way Microsoft.Identity.Web does in methods like AddJwtBearer is far from ideal. We should work with the Identity team to add APIs to components like JsonWebTokenHandler and ConfigurationManager so they log to a non-static IIdentityLogger provided by our authentication handlers.
This could be used to improve the Microsoft.Identity.Web integration with ASP.NET Core logging as well by allowing log messages to be scoped to the handler that is logging and include things like the whether the log came from AddMicrosoftIdentityWebApp or AddMicrosoftIdentityWebApi.
@jennyf19 @keegan-caruso
Contributor guide
Assessment
This issue has not been assessed yet.