grpc / grpc/grpc-dotnet

`AuthContext.IsPeerAuthenticated` should return true if `User.Identity.IsAuthenticated` does

Open
#2,537 2 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
C#
Stars
4.5k
Forks
836
Avg merge
6d 3h
Merged PRs (30d)
7

Description

### Is your feature request related to a problem? Please describe.
After _loads_ of trial & error (no offense, but some docs are confusing for beginners), it seems my Blazor WASM standalone app authenticates Azure B2C users via MSAL correctly - except for 1 thing:
`context.AuthContext.IsPeerAuthenticated` always returns `false`, even if `context.GetHttpContext().User.Identity.IsAuthenticated` returns `true`.

Since the docs for `AuthContext.PeerIdentityPropertyName` state:
> Gets the name of the property that indicates the peer identity

… I looked at the code which clarified that `IsPeerAuthenticated` returns `true` as soon as the former just isn't `null` - but that doesn't always seem to get set properly.
From what I could find (mainly 2 unit tests in this repo), the C# implementation solely focuses on authentication via certificates, because if the underlying `HttpContext` contains a `ClaimsPrincipal` with an `IIdentity` whose `IsAuthenticated` is true, gRPC seems to "simply not care".

### Describe the solution you'd like
Please, for Padawan-like developers like me, i.e., those struggling with authentication & authorization, enable that authenticated users (= those with an `HttpContext` containing a `ClaimsPrincipal` whose `IIdentity.IsAuthenticated` evaluates to `true`), can be easily checked/identified via `context.AuthContext.IsPeerAuthenticated`, too.
Because otherwise `context.GetHttpContext()` needs to be called on each & every method call.

### Describe alternatives you've considered
Continuing to use either workaround:
- Calling `context.GetHttpContext().User.Identity.IsAuthenticated` inside each overwritten method.
- Using a custom `AuthenticationInterceptor` which overrides 9 (!) methods to evaluate the `IIdentity` property & in the event of it being `true` sort of "modifies" the existing `ServerCallContext` by cloning everything from it, except for the `AuthContext` which is replaced with one that has `IsPeerAuthenticated` return `true`.

### Additional context
The docs regarding `AuthContext` should be improved to make its content as well as usage clearer - maybe even by adding a usage example for the scenario I just described.

Contributor guide

Open the contributing guide

Research direction

Start by reading AuthContext.IsPeerAuthenticated, AuthContext.PeerIdentityPropertyName, and the two existing unit tests mentioned in the issue. Check how HttpContext.User.Identity.IsAuthenticated relates to the current certificate-focused behavior. Done means authenticated ClaimsPrincipal identities are recognized and the AuthContext documentation explains the behavior with a usage example.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
authentication, backend
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.