microsoft / microsoft/PackageUploader

AAD Manifest parameters

Open
#35 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
C#
Stars
66
Forks
19
Avg merge
21h
Merged PRs (30d)
1

Description

Specifically "signInAudience" (aka: Supported account type) seems to matter for the AAD application being used for authentication.
"PersonalMicrosoftAccount" seems to give issues and does not let the AAD app be used for package uploader.
If we change "signInAudience" to be "AzureADMyOrg" things will probably work, but are there are other manifest attributes that will need to change as well in order to support this and not cause any problems?

We noticed that in the manifest an app with "signInAudience":"PersonalMicrosoftAccount", it has "accessTokenAcceptedVersion": 2 but this restriction isn't there for an app with "signInAudience":"AzureADMyOrg" (null value for that key). From reading various available documentation like these:
[https://learn.microsoft.com/en-us/azure/active-directory/develop/supported-accounts-validation]

[https://learn.microsoft.com/en-us/azure/active-directory/develop/access-tokens#token-formats]

...it seems that the supported account type changes features available and Azure AD apps use version 1.0 tokens if I'm not mistaken. So part of what we're wondering is if this is why the client secret token is accepted for "signInAudience":"AzureADMyOrg" but rejected for "signInAudience":"PersonalMicrosoftAccount".

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the Microsoft documentation linked in the issue and compare the Azure AD manifests for PersonalMicrosoftAccount and AzureADMyOrg. Determine which manifest attributes and token version are required for the package uploader, then verify that the resulting client-secret token is accepted without introducing other authentication problems.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, csharp
Domain
api, authentication
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.