New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Google+ based auth deprecation and replacement #333

Open
Tratcher opened this Issue Jan 8, 2019 · 0 comments

Comments

Projects
None yet
1 participant
@Tratcher
Copy link
Member

Tratcher commented Jan 8, 2019

Google is starting to shut down Google+ Signin for applications as early as January 28th 2019. ASP.NET and ASP.NET Core have been using the Google+ Signin APIs to authenticate Google account users in web applications. The affected NuGet packages are Microsoft.AspNetCore.Authentication.Google for ASP.NET Core and Microsoft.Owin.Security.Google for Microsoft.Owin with ASP.NET Web Forms and MVC. Mitigations and solutions will vary depending on which package and which version of that package you use.

Note that the replacement APIs Google has provided use a different data source and format. The mitigations and solutions given below account for the structural changes but applications will need to verify the data itself still satisfies their requirements. E.g. names, e-mail addresses, profile links, profile photos, etc. may provide subtly different values than before.

Microsoft.Owin with ASP.NET Web Forms and MVC

For Microsoft.Owin 3.1.0 and later a temporary mitigation is outlined here. Applications should do immediate testing with the mitigation to check for changes in the data format. We'll plan to release Microsoft.Owin 4.0.1 with a fix for this as soon as possible. Applications using any prior version will need to update to 4.0.1.

ASP.NET Core 1.x

The mitigation given above for Microsoft.Owin can also be adapted for ASP.NET Core 1.x. As 1.x is nearing end of life and has low usage there are no plans to patch the NuGet packages for this issue.

ASP.NET Core 2.x

For Microsoft.AspNetCore.Authentication.Google 2.x the mitigation is to replace your existing call to AddGoogle in Startup with:

            .AddGoogle(o =>
            {
                o.ClientId = Configuration["Authentication:Google:ClientId"];
                o.ClientSecret = Configuration["Authentication:Google:ClientSecret"];
                o.UserInformationEndpoint = "https://www.googleapis.com/oauth2/v2/userinfo";
                o.ClaimActions.Clear();
                o.ClaimActions.MapJsonKey(ClaimTypes.NameIdentifier, "id");
                o.ClaimActions.MapJsonKey(ClaimTypes.Name, "name");
                o.ClaimActions.MapJsonKey(ClaimTypes.GivenName, "given_name");
                o.ClaimActions.MapJsonKey(ClaimTypes.Surname, "family_name");
                o.ClaimActions.MapJsonKey("urn:google:profile", "link");
                o.ClaimActions.MapJsonKey(ClaimTypes.Email, "email");
            });

Applications should do immediate testing with the mitigation to check for changes in the data format. Expect a fix for this to be included in the February 2.1 and 2.2 patches that incorperates the above reconfiguration as the new defaults. No patch is planned for 2.0 since it has reached end of life.

ASP.NET Core 3.0 Preview

The mitigation given for 2.x can also be used for the current 3.0 preview. In future 3.0 previews we're considering removing the Microsoft.AspNetCore.Authentication.Google package and directing users to Microsoft.AspNetCore.Authentication.OpenIdConnect instead. We'll follow up with the final plan. Here's how to replace AddGoogle with AddOpenIdConnect in Startup. This replacement can be used with ASP.NET Core 2.0 and later and can be adapted for 1.x as needed.

            .AddOpenIdConnect("Google", o =>
            {
                o.ClientId = Configuration["Authentication:Google:ClientId"];
                o.ClientSecret = Configuration["Authentication:Google:ClientSecret"];
                o.Authority = "https://accounts.google.com";
                o.ResponseType = OpenIdConnectResponseType.Code;
                o.CallbackPath = "/signin-google"; // Or register the default "/sigin-oidc"
                o.Scope.Add("email");
            });
            JwtSecurityTokenHandler.DefaultInboundClaimTypeMap.Clear();

See aspnet/AspNetCore#6486 for discussion.

@aspnet aspnet locked as resolved and limited conversation to collaborators Jan 8, 2019

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.