Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

CTI Bug fixes for release7.0-preview5 #1935

Merged
merged 8 commits into from
Jun 13, 2022
Merged

CTI Bug fixes for release7.0-preview5 #1935

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
cbe8b0b
Fix config for blazor wasm
zahalzel Jun 10, 2022
75ad3d4
Fix config for blazor wasm (#1927)
zahalzel Jun 13, 2022
c4fa7ef
Add service principal when exposing API scopes (#1931)
zahalzel Jun 13, 2022
44e4edf
Add service principal when exposing API scopes
zahalzel Jun 13, 2022
442ef9b
Remove commented method
zahalzel Jun 13, 2022
12f32ec
expose scopes
zahalzel Jun 13, 2022
2db40c5
Fix scopes
zahalzel Jun 13, 2022
2440342
Fix config for blazor wasm
zahalzel Jun 10, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 12 additions & 11 deletions ...tityScaffolding/Microsoft.DotNet.MSIdentity/AuthenticationParameters/AzureAdProperties.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,8 @@ public static class DefaultProperties
public const bool ValidateAuthority = true;

public const string MicrosoftGraphBaseUrl = "https://graph.microsoft.com/v1.0";
public const string DefaultScopes = "user.read";
public const string MicrosoftGraphScopes = "user.read";
public const string ApiScopes = "access_as_user";
}

public class AzureAdBlock
Expand Down Expand Up @@ -77,15 +78,15 @@ public AzureAdBlock UpdateFromJToken(JToken azureAdToken)
{
JObject azureAdObj = JObject.FromObject(azureAdToken);

ClientId ??= azureAdObj.Value<string>(PropertyNames.ClientId); // here, if the applicationparameters value is null, we use the existing app settings value
Instance ??= azureAdObj.Value<string>(PropertyNames.Instance);
Domain ??= azureAdObj.Value<string>(PropertyNames.Domain);
TenantId ??= azureAdObj.Value<string>(PropertyNames.TenantId);
Authority ??= azureAdObj.Value<string>(PropertyNames.Authority);
CallbackPath ??= azureAdObj.Value<string>(PropertyNames.CallbackPath);
Scopes ??= azureAdObj.Value<string>(PropertyNames.Scopes);
ClientSecret ??= azureAdObj.Value<string>(PropertyNames.ClientSecret);
ClientCertificates ??= azureAdObj.Value<string[]>(PropertyNames.ClientCertificates);
ClientId ??= azureAdObj.GetValue(PropertyNames.ClientId)?.ToString(); // here, if the applicationparameters value is null, we use the existing app settings value
Instance ??= azureAdObj.GetValue(PropertyNames.Instance)?.ToString();
Domain ??= azureAdObj.GetValue(PropertyNames.Domain)?.ToString();
TenantId ??= azureAdObj.GetValue(PropertyNames.TenantId)?.ToString();
Authority ??= azureAdObj.GetValue(PropertyNames.Authority)?.ToString();
CallbackPath ??= azureAdObj.GetValue(PropertyNames.CallbackPath)?.ToString();
Scopes ??= azureAdObj.GetValue(PropertyNames.Scopes)?.ToString();
ClientSecret ??= azureAdObj.GetValue(PropertyNames.ClientSecret)?.ToString();
ClientCertificates ??= azureAdObj.GetValue(PropertyNames.ClientCertificates)?.ToObject<string[]>();

return this;
}
Expand Down Expand Up @@ -113,7 +114,7 @@ public AzureAdBlock UpdateFromJToken(JToken azureAdToken)
TenantId = TenantId ?? DefaultProperties.TenantId,
ClientId = ClientId ?? DefaultProperties.ClientId,
CallbackPath = CallbackPath ?? DefaultProperties.CallbackPath,
Scopes = Scopes ?? DefaultProperties.DefaultScopes,
Scopes = Scopes ?? DefaultProperties.ApiScopes,
ClientSecret = ClientSecret ?? DefaultProperties.ClientSecret,
ClientCertificates = ClientCertificates ?? Array.Empty<string>()
};
Expand Down
3 changes: 3 additions & 0 deletions ...icrosoft.DotNet.MSIdentity/CodeReaderWriter/CodeModifierConfigs/cm_dotnet_blazorwasm.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -281,6 +281,9 @@
},
{
"FileName": "FetchData.razor",
"Options": [
"DownstreamApi"
],
"Replacements": [
{
"MultiLineBlock": [
Expand Down
6 changes: 3 additions & 3 deletions ...yScaffolding/Microsoft.DotNet.MSIdentity/MicrosoftIdentityPlatform/AppSettingsModifier.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -93,7 +93,7 @@ public void ModifyAppSettings(ApplicationParameters applicationParameters, IEnum
if (_provisioningToolOptions.CallsGraph)
{
// update MicrosoftGraph Block
var microsoftGraphBlock = GetApiBlock(appSettings, MicrosoftGraph, DefaultProperties.DefaultScopes, DefaultProperties.MicrosoftGraphBaseUrl);
var microsoftGraphBlock = GetApiBlock(appSettings, MicrosoftGraph, DefaultProperties.MicrosoftGraphScopes, DefaultProperties.MicrosoftGraphBaseUrl);
if (microsoftGraphBlock != null)
{
changesMade = true;
Expand All @@ -104,7 +104,7 @@ public void ModifyAppSettings(ApplicationParameters applicationParameters, IEnum
if (_provisioningToolOptions.CallsDownstreamApi)
{
// update DownstreamAPI Block
var updatedDownstreamApiBlock = GetApiBlock(appSettings, DownstreamApi, DefaultProperties.DefaultScopes, DefaultProperties.MicrosoftGraphBaseUrl);
var updatedDownstreamApiBlock = GetApiBlock(appSettings, DownstreamApi, DefaultProperties.ApiScopes, DefaultProperties.MicrosoftGraphBaseUrl);
if (updatedDownstreamApiBlock != null)
{
changesMade = true;
Expand Down Expand Up @@ -174,7 +174,7 @@ internal bool NeedsUpdate(JObject existingBlock, JObject updatedBlock)
{
var inputParameters = JObject.FromObject(new ApiSettingsBlock
{
Scopes = string.IsNullOrEmpty(scopes) ? DefaultProperties.DefaultScopes : scopes,
Scopes = string.IsNullOrEmpty(scopes) ? DefaultProperties.MicrosoftGraphScopes : scopes,
BaseUrl = string.IsNullOrEmpty(baseUrl) ? DefaultProperties.MicrosoftGraphBaseUrl : baseUrl
});

Expand Down
32 changes: 15 additions & 17 deletions ...otNet.MSIdentity/MicrosoftIdentityPlatform/MicrosoftIdentityPlatformApplicationManager.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,21 +67,19 @@ public class MicrosoftIdentityPlatformApplicationManager
.Request()
.AddAsync(application);

if (applicationParameters.IsB2C) // TODO B2C not fully supported at the moment
// Create service principal, necessary for Web API applications
// and useful for Blazorwasm hosted applications. We create it always.
ServicePrincipal servicePrincipal = new ServicePrincipal
{
// Creates a service principal (needed for B2C) // TODO: What if it's not B2C?
ServicePrincipal servicePrincipal = new ServicePrincipal
{
AppId = createdApplication.AppId,
};
AppId = createdApplication.AppId,
};

// B2C does not allow user consent, and therefore we need to explicity create
// a service principal and permission grants. It's also useful for Blazorwasm hosted
// applications. We create it always.
ServicePrincipal? createdServicePrincipal = await graphServiceClient.ServicePrincipals
.Request()
.AddAsync(servicePrincipal).ConfigureAwait(false);
ServicePrincipal? createdServicePrincipal = await graphServiceClient.ServicePrincipals
.Request()
.AddAsync(servicePrincipal).ConfigureAwait(false);

if (applicationParameters.IsB2C) // TODO B2C not fully supported at the moment
{
// B2C does not allow user consent, and therefore we need to explicity grant permissions
if (applicationParameters.IsB2C)
{
Expand All @@ -103,7 +101,7 @@ public class MicrosoftIdentityPlatformApplicationManager
&& createdApplication.Api != null
&& (createdApplication.IdentifierUris == null || !createdApplication.IdentifierUris.Any()))
{
await ExposeScopes(graphServiceClient, createdApplication);
await ExposeScopesForNewWebApi(graphServiceClient, createdApplication);

// Re-reading the app to be sure to have everything.
createdApplication = (await graphServiceClient.Applications
Expand Down Expand Up @@ -402,7 +400,7 @@ internal static bool UpdateImplicitGrantSettings(Application app, ProvisioningTo
var requiredResourceAccess = new List<RequiredResourceAccess>();
var resourcesAccessAndScopes = new List<ResourceAndScope>
{
new ResourceAndScope($"api://{createdApplication.AppId}", "access_as_user")
new ResourceAndScope($"api://{createdApplication.AppId}", DefaultProperties.ApiScopes)
{
ResourceServicePrincipalId = createdServicePrincipal.Id
}
Expand Down Expand Up @@ -430,7 +428,7 @@ internal static bool UpdateImplicitGrantSettings(Application app, ProvisioningTo
ConsentType = "AllPrincipals",
PrincipalId = null,
ResourceId = createdServicePrincipal.Id,
Scope = "access_as_user"
Scope = DefaultProperties.ApiScopes
};

await graphServiceClient.Oauth2PermissionGrants
Expand Down Expand Up @@ -504,7 +502,7 @@ internal static async Task<string> ExposeScopes(GraphServiceClient graphServiceC
IsEnabled = true,
UserConsentDescription = "Allows this app to access the web API on your behalf",
UserConsentDisplayName = "Access the API on your behalf",
Value = "access_as_user",
Value = DefaultProperties.ApiScopes,
};

scopes.Add(newScope);
Expand All @@ -522,7 +520,7 @@ internal static async Task<string> ExposeScopes(GraphServiceClient graphServiceC
/// <param name="graphServiceClient"></param>
/// <param name="createdApplication"></param>
/// <returns></returns>
internal static async Task ExposeScopes(GraphServiceClient graphServiceClient, Application createdApplication)
internal static async Task ExposeScopesForNewWebApi(GraphServiceClient graphServiceClient, Application createdApplication)
{
var scopes = createdApplication.Api.Oauth2PermissionScopes?.ToList() ?? new List<PermissionScope>();
await ExposeScopes(graphServiceClient, createdApplication.AppId, createdApplication.Id, scopes);
Expand Down
2 changes: 1 addition & 1 deletion src/MSIdentityScaffolding/Microsoft.DotNet.MSIdentity/Tool/AppProvisioningTool.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -330,7 +330,7 @@ private async Task<ApplicationParameters> ConfigureBlazorWasmHostedClientAsync(A
clientToolOptions.ProjectType = "blazorwasm-client";
clientToolOptions.AppDisplayName = string.Concat(clientToolOptions.AppDisplayName ?? serverApplicationParameters.ApplicationDisplayName, "-Client");
clientToolOptions.HostedAppIdUri = serverApplicationParameters.AppIdUri;
clientToolOptions.HostedApiScopes = $"{serverApplicationParameters.AppIdUri}/access_as_user";
clientToolOptions.HostedApiScopes = $"{serverApplicationParameters.AppIdUri}/{DefaultProperties.ApiScopes}";

// Provision client app registration
var provisionClientAppRegistration = new AppProvisioningTool(Commands.CREATE_APP_REGISTRATION_COMMAND, clientToolOptions, silent: true);
Expand Down