Enhance ConfigureExchangeHybridApplication.ps1 based on customer and internal feedback - #2387
Conversation
lusassl-msft
added
the
Do not merge
|
/azp run |
|
Azure Pipelines successfully started running 1 pipeline(s). |
|
/azp run |
|
Azure Pipelines successfully started running 1 pipeline(s). |
f9fd249 to
c2e2c60
Compare
|
/azp run |
|
Azure Pipelines successfully started running 1 pipeline(s). |
| if (-not $returnedState) { | ||
| Write-Host "No state value was returned" -ForegroundColor Red | ||
|
|
||
| return | ||
| } | ||
|
|
||
| Write-Verbose "Script state: '$state' - Returned state: '$returnedState'" | ||
|
|
||
| if ($returnedState -cne $state) { | ||
| Write-Host "State mismatch detected! Expected '$state', got '$returnedState'" -ForegroundColor Red | ||
|
|
||
| return | ||
| } | ||
|
|
||
| $code = $queryString["code"] | ||
|
|
||
| if (-not $code) { | ||
| Write-Host "Authorization code is missing in callback" -ForegroundColor Red | ||
|
|
There was a problem hiding this comment.
Should we ever expect something like this to happen, if so should we provide what to do if this does happen?
There was a problem hiding this comment.
The state parameter binds the authorization response to this specific client request and provides CSRF protection. The client generates a random, unguessable value, stores it locally, sends it in the /authorize request, and verifies it on callback. If the returned state doesn’t match the stored value, the response is ignored - preventing stray redirects (e.g., from another tab/app/tenant) and attacker attempts to have the client redeem unsolicited results.
So, yes - it's possible that we end up here but it's unexpected and this code should prevent the client from continue processing => we don't redeem the returned code for an access token.
This is a very, very rare situation.
|
@lusassl-msft please update the docs to state if you run into issues to review the debug log and its location to have a better understanding of the issue. |
lusassl-msft
removed
the
Do not merge
|
/azp run |
|
Azure Pipelines successfully started running 1 pipeline(s). |
2 participants
Description:
ConfigureAuthServerlogic simplifiedDomainNamevalues from the correspondingMicrosoftACSAuth Server if there is oneAcceptedDomainon the on-premises side with the domains returned via Graph API call if no correspondingMicrosoftACSobject was found and we use the matching domainsGet-GraphAccessTokento make it more robustRemove-CertificateFromAzureServicePrincipalto return more context about the operation that was performedValidation:
Lab