From 6c8c1728a5b8bac0df9affebdcec7e2c1ce55f8e Mon Sep 17 00:00:00 2001 From: Alexander Beyderman Date: Thu, 31 Mar 2022 14:27:47 -0400 Subject: [PATCH 1/4] added support for v2.0 --- Microsoft.Identity.Web.Aspnet/CommonUtil.cs | 14 ++++++++++++++ .../MicrosoftIdentityWebApiAuthorizationBuilder.cs | 6 +++++- TodoListService/TodoListService.csproj | 2 +- 3 files changed, 20 insertions(+), 2 deletions(-) diff --git a/Microsoft.Identity.Web.Aspnet/CommonUtil.cs b/Microsoft.Identity.Web.Aspnet/CommonUtil.cs index 32fcf57..88b0207 100644 --- a/Microsoft.Identity.Web.Aspnet/CommonUtil.cs +++ b/Microsoft.Identity.Web.Aspnet/CommonUtil.cs @@ -17,6 +17,20 @@ public static string EnsureAuthorityIsV2(string authority) return authority; } + /// + /// Create valid issuers both for V1.0 and V2.0 + /// + /// + /// + public static List BuildValidIssuers(JwtBearerOptions webApiConfig) + { + return new List + { + $"{EnsureTrailingSlash(webApiConfig.AADInstance)}{webApiConfig.TenantId}", + $"{EnsureTrailingSlash(webApiConfig.AADInstance)}{webApiConfig.TenantId}/v2.0" + }; + } + public static string EnsureTrailingSlash(string value) { if (value == null) diff --git a/Microsoft.Identity.Web.Aspnet/MicrosoftIdentityWebApiAuthorizationBuilder.cs b/Microsoft.Identity.Web.Aspnet/MicrosoftIdentityWebApiAuthorizationBuilder.cs index 2cf90df..4666dfa 100644 --- a/Microsoft.Identity.Web.Aspnet/MicrosoftIdentityWebApiAuthorizationBuilder.cs +++ b/Microsoft.Identity.Web.Aspnet/MicrosoftIdentityWebApiAuthorizationBuilder.cs @@ -1,6 +1,8 @@ using Microsoft.IdentityModel.Tokens; using Microsoft.Owin.Security.ActiveDirectory; using Owin; +using System; +using System.Collections.Generic; namespace Microsoft.Identity.Web.Aspnet { @@ -17,10 +19,12 @@ public static void ProtectWebApiWithMicrosoftIdentity(this IAppBuilder app, JwtB new WindowsAzureActiveDirectoryBearerAuthenticationOptions { Tenant = webApiConfig.TenantId, + TokenValidationParameters = new TokenValidationParameters { SaveSigninToken = true, - ValidAudiences = webApiConfig.ValidAudiences + ValidAudiences = webApiConfig.ValidAudiences, + ValidIssuers = CommonUtil.BuildValidIssuers(webApiConfig) } }); } diff --git a/TodoListService/TodoListService.csproj b/TodoListService/TodoListService.csproj index 66ec2c2..dca61ef 100644 --- a/TodoListService/TodoListService.csproj +++ b/TodoListService/TodoListService.csproj @@ -455,7 +455,7 @@ - False + True True 9184 / From 9c3ef2242ffea3b7545de728f9ad9b72345988b0 Mon Sep 17 00:00:00 2001 From: Alexander Beyderman Date: Fri, 8 Apr 2022 13:10:40 -0400 Subject: [PATCH 2/4] added issuer validator. Had to update versions for all projects to avoid conflicts --- .../Microsoft.Identity.Web.Aspnet.csproj | 5 +- ...osoftIdentityWebApiAuthorizationBuilder.cs | 7 +- MyWebApplication/MyWebApplication.csproj | 36 +++---- MyWebApplication/Web.config | 100 ++++++++++-------- MyWebApplication/packages.config | 18 ++-- .../TodoListDownstreamService.csproj | 32 +++--- TodoListDownstreamService/Web.config | 14 ++- TodoListDownstreamService/packages.config | 14 +-- TodoListService/TodoListService.csproj | 24 ++--- TodoListService/Web.config | 28 ++--- TodoListService/packages.config | 12 +-- TodoListWebApp/TodoListWebApp.csproj | 28 ++--- TodoListWebApp/Web.config | 28 ++--- TodoListWebApp/packages.config | 14 +-- 14 files changed, 196 insertions(+), 164 deletions(-) diff --git a/Microsoft.Identity.Web.Aspnet/Microsoft.Identity.Web.Aspnet.csproj b/Microsoft.Identity.Web.Aspnet/Microsoft.Identity.Web.Aspnet.csproj index b87f347..16884ce 100644 --- a/Microsoft.Identity.Web.Aspnet/Microsoft.Identity.Web.Aspnet.csproj +++ b/Microsoft.Identity.Web.Aspnet/Microsoft.Identity.Web.Aspnet.csproj @@ -75,7 +75,10 @@ - 4.24.0 + 4.43.0 + + + 1.23.1 2.2.8 diff --git a/Microsoft.Identity.Web.Aspnet/MicrosoftIdentityWebApiAuthorizationBuilder.cs b/Microsoft.Identity.Web.Aspnet/MicrosoftIdentityWebApiAuthorizationBuilder.cs index 4666dfa..3184857 100644 --- a/Microsoft.Identity.Web.Aspnet/MicrosoftIdentityWebApiAuthorizationBuilder.cs +++ b/Microsoft.Identity.Web.Aspnet/MicrosoftIdentityWebApiAuthorizationBuilder.cs @@ -1,8 +1,7 @@ using Microsoft.IdentityModel.Tokens; +using Microsoft.IdentityModel.Validators; using Microsoft.Owin.Security.ActiveDirectory; using Owin; -using System; -using System.Collections.Generic; namespace Microsoft.Identity.Web.Aspnet { @@ -24,7 +23,9 @@ public static void ProtectWebApiWithMicrosoftIdentity(this IAppBuilder app, JwtB { SaveSigninToken = true, ValidAudiences = webApiConfig.ValidAudiences, - ValidIssuers = CommonUtil.BuildValidIssuers(webApiConfig) + //ValidIssuers = CommonUtil.BuildValidIssuers(webApiConfig), + ValidateIssuer = true, + IssuerValidator = AadIssuerValidator.GetAadIssuerValidator(new AuthenticationConfig().Authority).Validate } }); } diff --git a/MyWebApplication/MyWebApplication.csproj b/MyWebApplication/MyWebApplication.csproj index 8a84cbd..b1e26fe 100644 --- a/MyWebApplication/MyWebApplication.csproj +++ b/MyWebApplication/MyWebApplication.csproj @@ -51,35 +51,35 @@ ..\packages\Microsoft.CodeDom.Providers.DotNetCompilerPlatform.3.6.0\lib\net45\Microsoft.CodeDom.Providers.DotNetCompilerPlatform.dll - - ..\packages\Microsoft.IdentityModel.JsonWebTokens.6.8.0\lib\net461\Microsoft.IdentityModel.JsonWebTokens.dll + + ..\packages\Microsoft.IdentityModel.JsonWebTokens.6.17.0\lib\net472\Microsoft.IdentityModel.JsonWebTokens.dll - - ..\packages\Microsoft.IdentityModel.Logging.6.8.0\lib\net461\Microsoft.IdentityModel.Logging.dll + + ..\packages\Microsoft.IdentityModel.Logging.6.17.0\lib\net472\Microsoft.IdentityModel.Logging.dll - - ..\packages\Microsoft.IdentityModel.Protocols.6.8.0\lib\net461\Microsoft.IdentityModel.Protocols.dll + + ..\packages\Microsoft.IdentityModel.Protocols.6.17.0\lib\net472\Microsoft.IdentityModel.Protocols.dll - - ..\packages\Microsoft.IdentityModel.Protocols.OpenIdConnect.6.8.0\lib\net461\Microsoft.IdentityModel.Protocols.OpenIdConnect.dll + + ..\packages\Microsoft.IdentityModel.Protocols.OpenIdConnect.6.17.0\lib\net472\Microsoft.IdentityModel.Protocols.OpenIdConnect.dll - - ..\packages\Microsoft.IdentityModel.Tokens.6.8.0\lib\net461\Microsoft.IdentityModel.Tokens.dll + + ..\packages\Microsoft.IdentityModel.Tokens.6.17.0\lib\net472\Microsoft.IdentityModel.Tokens.dll - - ..\packages\Microsoft.Owin.4.1.1\lib\net45\Microsoft.Owin.dll + + ..\packages\Microsoft.Owin.4.2.0\lib\net45\Microsoft.Owin.dll ..\packages\Microsoft.Owin.Host.SystemWeb.4.1.1\lib\net45\Microsoft.Owin.Host.SystemWeb.dll - - ..\packages\Microsoft.Owin.Security.4.1.1\lib\net45\Microsoft.Owin.Security.dll + + ..\packages\Microsoft.Owin.Security.4.2.0\lib\net45\Microsoft.Owin.Security.dll ..\packages\Microsoft.Owin.Security.Cookies.4.1.1\lib\net45\Microsoft.Owin.Security.Cookies.dll - - ..\packages\Microsoft.Owin.Security.OpenIdConnect.4.1.1\lib\net45\Microsoft.Owin.Security.OpenIdConnect.dll + + ..\packages\Microsoft.Owin.Security.OpenIdConnect.4.2.0\lib\net45\Microsoft.Owin.Security.OpenIdConnect.dll ..\packages\Newtonsoft.Json.12.0.3\lib\net45\Newtonsoft.Json.dll @@ -88,8 +88,8 @@ - - ..\packages\System.IdentityModel.Tokens.Jwt.6.8.0\lib\net461\System.IdentityModel.Tokens.Jwt.dll + + ..\packages\System.IdentityModel.Tokens.Jwt.6.17.0\lib\net472\System.IdentityModel.Tokens.Jwt.dll diff --git a/MyWebApplication/Web.config b/MyWebApplication/Web.config index d4909fc..5ab0c13 100644 --- a/MyWebApplication/Web.config +++ b/MyWebApplication/Web.config @@ -1,85 +1,101 @@ - + - - - - - - - - - - + + + + + + + + + + - - + + + + + + + + + + + + + + - - + + - - + + - - + + - - + + - - + + - - + + - - + + - - + + - - + + - - + + - - + + - - + + - - + + + + + + - - + + - \ No newline at end of file + diff --git a/MyWebApplication/packages.config b/MyWebApplication/packages.config index 4fa5e4d..5eb41d4 100644 --- a/MyWebApplication/packages.config +++ b/MyWebApplication/packages.config @@ -9,23 +9,23 @@ - - + + - - - + + + - + - + - + - + \ No newline at end of file diff --git a/TodoListDownstreamService/TodoListDownstreamService.csproj b/TodoListDownstreamService/TodoListDownstreamService.csproj index 4a28ea7..32bc603 100644 --- a/TodoListDownstreamService/TodoListDownstreamService.csproj +++ b/TodoListDownstreamService/TodoListDownstreamService.csproj @@ -57,23 +57,23 @@ ..\packages\Microsoft.Graph.Core.1.24.0\lib\net45\Microsoft.Graph.Core.dll - - ..\packages\Microsoft.Identity.Client.4.24.0\lib\net461\Microsoft.Identity.Client.dll + + ..\packages\Microsoft.Identity.Client.4.43.0\lib\net461\Microsoft.Identity.Client.dll - - ..\packages\Microsoft.IdentityModel.JsonWebTokens.6.8.0\lib\net461\Microsoft.IdentityModel.JsonWebTokens.dll + + ..\packages\Microsoft.IdentityModel.JsonWebTokens.6.17.0\lib\net472\Microsoft.IdentityModel.JsonWebTokens.dll - - ..\packages\Microsoft.IdentityModel.Logging.6.8.0\lib\net461\Microsoft.IdentityModel.Logging.dll + + ..\packages\Microsoft.IdentityModel.Logging.6.17.0\lib\net472\Microsoft.IdentityModel.Logging.dll - - ..\packages\Microsoft.IdentityModel.Protocols.6.8.0\lib\net461\Microsoft.IdentityModel.Protocols.dll + + ..\packages\Microsoft.IdentityModel.Protocols.6.17.0\lib\net472\Microsoft.IdentityModel.Protocols.dll ..\packages\Microsoft.IdentityModel.Protocols.WsFederation.6.8.0\lib\net461\Microsoft.IdentityModel.Protocols.WsFederation.dll - - ..\packages\Microsoft.IdentityModel.Tokens.6.8.0\lib\net461\Microsoft.IdentityModel.Tokens.dll + + ..\packages\Microsoft.IdentityModel.Tokens.6.17.0\lib\net472\Microsoft.IdentityModel.Tokens.dll ..\packages\Microsoft.IdentityModel.Tokens.Saml.6.8.0\lib\net461\Microsoft.IdentityModel.Tokens.Saml.dll @@ -112,8 +112,8 @@ - - ..\packages\System.IdentityModel.Tokens.Jwt.6.8.0\lib\net461\System.IdentityModel.Tokens.Jwt.dll + + ..\packages\System.IdentityModel.Tokens.Jwt.6.17.0\lib\net472\System.IdentityModel.Tokens.Jwt.dll ..\packages\System.Memory.4.5.4\lib\net461\System.Memory.dll @@ -122,8 +122,8 @@ ..\packages\System.Numerics.Vectors.4.5.0\lib\net46\System.Numerics.Vectors.dll - - ..\packages\System.Runtime.CompilerServices.Unsafe.4.5.3\lib\net461\System.Runtime.CompilerServices.Unsafe.dll + + ..\packages\System.Runtime.CompilerServices.Unsafe.6.0.0\lib\net461\System.Runtime.CompilerServices.Unsafe.dll ..\packages\System.ValueTuple.4.3.0\lib\netstandard1.0\System.ValueTuple.dll @@ -419,10 +419,6 @@ {16c31491-e7d6-4d70-b044-7b46875f6001} Microsoft.Identity.Web.Aspnet - - {dc125d26-fa15-4a55-82c8-dd0f9536525c} - TodoList.Shared - 10.0 diff --git a/TodoListDownstreamService/Web.config b/TodoListDownstreamService/Web.config index 3b624a9..2296010 100644 --- a/TodoListDownstreamService/Web.config +++ b/TodoListDownstreamService/Web.config @@ -29,7 +29,7 @@ - + @@ -37,11 +37,11 @@ - + - + @@ -79,6 +79,14 @@ + + + + + + + + diff --git a/TodoListDownstreamService/packages.config b/TodoListDownstreamService/packages.config index 1540768..0d7a8e4 100644 --- a/TodoListDownstreamService/packages.config +++ b/TodoListDownstreamService/packages.config @@ -15,12 +15,12 @@ - - - - + + + + - + @@ -36,10 +36,10 @@ - + - + \ No newline at end of file diff --git a/TodoListService/TodoListService.csproj b/TodoListService/TodoListService.csproj index dca61ef..d38685b 100644 --- a/TodoListService/TodoListService.csproj +++ b/TodoListService/TodoListService.csproj @@ -68,23 +68,23 @@ ..\packages\Microsoft.Extensions.Primitives.5.0.0\lib\net461\Microsoft.Extensions.Primitives.dll - - ..\packages\Microsoft.Identity.Client.4.24.0\lib\net461\Microsoft.Identity.Client.dll + + ..\packages\Microsoft.Identity.Client.4.43.0\lib\net461\Microsoft.Identity.Client.dll - - ..\packages\Microsoft.IdentityModel.JsonWebTokens.6.8.0\lib\net461\Microsoft.IdentityModel.JsonWebTokens.dll + + ..\packages\Microsoft.IdentityModel.JsonWebTokens.6.17.0\lib\net472\Microsoft.IdentityModel.JsonWebTokens.dll - - ..\packages\Microsoft.IdentityModel.Logging.6.8.0\lib\net461\Microsoft.IdentityModel.Logging.dll + + ..\packages\Microsoft.IdentityModel.Logging.6.17.0\lib\net472\Microsoft.IdentityModel.Logging.dll - - ..\packages\Microsoft.IdentityModel.Protocols.6.8.0\lib\net461\Microsoft.IdentityModel.Protocols.dll + + ..\packages\Microsoft.IdentityModel.Protocols.6.17.0\lib\net472\Microsoft.IdentityModel.Protocols.dll ..\packages\Microsoft.IdentityModel.Protocols.WsFederation.6.8.0\lib\net461\Microsoft.IdentityModel.Protocols.WsFederation.dll - - ..\packages\Microsoft.IdentityModel.Tokens.6.8.0\lib\net461\Microsoft.IdentityModel.Tokens.dll + + ..\packages\Microsoft.IdentityModel.Tokens.6.17.0\lib\net472\Microsoft.IdentityModel.Tokens.dll ..\packages\Microsoft.IdentityModel.Tokens.Saml.6.8.0\lib\net461\Microsoft.IdentityModel.Tokens.Saml.dll @@ -130,8 +130,8 @@ - - ..\packages\System.IdentityModel.Tokens.Jwt.6.8.0\lib\net461\System.IdentityModel.Tokens.Jwt.dll + + ..\packages\System.IdentityModel.Tokens.Jwt.6.17.0\lib\net472\System.IdentityModel.Tokens.Jwt.dll ..\packages\System.Memory.4.5.4\lib\net461\System.Memory.dll diff --git a/TodoListService/Web.config b/TodoListService/Web.config index 4e7f64a..46f3687 100644 --- a/TodoListService/Web.config +++ b/TodoListService/Web.config @@ -18,14 +18,14 @@ - - - - - - - - + + + + + + + + @@ -63,7 +63,7 @@ - + @@ -79,11 +79,11 @@ - + - + @@ -91,7 +91,7 @@ - + @@ -121,6 +121,10 @@ + + + + diff --git a/TodoListService/packages.config b/TodoListService/packages.config index 7da730f..a634dc0 100644 --- a/TodoListService/packages.config +++ b/TodoListService/packages.config @@ -18,12 +18,12 @@ - - - - + + + + - + @@ -40,7 +40,7 @@ - + diff --git a/TodoListWebApp/TodoListWebApp.csproj b/TodoListWebApp/TodoListWebApp.csproj index ac8faa7..252e3e2 100644 --- a/TodoListWebApp/TodoListWebApp.csproj +++ b/TodoListWebApp/TodoListWebApp.csproj @@ -56,23 +56,23 @@ ..\packages\Microsoft.CodeDom.Providers.DotNetCompilerPlatform.3.6.0\lib\net45\Microsoft.CodeDom.Providers.DotNetCompilerPlatform.dll - - ..\packages\Microsoft.Identity.Client.4.24.0\lib\net461\Microsoft.Identity.Client.dll + + ..\packages\Microsoft.Identity.Client.4.43.0\lib\net461\Microsoft.Identity.Client.dll - - ..\packages\Microsoft.IdentityModel.JsonWebTokens.6.8.0\lib\net461\Microsoft.IdentityModel.JsonWebTokens.dll + + ..\packages\Microsoft.IdentityModel.JsonWebTokens.6.17.0\lib\net472\Microsoft.IdentityModel.JsonWebTokens.dll - - ..\packages\Microsoft.IdentityModel.Logging.6.8.0\lib\net461\Microsoft.IdentityModel.Logging.dll + + ..\packages\Microsoft.IdentityModel.Logging.6.17.0\lib\net472\Microsoft.IdentityModel.Logging.dll - - ..\packages\Microsoft.IdentityModel.Protocols.6.8.0\lib\net461\Microsoft.IdentityModel.Protocols.dll + + ..\packages\Microsoft.IdentityModel.Protocols.6.17.0\lib\net472\Microsoft.IdentityModel.Protocols.dll - - ..\packages\Microsoft.IdentityModel.Protocols.OpenIdConnect.6.8.0\lib\net461\Microsoft.IdentityModel.Protocols.OpenIdConnect.dll + + ..\packages\Microsoft.IdentityModel.Protocols.OpenIdConnect.6.17.0\lib\net472\Microsoft.IdentityModel.Protocols.OpenIdConnect.dll - - ..\packages\Microsoft.IdentityModel.Tokens.6.8.0\lib\net461\Microsoft.IdentityModel.Tokens.dll + + ..\packages\Microsoft.IdentityModel.Tokens.6.17.0\lib\net472\Microsoft.IdentityModel.Tokens.dll ..\packages\Microsoft.Owin.4.1.1\lib\net45\Microsoft.Owin.dll @@ -99,8 +99,8 @@ - - ..\packages\System.IdentityModel.Tokens.Jwt.6.8.0\lib\net461\System.IdentityModel.Tokens.Jwt.dll + + ..\packages\System.IdentityModel.Tokens.Jwt.6.17.0\lib\net472\System.IdentityModel.Tokens.Jwt.dll diff --git a/TodoListWebApp/Web.config b/TodoListWebApp/Web.config index db5b698..7fd63c5 100644 --- a/TodoListWebApp/Web.config +++ b/TodoListWebApp/Web.config @@ -7,13 +7,13 @@ - - - - - - - + + + + + + + @@ -55,15 +55,15 @@ - + - + - + @@ -71,7 +71,7 @@ - + @@ -87,7 +87,11 @@ - + + + + + diff --git a/TodoListWebApp/packages.config b/TodoListWebApp/packages.config index 029e0da..fee20f3 100644 --- a/TodoListWebApp/packages.config +++ b/TodoListWebApp/packages.config @@ -12,13 +12,13 @@ - - - + + + - - - + + + @@ -29,6 +29,6 @@ - + \ No newline at end of file From 9e3e35aab3fa69b1fc0e71c0c76521729aaab6ba Mon Sep 17 00:00:00 2001 From: Alexander Beyderman Date: Fri, 8 Apr 2022 13:12:55 -0400 Subject: [PATCH 3/4] removed redundant method --- Microsoft.Identity.Web.Aspnet/CommonUtil.cs | 14 -------------- 1 file changed, 14 deletions(-) diff --git a/Microsoft.Identity.Web.Aspnet/CommonUtil.cs b/Microsoft.Identity.Web.Aspnet/CommonUtil.cs index 88b0207..32fcf57 100644 --- a/Microsoft.Identity.Web.Aspnet/CommonUtil.cs +++ b/Microsoft.Identity.Web.Aspnet/CommonUtil.cs @@ -17,20 +17,6 @@ public static string EnsureAuthorityIsV2(string authority) return authority; } - /// - /// Create valid issuers both for V1.0 and V2.0 - /// - /// - /// - public static List BuildValidIssuers(JwtBearerOptions webApiConfig) - { - return new List - { - $"{EnsureTrailingSlash(webApiConfig.AADInstance)}{webApiConfig.TenantId}", - $"{EnsureTrailingSlash(webApiConfig.AADInstance)}{webApiConfig.TenantId}/v2.0" - }; - } - public static string EnsureTrailingSlash(string value) { if (value == null) From 242e57b660d5e4c4cad4cc6e8d779ba6c2dfb2eb Mon Sep 17 00:00:00 2001 From: Alexander Beyderman Date: Mon, 11 Apr 2022 15:37:31 -0400 Subject: [PATCH 4/4] refactoring --- .../MicrosoftIdentityWebApiAuthorizationBuilder.cs | 2 -- 1 file changed, 2 deletions(-) diff --git a/Microsoft.Identity.Web.Aspnet/MicrosoftIdentityWebApiAuthorizationBuilder.cs b/Microsoft.Identity.Web.Aspnet/MicrosoftIdentityWebApiAuthorizationBuilder.cs index 3184857..45ae7a4 100644 --- a/Microsoft.Identity.Web.Aspnet/MicrosoftIdentityWebApiAuthorizationBuilder.cs +++ b/Microsoft.Identity.Web.Aspnet/MicrosoftIdentityWebApiAuthorizationBuilder.cs @@ -23,8 +23,6 @@ public static void ProtectWebApiWithMicrosoftIdentity(this IAppBuilder app, JwtB { SaveSigninToken = true, ValidAudiences = webApiConfig.ValidAudiences, - //ValidIssuers = CommonUtil.BuildValidIssuers(webApiConfig), - ValidateIssuer = true, IssuerValidator = AadIssuerValidator.GetAadIssuerValidator(new AuthenticationConfig().Authority).Validate } });