initial commit to move issuer validator to separate assembly from idweb #1736

jennyf19 · 2021-10-22T01:47:41Z

initial commit to move issuer validator to separate assembly from MS.Id.Web

I'm unable to get the VS test runner to run, but the tests pass in the command line. will keep trying to get that sorted out.

@GeoK have addressed your PR comments from the initial PR in Id.Web.

note: only code changes were from suggestions 1 and 2 from @GeoK between Id.Web and this commit.

Also resolves #1731

Update @brentschmaltz

In OpenIdConnectOptions configuration, we would now do the following with the latest changes (10.24):

AadIssuerValidator aadIssuerValidator = AadIssuerValidator.GetAadIssuerValidator(authority, openIdConnectOptions.Backchannel).Validate;

Update 10.25
Tested M.IM.Validators with ID Web -> Web app calls web API calls graph & B2C calls web API

…Id.Web

jennyf19 · 2021-10-22T01:48:16Z

src/Microsoft.IdentityModel.Tokens/Properties/AssemblyInfo.cs

@@ -47,3 +47,4 @@
 [assembly: InternalsVisibleTo("Microsoft.IdentityModel.KeyVaultExtensions.Tests, PublicKey=0024000004800000940000000602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9")]
 [assembly: InternalsVisibleTo("Microsoft.IdentityModel.Protocols, PublicKey=0024000004800000940000000602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9")]
 [assembly: InternalsVisibleTo("Microsoft.IdentityModel.Protocols.Tests, PublicKey=0024000004800000940000000602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9")]
+[assembly: InternalsVisibleTo("Microsoft.IdentityModel.Validators, PublicKey=0024000004800000940000000602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9")]


this is for the M.IM.Json opensource classes.

jmprieur

LGTM
Thanks @jennyf19.

For the error message strings that were renamed form IDW to IDX401xx,
shall we want to do a transformation at the IdWeb level ? or just document that they had changed?

jennyf19 · 2021-10-22T03:14:00Z

I'm not sure what we will do, but can discuss once these updates are out and we can try things out more easily.

In reply to: 786380485

brentschmaltz · 2021-10-22T19:27:45Z

src/Microsoft.IdentityModel.Validators/AadIssuerValidator/AadIssuerValidator.cs

+        /// <exception cref="ArgumentNullException"> if <paramref name="validationParameters"/> is null.</exception>
+        /// <exception cref="SecurityTokenInvalidIssuerException">if the issuer is invalid or if there is a network issue. </exception>
+        public string Validate(
+            string actualIssuer,


suggest name: issuer rather than actualIssuer. #Resolved

brentschmaltz · 2021-10-22T19:29:42Z

src/Microsoft.IdentityModel.Validators/AadIssuerValidator/AadIssuerValidator.cs

+        {
+            if (string.IsNullOrEmpty(actualIssuer))
+            {
+                throw new ArgumentNullException(nameof(actualIssuer));


normally we log all exceptions thrown using LogHelper.LogArgumentNullException, we should follow this same pattern here.
see:

azure-activedirectory-identitymodel-extensions-for-dotnet/src/Microsoft.IdentityModel.Tokens/Validators.cs

Line 223 in d8ad857

throw LogHelper.LogExceptionMessage(new SecurityTokenInvalidIssuerException(LogMessages.IDX10211)

#Resolved

yes, thanks! i meant to look into this yesterday. it was on my list. updated and fixed.

brentschmaltz · 2021-10-22T19:45:45Z

src/Microsoft.IdentityModel.Validators/AadIssuerValidator/AadIssuerValidator.cs

+namespace Microsoft.IdentityModel.Validators
+{
+    /// <summary>
+    /// Generic class that validates token issuer from the Microsoft identity platform (AAD).


Wilson validates SAML and SAML2 tokens, we need to comment that this class only works with either a JsonWebToken or a JwtSecurityToken. #Resolved

updated the comment. good point.

brentschmaltz · 2021-10-22T19:48:17Z

src/Microsoft.IdentityModel.Validators/AadIssuerValidator/AadIssuerValidatorFactory.cs

+        /// Initializes a new instance of the <see cref="AadIssuerValidatorFactory"/> class.
+        /// </summary>
+        /// <param name="httpClient">Optional HttpClient to use to retrieve the endpoint metadata (can be null).</param>
+        public AadIssuerValidatorFactory(


normally we don't use default parameters and have multiple ctors.
The reason is adding a default parameter can cause a runtime failure, so we just choose to not use them for public apis. #Resolved

make sense. we had an issue w/this w/MSAL.NET a few weeks ago.

fixed.

GeoK · 2021-10-22T22:30:14Z

src/Microsoft.IdentityModel.Validators/AadIssuerValidator/AadIssuerValidator.cs

+            catch (Exception ex)
+            {
+                throw LogHelper.LogExceptionMessage(new SecurityTokenInvalidIssuerException(
+                string.Format(


LogHelper.FormatInvariant is used on other places to make sure log parameters are obfuscated. There is a parallel work stream that would allow non-PII arguments not to get obfuscated, but it will work in conjunction with LogHelper.FormatInvariant. #Resolved

should i use LogHelper.FormatInvariant instead?

yes please use LogHelper.FormatInvariant

fixed. thanks. very cool

GeoK · 2021-10-22T22:32:48Z

We should update strongname bypass scripts as M.IM.Validators is a new assembly (#1, #2)

In reply to: 949995333

GeoK · 2021-10-22T22:40:37Z

src/Microsoft.IdentityModel.Validators/AadIssuerValidator/AadIssuerValidator.cs

+                throw new ArgumentNullException(nameof(validationParameters));
+            }
+
+            string tenantId = GetTenantIdFromToken(securityToken);


Can we pull GetTenantId into IsValidIssuer? Thinking that for single-tenant apps there will be no need to extract tenantId and it would result in a waste of cycles for each request.

potentially IsValidIssuer could be called several times. would you recommend having the tenantId as a ref parameter of IsValidIssuer? computed the first time

GeoK · 2021-10-22T22:42:30Z

src/Microsoft.IdentityModel.Validators/AadIssuerValidator/AadIssuerValidator.cs

+            if (securityToken == null)
+            {
+                throw new ArgumentNullException(nameof(securityToken));
+            }


Suggested change

if (securityToken == null)

{

throw new ArgumentNullException(nameof(securityToken));

}

_ = securityToken ?? throw new ArgumentNullException(nameof(securityToken));

``` #Resolved

nice! thx. fixed.

brentschmaltz · 2021-10-22T23:44:17Z

@jmprieur there is more work to do before this should be pulled in.

brentschmaltz · 2021-10-22T23:45:29Z

src/Microsoft.IdentityModel.Validators/AadIssuerValidator/AadIssuerValidator.cs

+            TokenValidationParameters validationParameters)
+        {
+            _ = issuer ?? throw new ArgumentNullException(nameof(issuer));
+


we usually don't have blank lines.
we try to have minimal spacing #Resolved

sounds good. have removed several.

brentschmaltz · 2021-10-22T23:49:22Z

src/Microsoft.IdentityModel.Validators/AadIssuerValidator/AadIssuerValidator.cs

+    /// </summary>
+    public class AadIssuerValidator
+    {
+        internal AadIssuerValidator(


How will this constructor be used? #Resolved

Something like the following:

AadIssuerValidatorFactory factory = new AadIssuerValidatorFactory(/* http client */); options.TokenValidationParameters.IssuerValidator = factory.GetAadIssuerValidator(authority).Validate;

@jennyf19 : we should add a <example><code> blob in the XML comment to show how this method is used.

Or with SAL policies, this sample code

update the xml

I am questioning the need for the factory, a static method on the class would do the same thing.

brentschmaltz · 2021-10-23T00:08:52Z

src/Microsoft.IdentityModel.Validators/AadIssuerValidator/AadIssuerValidatorFactory.cs

+    /// <summary>
+    /// Factory class for creating the AadIssuerValidator per authority.
+    /// </summary>
+    public class AadIssuerValidatorFactory


I am not completely understanding the need for this factory.
It seems that the usage pattern is a singleton that is attached to TokenValidationParameters on startup.
Help me understand the need to cache the delegate.
We could just as easily have a static method on the class. #Pending

Previously we had a static, but customers wanted to inject an HttpClient to retrieve the OpenId Connect doc, so we moved to a factory and we cache the delegates because there can be several authories in an application and several token versions.

There could be two overloads and one could have a HttpClient as a parameter.
When there is no HttpClient passed, we need to use the HttpClient from BaseConfigurationManager.
Reusing the same HttpClient (in the null case we create and reuse a HttpClient) could lead to stale DNS issues.

i think is is resovled now by using the validationParams to get the issuer, in the v2 case.

brentschmaltz · 2021-10-23T00:22:51Z

...dentityModel.Validators/AadIssuerValidator/InstanceDiscovery/IssuerConfigurationRetriever.cs

+    /// <summary>
+    /// An implementation of IConfigurationRetriever geared towards Azure AD issuers metadata.
+    /// </summary>
+    internal class IssuerConfigurationRetriever : IConfigurationRetriever<IssuerMetadata>


Why do we need a custom IConfigurationRetriever?
Are we getting a standard discovery document? #Resolved

I'm not sure. What do you recommend?

we do retrieve a standard discovery document, but only are interested in the issuer property, so why deserialize everything?

Everything will get deserialized anyway, the entire json is read into memory.
That will take place once and is a very small time compared to the http get to the discovery endpoint.
These custom classes will need to be supported for a long time, it they are not needed, i recommend using the standard.
In the future is we need anything additional from AAD, we will need to change the object design.

got it. fixed.

brentschmaltz · 2021-10-23T00:30:16Z

src/Microsoft.IdentityModel.Validators/AadIssuerValidator/AadIssuerValidator.cs

+            {
+                if (securityToken.Issuer.EndsWith("v2.0", StringComparison.OrdinalIgnoreCase))
+                {
+                    if (AadIssuerV2 == null)


In the v2 case can't TokenValidationParameters.ConfigurationManager and / or Configuration be used to get the issuer from: BaseConfiguration? #Resolved

This was a new feature we just added a couple of weeks ago.
@mafurman knows most about it.

yes. fixed. thanks for the pointing that out.

The logic here for making use of TokenValidationParameters.ConfigurationManager + Configuration looks good. :)

This should fit well into the most recent Last Known Good (LKG) PR as one of the exceptions it looks for is SecurityTokenInvalidIssuerException in order to determine if LKG fallback or configuration refresh is necessary.

brentschmaltz · 2021-10-23T00:33:55Z

src/Microsoft.IdentityModel.Validators/AadIssuerValidator/AadIssuerValidator.cs

+        private ConfigurationManager<IssuerMetadata> CreateConfigManager(
+            string aadAuthority)
+        {
+            if (HttpClient != null)


We should be using the HttpClient from BaseConfigurationManager, we will need to expose that.
The asp.net team asked us to make sure all calls use that HttpClient. #Resolved

that's cool. we can have a static method then.

brentschmaltz · 2021-10-23T04:59:23Z

src/Microsoft.IdentityModel.Validators/AadIssuerValidator/AadIssuerValidator.cs

+
+            if (securityToken is JsonWebToken jsonWebToken)
+            {
+                jsonWebToken.TryGetPayloadValue(AadIssuerValidatorConstants.Tid, out string tid);


this could be written (same below):
if (jsonWebToken.TryGetPayloadValue(AadIssuerValidatorConstants.Tid, out string tid) return tid #Resolved

brentschmaltz · 2021-10-23T05:02:43Z

src/Microsoft.IdentityModel.Validators/AadIssuerValidator/AadIssuerValidator.cs

+                    return (string)tid;
+
+                jwtSecurityToken.Payload.TryGetValue(AadIssuerValidatorConstants.TenantId, out object tenantId);
+                if (tenantId != null)


why check null here but not above? #Resolved

not sure, but have used what you suggested here as well.

brentschmaltz · 2021-10-23T05:27:40Z

src/Microsoft.IdentityModel.Validators/AadIssuerValidator/AadIssuerValidator.cs

+            {
+                try
+                {
+                    Uri issuerFromTemplateUri = new Uri(validIssuerTemplate.Replace("{tenantid}", tenantId));


Why do we need to create the Uri's?
Below we just compare the strings. #Resolved

will do, but need to check on the actual string format, example if there are trailing /'s anywhere or not.

brentschmaltz · 2021-10-23T05:36:55Z

src/Microsoft.IdentityModel.Validators/AadIssuerValidator/AadIssuerValidator.cs

+                    if (AadIssuerV2 == null)
+                    {
+                        IssuerMetadata issuerMetadata =
+                            CreateConfigManager(AadAuthority).GetConfigurationAsync().ConfigureAwait(false).GetAwaiter().GetResult();


I think there is a race condition here.
Consider two threads with different tokens, one v1, one v2.
AadAuthority is used in both cases. CreateV1Authority could modify AadAuthority.
It may be simpler to have two separate variables and initialize them on creation since the change in the V1 case is not dependent on the token arriving.
In any case, two variables would help. #Resolved

good point. fixed.

brentschmaltz · 2021-10-23T05:43:07Z

src/Microsoft.IdentityModel.Validators/AadIssuerValidator/AadIssuerValidator.cs

+                return uri.Segments[1].TrimEnd('/');
+
+            if (uri.Segments.Length == 5 && uri.Segments[1].TrimEnd('/') == AadIssuerValidatorConstants.Tfp)
+                throw new SecurityTokenInvalidIssuerException(LogMessages.IDX40104);


make sure to use LogHelper.LogExceptionMessage when throwing. #Resolved

yes missed this one. i've checked the remaining files as well and updated if needed.

mafurman · 2021-10-25T19:22:49Z

src/Microsoft.IdentityModel.Validators/AadIssuerValidator/AadIssuerValidator.cs

+        /// TokenValidationParameters.IssuerValidator = aadIssuerValidator.Validate;
+        /// </code></example>
+        /// <remarks>The issuer is considered as valid if it has the same HTTP scheme and authority as the
+        /// authority from the configuration file, has a tenant ID, and optionally v2.0 (this web API


nit: should this say "(if this web API...)" #Resolved

probably, yes. thanks. fixed.

mafurman

Do we need to add any tests that plug this new IssuerValidator into the JwtSecurityTokenHandler/JsonWebTokenHandler? I know we have tests that use custom validators so it might not be necessary.

mafurman · 2021-10-25T19:57:56Z

src/Microsoft.IdentityModel.Validators/AadIssuerValidator/AadIssuerValidator.cs

+
+                    return issuerFromTemplate == actualIssuer;
+                }
+#pragma warning disable CA1031 // Do not catch general exception types


We generally put these in the GlobalSuppressions.cs file that's present in each assembly. #Resolved

makes sense. was following another class that did this, but have added a GS file. thanks again

mafurman · 2021-10-25T20:02:45Z

src/Microsoft.IdentityModel.Validators/AadIssuerValidator/AadIssuerValidator.cs

+namespace Microsoft.IdentityModel.Validators
+{
+    /// <summary>
+    /// Generic class that validates either JsonWebTokens or JwtSecurityTokens issued from the Microsoft identity platform (AAD).


Should this comment say "that validates the issuer for either"? #Resolved

mafurman · 2021-10-25T20:06:17Z

src/Microsoft.IdentityModel.Validators/AadIssuerValidator/AadIssuerValidator.cs

+            {
+                if (securityToken.Issuer.EndsWith("v2.0", StringComparison.OrdinalIgnoreCase))
+                {
+                    if (AadIssuerV2 == null)


The logic here for making use of TokenValidationParameters.ConfigurationManager + Configuration looks good. :)

This should fit well into the most recent Last Known Good (LKG) PR as one of the exceptions it looks for is SecurityTokenInvalidIssuerException in order to determine if LKG fallback or configuration refresh is necessary.

mafurman · 2021-10-25T20:16:13Z

test/Microsoft.IdentityModel.Validators.Tests/MicrosoftIdentityIssuerValidatorTest.cs

+
+            var actualIssuers = validator.Validate(ValidatorConstants.AadIssuer, jwtSecurityToken, new TokenValidationParameters() { ValidIssuers = new[] { ValidatorConstants.AadIssuer } });
+
+            Assert.Equal(ValidatorConstants.AadIssuer, actualIssuers);


nit: We generally like to use our CompareContext and IdentityComparer classes during testing as they allow us to get more information out of test failures (e.g. if the first AssertEqual here fails we won't know anything about the next one). #Resolved

cool. I didn't see that. i've used IdentityComparer. thanks

- xml comments - use `IdentityComparer` in tests clean-up

jmprieur

LGTM
Thanks @jennyf19

src/Microsoft.IdentityModel.Validators/AadIssuerValidator/AadIssuerValidator.cs

initial commit to move issuer validator to separate assembly from MS.…

699129b

…Id.Web

jennyf19 requested review from GeoK, brentschmaltz and jmprieur October 22, 2021 01:47

jennyf19 commented Oct 22, 2021

View reviewed changes

add to bulid config

f105231

jennyf19 mentioned this pull request Oct 22, 2021

SecurityTokenInvalidIssuerException with OpenID Connect and the Azure AD "common" endpoint #1731

Closed

fix capital letter in test

e01ec5d

jmprieur changed the title ~~initial commit to move issuer validator to separate assembly from MS.…~~ initial commit to move issuer validator to separate assembly from idweb Oct 22, 2021

jmprieur approved these changes Oct 22, 2021

View reviewed changes

brentschmaltz reviewed Oct 22, 2021

View reviewed changes

PR feedback from Brent

02feea8

GeoK reviewed Oct 22, 2021

View reviewed changes

jennyf19 added 2 commits October 22, 2021 15:43

add strong name bypass for new assembly

f667593

update log message format & argument null checks

160e62a

brentschmaltz reviewed Oct 22, 2021

View reviewed changes

brentschmaltz reviewed Oct 23, 2021

View reviewed changes

use LogHelper.FormatInvariant, remove lines, update comment

bfbcd73

brentschmaltz reviewed Oct 23, 2021

View reviewed changes

jennyf19 added 2 commits October 24, 2021 17:33

remove factory, add static, and use validation params

e889277

remove issuer config retriever to use standard, update exceptions

a62338e

mafurman reviewed Oct 25, 2021

View reviewed changes

mafurman approved these changes Oct 25, 2021

View reviewed changes

address Maria's feedback:

e28af2b

- xml comments - use `IdentityComparer` in tests clean-up

jmprieur approved these changes Oct 26, 2021

View reviewed changes

brentschmaltz reviewed Oct 27, 2021

View reviewed changes

src/Microsoft.IdentityModel.Validators/AadIssuerValidator/AadIssuerValidator.cs Show resolved Hide resolved

brentschmaltz approved these changes Oct 27, 2021

View reviewed changes

add a line

76b90bb

jennyf19 merged commit 697f090 into dev Oct 27, 2021

brentschmaltz deleted the jennyf/issuerValidator branch April 3, 2023 17:59


		var actualIssuers = validator.Validate(ValidatorConstants.AadIssuer, jwtSecurityToken, new TokenValidationParameters() { ValidIssuers = new[] { ValidatorConstants.AadIssuer } });

		Assert.Equal(ValidatorConstants.AadIssuer, actualIssuers);

initial commit to move issuer validator to separate assembly from idweb #1736

initial commit to move issuer validator to separate assembly from idweb #1736

Conversation

jennyf19 commented Oct 22, 2021 • edited Loading

Choose a reason for hiding this comment

jmprieur left a comment

Choose a reason for hiding this comment

jennyf19 commented Oct 22, 2021

brentschmaltz Oct 22, 2021 • edited by jennyf19 Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

brentschmaltz Oct 22, 2021 • edited by jennyf19 Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

brentschmaltz Oct 22, 2021 • edited by jennyf19 Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

brentschmaltz Oct 22, 2021 • edited by jennyf19 Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

GeoK Oct 22, 2021 • edited by jennyf19 Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

GeoK commented Oct 22, 2021 • edited by jennyf19 Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

GeoK Oct 22, 2021 • edited by jennyf19 Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

brentschmaltz commented Oct 22, 2021

brentschmaltz Oct 22, 2021 • edited by jennyf19 Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

brentschmaltz Oct 22, 2021 • edited by jennyf19 Loading

Choose a reason for hiding this comment

jmprieur Oct 22, 2021 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

brentschmaltz Oct 23, 2021 • edited by jennyf19 Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

brentschmaltz Oct 23, 2021 • edited by jennyf19 Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

brentschmaltz Oct 23, 2021 • edited by jennyf19 Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

brentschmaltz Oct 23, 2021 • edited by jennyf19 Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

brentschmaltz Oct 23, 2021 • edited by jennyf19 Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

brentschmaltz Oct 23, 2021 • edited by jennyf19 Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

brentschmaltz Oct 23, 2021 • edited by jennyf19 Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

brentschmaltz Oct 23, 2021 • edited by jennyf19 Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

brentschmaltz Oct 23, 2021 • edited by jennyf19 Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mafurman Oct 25, 2021 • edited by jennyf19 Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mafurman left a comment • edited Loading

jennyf19 commented Oct 22, 2021 •

edited

Loading

brentschmaltz Oct 22, 2021 •

edited by jennyf19

Loading

brentschmaltz Oct 22, 2021 •

edited by jennyf19

Loading

brentschmaltz Oct 22, 2021 •

edited by jennyf19

Loading

brentschmaltz Oct 22, 2021 •

edited by jennyf19

Loading

GeoK Oct 22, 2021 •

edited by jennyf19

Loading

GeoK commented Oct 22, 2021 •

edited by jennyf19

Loading

GeoK Oct 22, 2021 •

edited by jennyf19

Loading

brentschmaltz Oct 22, 2021 •

edited by jennyf19

Loading

brentschmaltz Oct 22, 2021 •

edited by jennyf19

Loading

jmprieur Oct 22, 2021 •

edited

Loading

brentschmaltz Oct 23, 2021 •

edited by jennyf19

Loading

brentschmaltz Oct 23, 2021 •

edited by jennyf19

Loading

brentschmaltz Oct 23, 2021 •

edited by jennyf19

Loading

brentschmaltz Oct 23, 2021 •

edited by jennyf19

Loading

brentschmaltz Oct 23, 2021 •

edited by jennyf19

Loading

brentschmaltz Oct 23, 2021 •

edited by jennyf19

Loading

brentschmaltz Oct 23, 2021 •

edited by jennyf19

Loading

brentschmaltz Oct 23, 2021 •

edited by jennyf19

Loading

brentschmaltz Oct 23, 2021 •

edited by jennyf19

Loading

mafurman Oct 25, 2021 •

edited by jennyf19

Loading

mafurman left a comment •

edited

Loading

mafurman Oct 25, 2021 •

edited by jennyf19

Loading

mafurman Oct 25, 2021 •

edited by jennyf19

Loading

mafurman Oct 25, 2021 •

edited by jennyf19

Loading