Update InstanceDiscovery.cs (#1674)

* Update InstanceDiscovery.cs Dynamicly add dSTS endpoints to whitelist for endpoint discovery. Remove hard coded whitelisting of dSTS endpoints and add dynamic discovery. * Update InstanceDiscovery.cs Update StringComparison to OrdinalIgnorCase.
AzureAD · Oct 31, 2019 · 661d12c · 661d12c
1 parent 4c9c9ea
commit 661d12c
Showing 1 changed file with 9 additions and 8 deletions.
diff --git a/src/Microsoft.IdentityModel.Clients.ActiveDirectory/Internal/Instance/InstanceDiscovery.cs b/src/Microsoft.IdentityModel.Clients.ActiveDirectory/Internal/Instance/InstanceDiscovery.cs
@@ -76,14 +76,7 @@ internal class InstanceDiscovery
             "login.microsoftonline.com" // Microsoft Azure Worldwide
         });
 
-        private static HashSet<string> WhitelistedDomains = new HashSet<string>(new[]
-        {
-            "dsts.core.windows.net", 
-            "dsts.core.chinacloudapi.cn", 
-            "dsts.core.cloudapi.de",
-            "dsts.core.usgovcloudapi.net", 
-            "dsts.core.azure-test.net"
-        });
+        private static HashSet<string> WhitelistedDomains = new HashSet<string>();
 
         private readonly IHttpManager _httpManager;
 
@@ -119,6 +112,14 @@ public async Task<InstanceDiscoveryMetadataEntry> GetMetadataEntryAsync(Uri auth
                 await semaphore.WaitAsync().ConfigureAwait(false); // SemaphoreSlim.WaitAsync() will not block current thread
                 try
                 {
+                    // Dynamicly add dSTS endpoints to whitelist
+                    if (authority.Host.Contains(".dsts.") && 
+                        !WhitelistedDomains.Any(domain => authority.Host.EndsWith(domain, StringComparison.OrdinalIgnoreCase)))
+                    {
+                        int dstsSuffixIndex = authority.Host.IndexOf(".dsts.", StringComparison.OrdinalIgnoreCase) + 1;
+                        WhitelistedDomains.Add(authority.Host.Substring(dstsSuffixIndex));
+                    }
+
                     if (!InstanceCache.TryGetValue(authority.Host, out entry))
                     {
                         await DiscoverAsync(authority, validateAuthority, requestContext).ConfigureAwait(false);