Correct identity token encryption by setting the correct security policy for the user token. #2976
Conversation
…icy for the user token.
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #2976 +/- ##
==========================================
- Coverage 55.46% 55.40% -0.06%
==========================================
Files 352 352
Lines 67853 67851 -2
Branches 13904 13904
==========================================
- Hits 37634 37593 -41
- Misses 26100 26130 +30
- Partials 4119 4128 +9 ☔ View full report in Codecov by Sentry. |
| @@ -2654,6 +2654,8 @@ public void UpdateSession(IUserIdentity identity, StringCollection preferredLoca | |||
| identityToken.PolicyId = identityPolicy.PolicyId; | |||
| userTokenSignature = identityToken.Sign(dataToSign, securityPolicyUri); | |||
|
|
|||
| m_userTokenSecurityPolicyUri = securityPolicyUri; | |||
There was a problem hiding this comment.
All other fields are only updated after the activate Session call, not shure if this is the right place to Update?
There was a problem hiding this comment.
The m_userTokenSecurityPolicyUri value is used inside the Encrypt method. securityPolicy can be passed directly also and the m_userTokenSecurityPolicyUri be updated after but all places where Encrypt is called call it this way
There was a problem hiding this comment.
I think whats confusing here is that the same variable is used for different purposes, first for client signature, then user signature, which can have a different Uri. Having a new var for the second use case would make it easier to understand.
There was a problem hiding this comment.
Ok, I've separated them
Correct identity token encryption by setting the correct security policy for the user token in client session UpdateSession.
Proposed changes
Correct identity token encryption by setting the correct security policy for the user token in client session UpdateSession.
Related Issues
Types of changes
What types of changes does your code introduce?
Put an
xin the boxes that apply. You can also fill these out after creating the PR.Checklist
Put an
xin the boxes that apply. You can also fill these out after creating the PR. If you're unsure about any of them, don't hesitate to ask. We're here to help! This is simply a reminder of what we are going to look for before merging your code.Further comments
If this is a relatively large or complex change, kick off the discussion by explaining why you chose the solution you did and what alternatives you considered, etc...