Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add Scopes validation for ClientCredentials authentication #10

Closed
wants to merge 1 commit into from
Closed

Add Scopes validation for ClientCredentials authentication #10

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 7 additions & 7 deletions src/Microsoft.Agents.SDK.sln
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -338,11 +338,7 @@ Global
{BC5EFA6C-7EB5-4803-B7C5-093892E9DBB8}.Debug|Any CPU.Build.0 = Debug|Any CPU
{BC5EFA6C-7EB5-4803-B7C5-093892E9DBB8}.Release|Any CPU.ActiveCfg = Release|Any CPU
{BC5EFA6C-7EB5-4803-B7C5-093892E9DBB8}.Release|Any CPU.Build.0 = Release|Any CPU
{B9AD64EF-EA22-4CAC-B89B-03CEE46CFF4F}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
{B9AD64EF-EA22-4CAC-B89B-03CEE46CFF4F}.Debug|Any CPU.Build.0 = Debug|Any CPU
{B9AD64EF-EA22-4CAC-B89B-03CEE46CFF4F}.Release|Any CPU.ActiveCfg = Release|Any CPU
{B9AD64EF-EA22-4CAC-B89B-03CEE46CFF4F}.Release|Any CPU.Build.0 = Release|Any CPU
{BF587311-1240-889C-E6AE-ED61A6ED2B37}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
{BF587311-1240-889C-E6AE-ED61A6ED2B37}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
{BF587311-1240-889C-E6AE-ED61A6ED2B37}.Debug|Any CPU.Build.0 = Debug|Any CPU
{BF587311-1240-889C-E6AE-ED61A6ED2B37}.Release|Any CPU.ActiveCfg = Release|Any CPU
{BF587311-1240-889C-E6AE-ED61A6ED2B37}.Release|Any CPU.Build.0 = Release|Any CPU
Expand All @@ -354,6 +350,10 @@ Global
{153EA430-9914-18E7-409F-7292CB1914AB}.Debug|Any CPU.Build.0 = Debug|Any CPU
{153EA430-9914-18E7-409F-7292CB1914AB}.Release|Any CPU.ActiveCfg = Release|Any CPU
{153EA430-9914-18E7-409F-7292CB1914AB}.Release|Any CPU.Build.0 = Release|Any CPU
{B9AD64EF-EA22-4CAC-B89B-03CEE46CFF4F}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
{B9AD64EF-EA22-4CAC-B89B-03CEE46CFF4F}.Debug|Any CPU.Build.0 = Debug|Any CPU
{B9AD64EF-EA22-4CAC-B89B-03CEE46CFF4F}.Release|Any CPU.ActiveCfg = Release|Any CPU
{B9AD64EF-EA22-4CAC-B89B-03CEE46CFF4F}.Release|Any CPU.Build.0 = Release|Any CPU
EndGlobalSection
GlobalSection(SolutionProperties) = preSolution
HideSolutionNode = FALSE
Expand Down Expand Up @@ -417,10 +417,10 @@ Global
{7D1A1CE5-6D9B-4D31-AC77-C3B1787F575D} = {AD743B78-D61F-4FBF-B620-FA83CE599A50}
{06E490F7-F0BB-E3C4-54FE-5210627292A1} = {183D0E91-B84E-46D7-B653-6D85B4CCF804}
{BC5EFA6C-7EB5-4803-B7C5-093892E9DBB8} = {183D0E91-B84E-46D7-B653-6D85B4CCF804}
{B9AD64EF-EA22-4CAC-B89B-03CEE46CFF4F} = {AD743B78-D61F-4FBF-B620-FA83CE599A50}
{BF587311-1240-889C-E6AE-ED61A6ED2B37} = {183D0E91-B84E-46D7-B653-6D85B4CCF804}
{BF587311-1240-889C-E6AE-ED61A6ED2B37} = {183D0E91-B84E-46D7-B653-6D85B4CCF804}
{697C1093-D392-8ABC-2BC8-F955022B1853} = {183D0E91-B84E-46D7-B653-6D85B4CCF804}
{153EA430-9914-18E7-409F-7292CB1914AB} = {183D0E91-B84E-46D7-B653-6D85B4CCF804}
{B9AD64EF-EA22-4CAC-B89B-03CEE46CFF4F} = {AD743B78-D61F-4FBF-B620-FA83CE599A50}
EndGlobalSection
GlobalSection(ExtensibilityGlobals) = postSolution
SolutionGuid = {F1E8E538-309A-46F8-9CE7-AEC6589FAE60}
Expand Down
21 changes: 15 additions & 6 deletions src/libraries/Authentication/Authentication.Msal/MsalAuth.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -93,6 +93,10 @@ public async Task<string> GetAccessTokenAsync(string resourceUrl, IList<string>
ExecuteAuthenticationResults authResultPayload = null;
if (msalAuthClient is IConfidentialClientApplication msalConfidentialClient)
{
if (localScopes.Length == 0) {
throw new ArgumentException("At least one Scope is required for Client Authentication.");
}

var authResult = await msalConfidentialClient.AcquireTokenForClient(localScopes).WithForceRefresh(true).ExecuteAsync().ConfigureAwait(false);
authResultPayload = new ExecuteAuthenticationResults()
{
Expand Down Expand Up @@ -204,21 +208,26 @@ private object CreateClientApplication()
private string[] ResolveScopesList(Uri instanceUrl, IList<string> scopes = null)
{
IList<string> _localScopesResolver = new List<string>();

if (scopes != null && scopes.Count > 0)
{
return scopes.ToArray();
}
else
{
List<string> templist = new List<string>();
foreach (var scope in _connectionSettings.Scopes)
var templist = new List<string>();

if (_connectionSettings.Scopes != null)
{
var scopePlaceholder = scope;
if (scopePlaceholder.ToLower().Contains("{instance}"))
foreach (var scope in _connectionSettings.Scopes)
{
scopePlaceholder = scopePlaceholder.Replace("{instance}", $"{instanceUrl.Scheme}://{instanceUrl.Host}");
var scopePlaceholder = scope;
if (scopePlaceholder.ToLower().Contains("{instance}"))
{
scopePlaceholder = scopePlaceholder.Replace("{instance}", $"{instanceUrl.Scheme}://{instanceUrl.Host}");
}
templist.Add(scopePlaceholder);
}
templist.Add(scopePlaceholder);
}
return templist.ToArray();
}
Expand Down
31 changes: 29 additions & 2 deletions src/tests/Microsoft.Agents.Authentication.Msal.Tests/MsalAuthTests.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,9 +64,36 @@ public void Constructor_ShouldThrowOnNullConfiguration()
[Fact]
public async Task GetAccessTokenAsync_ShouldThrowOnMalformedUri()
{
var msal = new MsalAuth(_service.Object, _configuration.GetSection(SettingsSection));
var msalAuth = new MsalAuth(_service.Object, _configuration.GetSection(SettingsSection));

await Assert.ThrowsAsync<ArgumentException>(() => msalAuth.GetAccessTokenAsync(null, _scopes, false));
}

[Fact]
public async Task GetAccessTokenAsync_ShouldThrowOnNullScopesForClientCredentials()
{
var options = new Mock<IOptions<MsalAuthConfigurationOptions>>();

var returnedOptions = new MsalAuthConfigurationOptions
{
MSALEnabledLogPII = false
};
options.Setup(x => x.Value).Returns(returnedOptions).Verifiable(Times.Exactly(2));

await Assert.ThrowsAsync<ArgumentException>(() => msal.GetAccessTokenAsync(null, _scopes, false));
var logger = new Mock<ILogger<MsalAuth>>();

var service = new Mock<IServiceProvider>();
service.Setup(x => x.GetService(typeof(IOptions<MsalAuthConfigurationOptions>)))
.Returns(options.Object)
.Verifiable(Times.Exactly(2));
service.Setup(x => x.GetService(typeof(ILogger<MsalAuth>)))
.Returns(logger.Object)
.Verifiable(Times.Once);

var msalAuth = new MsalAuth(service.Object, _configuration.GetSection(SettingsSection));

await Assert.ThrowsAsync<ArgumentException>(() => msalAuth.GetAccessTokenAsync(ResourceUrl, null, false));
Mock.Verify(options, service);
}

[Fact]
Expand Down
Loading