Owin Identity Construction crash if "preferred_username" claim is not present

[guillaumejay]

Microsoft.Identity.Web Library

Microsoft.Identity.Web

Microsoft.Identity.Web version

2.11.1

Web app

Sign-in users

Web API

Protected web APIs (validating tokens)

Token cache serialization

In-memory caches

Description

Current Owin code looks for a very specific claims preferred_username and crash if not present

Reproduction steps

Use Owin ( test/devapps/asp.net MVC/OwinWebApp application ) on Azure AD B2C without this claims.

Error message

System.NullReferenceException

Id Web logs

No response

Relevant code snippets

This is the problematic webcode :
 string name = context.AuthenticationTicket.Identity.FindFirst("preferred_username").Value;
Microsoft.identy.web.Owin/AppBuilderExtension.Cs
https://github.com/AzureAD/microsoft-identity-web/blob/master/src/Microsoft.Identity.Web.OWIN/AppBuilderExtension.cs#L180

Regression

No response

Expected behavior

Read the the claim name from the ClaimNameType name ?

[guillaumejay]

This can be fixed in an application by using the UpdateOptions parameters of AddMicrosoftIdentityWebApp and replace Notifications.SecurityTokenValidated.

It's a bit tedious because you have to copy the UniqueTenantIdentifier and UniqueObectIdentifier claims filling from the original source code, and it uses internals classes, but it can be done.

[jmprieur]

Thanks @guillaumejay for updating this issue
would you like to share the solution you've found?

[guillaumejay]

I forked this repo and was able to modify OwinWebApp so it works ( https://github.com/guillaumejay/microsoft-identity-web/tree/master/tests/DevApps/aspnet-mvc/OwinWebApp )
More specifically, the fix is here : https://github.com/guillaumejay/microsoft-identity-web/blob/feaf65eb529032e43483afcf61464e0532c2f723/tests/DevApps/aspnet-mvc/OwinWebApp/App_Start/Startup.Auth.cs#L63

It's working with new MVC project, it's not working on WebForms project
On my current project, or new projects from scratch
HttpContextBase httpContext = context.OwinContext.Get(typeof(HttpContextBase).FullName);
httpContext.Session is always null

I also discovered this : #2312 (comment) which is quite scary for my use case

[jennyf19]

https://github.com/AzureAD/microsoft-identity-web/releases/tag/2.13.4