Skip to content

[Blazor] Auth improvements #20073

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed

Conversation

javiercn
Copy link
Member

#19966

Multiple fixes for small issues in the auth packages:

  • Fixes some issues with the startup APIs.
  • Fixes redirect to login on the template to avoid an infinite redirect loop if the user is already authenticated but not authorized.
  • Fixes missing escape data string on the return url for redirect to login.
  • Fixes an async initialization bug in the oidc-client.js implementation where calls could be made before the service was fully initialized.
  • Adds missing metadataUrl parameter to OidcProvider options. This allows dealing with non-compliant providers that host their metadata url in places other than <<authority>>/.well-known/openid-configuration
  • Updates the Msal cache options to match the defaults provided by MSAL and fixes a bug that prevented overriding them.
  • Fixes an issue where authorization didn't work if the app was hosted under a base path.
    • The fix was to re-order IdentityServer in the middleware pipeline as they have a special middleware that handles the base path.

@javiercn javiercn marked this pull request as ready for review March 23, 2020 15:00
@Pilchie Pilchie added the area-blazor Includes: Blazor, Razor Components label Mar 23, 2020
Copy link
Member

@captainsafia captainsafia left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Changes seem sensible to me based on the PR description.

/// <param name="services">The <see cref="IServiceCollection"/>.</param>
/// <param name="configure">The <see cref="Action{RemoteAuthenticationOptions{MsalProviderOptions}}"/> to configure the <see cref="RemoteAuthenticationOptions{MsalProviderOptions}"/>.</param>
/// <returns>The <see cref="IServiceCollection"/>.</returns>
public static IServiceCollection AddMsalAuthentication<TRemoteAuthenticationState>(this IServiceCollection services, Action<RemoteAuthenticationOptions<MsalProviderOptions>> configure)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It looks like the configure parameter isn't used. Am I missing something? Why don't we call it any more?

} catch (e) {
reject(e);
}
});
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Minor stylistic point but rather than manually creating a promise and having a try/catch, it could do:

this._initialized = (async () => {
    const userManager = await this.createUserManager(settings);
    AuthenticationService.instance = new OidcAuthorizeService(userManager);
})();

@@ -15,7 +15,14 @@
<Found Context="routeData">
<AuthorizeRouteView RouteData="@routeData" DefaultLayout="@typeof(MainLayout)">
<NotAuthorized>
<RedirectToLogin />
@if(!context.User.Identity.IsAuthenticated)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
@if(!context.User.Identity.IsAuthenticated)
@if (!context.User.Identity.IsAuthenticated)

@SteveSandersonMS
Copy link
Member

Is there any chance we're a bit short on test coverage with some of this? It's unusual to be able to fix a wide range of issues without impacting or adding any tests.

I'm particularly thinking about the DI parts here - there are a lot of different combinations of overloads. Do you think they would be amenable to unit testing, or can this only be seen at the E2E level?

@ghost ghost closed this Mar 25, 2020
This pull request was closed.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
area-blazor Includes: Blazor, Razor Components
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants