Call Graph on ticket received

[xperiandri]

I wanted to gather additional AAD user info and merge it into principal claims.
Because UserInfo endpoint is not being called (#1771) and I need some more info (#1772) decided to use Graph.

So I provided a delegate to events.OnTicketReceived property.
But as long as a user is not authenticated there yet, Graph authentication fails.
Moreover, it cannot find an authentication schema. As long as I override it to use Cookie as default.

.AddMicrosoftIdentityWebApp(
	options => configuration.GetSection("AzureAd").Bind(options),
	options =>
	{
		configuration.GetSection("AzureAd").Bind(options);
		if (!options.ResponseType.Split(' ').Contains("code"))
		{
			options.ResponseType = string.Join(' ', "code", options.ResponseType);
		}
		ExternalClaimsMappings.mapMicrosoftClaims(options.ClaimActions);
		var events = options.Events;
		//events.OnTokenResponseReceived = MicrosoftAuthenticationEventsHandler.OnTokenResponseReceived;
		//events.OnTicketReceived = MicrosoftAuthenticationEventsHandler.OnTicketReceived;
	},
	openIdConnectScheme: IdentityProviders.Microsoft,
	displayName: "Microsoft Account",
	cookieScheme: null)

So I provided a delegate to OnTokenResponseReceived property to do

[<CompiledName("OnTokenResponseReceived")>]
let onTokenResponseReceived (ctx : TokenResponseReceivedContext) = task {
    let provider =
        DelegateAuthenticationProvider(
            fun request ->
                request.Headers.Authorization <-
                    System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", ctx.ProtocolMessage.AccessToken)
                Task.CompletedTask)
    let graph = GraphServiceClient(provider)
    let principal = ctx.Principal |> MicrosoftPrincipal.op_Implicit
    let! userInfo = graph.GetUserInfoAsync (principal, CancellationToken.None)
    let identity = ctx.Principal.Identity :?> ClaimsIdentity
    identity.AddClaim (Claim(TdlClaims.Email, userInfo.Email))
    // TODO: Add other claims
}

but AccessToken is null because of #880 which I fixed in #1771

So my question is how to instruct Graph to take the token received before signing in completed in order to gather user info and merge it into claims?

[jmprieur]

@xperiandri : you can use the following sample as an example on how to call Graph from the OnTokenValidated event:

https://github.com/Azure-Samples/active-directory-aspnetcore-webapp-openidconnect-v2/blob/3918633c09c8f90275901939ad3844ab65a5ebb7/5-WebApp-AuthZ/5-2-Groups/Startup.cs#L51

cc: @kalyankrishna1 to help if needed.

[xperiandri]

@jmprieur this works great unless I add a new scope.
In that case on login, I get UiRequiredException even though the user has already given consent and logged in to AAD.
How to fix that?

[jmprieur]

UiRequiredException is expected, @xperiandri: this means the user needs to consent for more.
If you need more scopes at the beginning, you need to specify them in the EnableTokenAcquisitionToCallDownstreamWebApi()

[jmprieur]

@xperiandri : can you pre-authorize this scope (admin consent)?

[xperiandri]

1. So how can I use 2 different sets of scopes on login?

[xperiandri]

2. How to fix the issue with Blazor Server?

[xperiandri]

3. Why whole Microsoft.Identity.Web is tied to a scheme named OpenIdConnect? After I renamed my Azure AD scheme to this name I got a constant loop of ConsentHandler.HandleException(ex); -> /MicrosoftAccount/Identity/Challenge/ and back

[jmprieur]

@xperiandri : Microsoft.Identity.Web uses the default scheme, which is the scheme passed to the last AddAuthentication("scheme"). To use several schemes, use the overrides of AddMicrosoftIdentityWebApp that take the authentication scheme. and use the right authentication scheme to call Microsoft Graph.

See https://github.com/AzureAD/microsoft-identity-web/wiki/Multiple-Authentication-Schemes

[xperiandri]

This is my setup

services.ConfigureApplicationCookie(options =>
{
    options.LoginPath = "/Identity/Account/Login";
    options.LogoutPath = "/Identity/Account/LogOff";
});

// Configure Identity to use the same JWT claims as OpenIddict instead
// of the legacy WS-Federation claims it uses by default (ClaimTypes),
// which saves you from doing the mapping in your authorization controller.
services.Configure<IdentityOptions>(options =>
{
    options.ClaimsIdentity.UserIdClaimType = Claims.UserId;
    options.ClaimsIdentity.UserNameClaimType = Claims.Name;
    options.ClaimsIdentity.EmailClaimType = Claims.Email;
    options.ClaimsIdentity.RoleClaimType = Claims.Role;
});
services.AddTransient<IClaimsTransformation, TdlClaimsTransformation>();

services.Configure<MicrosoftIdentityOptions>(IdentityProviders.Microsoft, configuration.GetSection("AzureAd"));

services
// I need standard ASP.NET Identity
    .AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)
    .AddMicrosoftWorkOrSchool(configuration);

public static AuthenticationBuilder AddMicrosoftWorkOrSchool(this AuthenticationBuilder builder, IConfiguration configuration)
{
    var initialScopes = configuration["DownstreamApi:Scopes"]?.Split(' ') ?? configuration["MicrosoftGraph:Scopes"]?.Split(' ');

    builder
        .AddMicrosoftIdentityWebApp(
            options =>
            {
                configuration.GetSection("AzureAd").Bind(options);
// This is never called because you throw away the Access and call to UserInfo endpoint does not happen
                //ExternalClaimsMappings.mapMicrosoftClaims(options.ClaimActions);
            },
            openIdConnectScheme: IdentityProviders.Microsoft, // This is my scheme 'MicrosoftAccount'
            displayName: "Microsoft Account",
            cookieScheme: null)
        .EnableTokenAcquisitionToCallDownstreamApi(initialScopes)
        .AddMicrosoftGraph(configuration.GetSection("MicrosoftGraph"))
        .AddDownstreamWebApi("DownstreamApi", configuration.GetSection("DownstreamApi"))
        .AddInMemoryTokenCaches();

    return builder;
}

Could you tell me what is wrong with my setup?

[xperiandri]

How can I change login claims set on the fly?

builder
    .AddMicrosoftIdentityWebApp(
        options =>
        {
            var events = options.Events;
            events.OnRedirectToIdentityProvider = ctx =>
            {
                if (ctx.HttpContext.Request.RouteValues["area"] == TDL.Model.Common.Constants.Areas.Marketplace)
                {
                    var options = ctx.Options;
                    var scope = options.Scope;
// This manipulation does not work
                    scope.Remove("Team.ReadBasic.All");
                    scope.Add("Directory.Read.All");
                }
                return Task.CompletedTask;
            };
            events.OnTokenValidated = MicrosoftAuthenticationEventsHandler.OnTokenValidated;
        },
        openIdConnectScheme: IdentityProviders.Microsoft,
        displayName: "Microsoft Account",
        cookieScheme: null)

How can I achieve that?