Comments (5)
Hi @rmwesley - thank you for that very much detailed description.
The issue is clear and for some reason missed that before.
I made the change and will publish it upon the next version 🙏
from fastapi_msal.
De nada @rmwesley
As this issue is now marked as closed I propose to open few new ones.
It seems to me like you are referring to different topics so can you make sure each has its own topic?
Will help me to better answer them.
The first is about the MSAL JWT token, I will look into that once I can better understand the issue / concern.
The second is about updating the documentations which are long past due... probably my next challenge here 😅
The third is about the RBAC which while the PR is simple I'm not sure if that the correct implementation to handle that issue.
We can discuss and I'll elaborate more on that ticket if this is making more sense.
Obrigado 🙏
from fastapi_msal.
Here's an open discussion on FastAPI that may be related to this subject:
tiangolo/fastapi#10615
This discussion is related to a 500 upon trying to authenticate, which is not the same issue as here.
In this case (trying to authenticate) we should get a 400 for invalid credentials (Bad request). Should I open another issue here for this Swagger UI bug?
In our case we should get a 401, since we are not trying to authenticate, we are trying to use the API with an invalid Bearer Token.
from fastapi_msal.
Awesome! Thanks a lot for the reactivity!
I still wanted to comment on the OIDC code for OpendID Connect grant flow.
Apparently, all handling of issued id_tokens
on Python MSAL's repo is done under oauth2cli/oidc.py. Correct me if I'm wrong and part of the grant flow is done somewhere else, it is not clear to me.
Most of the raised runtime errors I mentioned above are related to the decoding of the id_token
JWT in the middle of the OIDC grant flow.
It may seem unrelated, but I stumbled upon this issue that is still open here.
As ejsyx said regarding JWT decoding, MSAL does not use PyJWT's decode function for decoding JWTs, only for encoding them. This is based on what rayluo commented on this PyJWT decoding issue.
So MSAL decodes the id_token
JWT with their own custom-made decode_id_token()
function in oauth2cli/oidc.py, right?
This function only decodes the middle part of the id_token
, since under oauth2cli/oidc.py
MSAL uses a custom decode_part(id_token.split('.')[1])
function, and thus it completely ignores the signature validation, as I mentioned in my original post.
But besides that, OIDC grant flow, that issues an id_token
, should not be used for authentication. For auth, an auth code flow is supposed to be done, that ends up issuing an access_token
as a grant.
fbelhadi mentioned this issue on this PR arguing Access tokens should be used instead of ID tokens in fastapi_msal (there he mentions the Microsoft Identity Platform docs I keep referring to in my posts haha).
Still, this pull request only mentions RBAC. So the concerns raised by ejsyx will be ignored, right? I mean, if you switch the grant flow and end up with an access_token
instead the signature validation issue of id_tokens
will become obsolete, right? Or am I just making a crazy soup of unrelated issues?
from fastapi_msal.
Tranquilo kkkk
I was just noting down some things I was analysing, I completely rewrote this message at the very least five times to try and make it make sense, I will keep rewriting it for a while haha.
Also, the "MIP" docs I mentioned are those of Microsoft Identity platform I keep referring to: Access tokens and ID tokens.
from fastapi_msal.
Related Issues (20)
- Document how to get a token for accessing the API via curl HOT 4
- How to get group claims? HOT 5
- Dependency overrides in unit testing HOT 1
- Expired token return Internal Server Error HOT 1
- Exception in ASGI Application When Running Sample from README HOT 17
- Wrong redirect URL when using README usage example HOT 2
- Question: Any way to hide the /docs that is compatible with fastapi_msal? HOT 7
- redirect_uri str type expected (type=type_error.str) HOT 2
- Migration to pydantic v2 (and pydantic-settings) HOT 1
- Question: How to access API outside of swagger page HOT 10
- Route to token_path is http when I need httpS per Azure application configuration HOT 2
- Cannot use B2C logins HOT 1
- Authority URL is now always returns as a b2c url. HOT 3
- Missing "groups" property on IDTokenClaim HOT 6
- Is python 3.7 / 3.8 supported? HOT 1
- Question: How to bypass MSAL authentication for unit testing? HOT 4
- Question: Cannot install fastapi_msal on Windows HOT 4
- How do I get past this stage to get the access token? HOT 2
- Logout with fastapi_msal HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from fastapi_msal.