Quantcast
Channel: Security
Viewing all articles
Browse latest Browse all 4737

ASP.NET MVC 5 - Microsoft Account OAuth2 sign-on stop to work after update the Microsoft.Owin packages from v3.0.1 to v3.1.0

$
0
0

I have updated the following Nuget packages from v3.0.1 to v3.1.0:

  • Microsoft.Owin
  • Microsoft.Owin.Host.SystemWeb
  • Microsoft.Owin.Security
  • Microsoft.Owin.Security.Cookies
  • Microsoft.Owin.Security.Google
  • Microsoft.Owin.Security.MicrosoftAccount

And after these updates the following issue is displayed when I try to authenticate using a Microsoft Account:

Correlation ID: 1a411cc0-446c-42bb-8659-cdd7dd9e6199
AADSTS70011: The provided value for the input parameter 'scope' is not valid. The scope wl.emails is not valid.

Important notes:

  • This issue is only happening when I try to use a Microsoft Account for authenticating. There is no issue when I use a Google account for authenticating it
  • When I do the downgrade for the v3.0.1 the Microsoft Account authentication back to work again

Does anyone know if something has changed in Microsoft authentication on Microsoft.Owin.Security.MicrosoftAccount v3.1.0 that I have to change in my source code?

Here are the Startup.Auth.cs and AccountController.cs from the System:

Startup.Auth.cs

using Microsoft.Owin;
using Microsoft.Owin.Security;
using Microsoft.Owin.Security.Cookies;
using Microsoft.Owin.Security.Google;
using Microsoft.Owin.Security.MicrosoftAccount;
using Owin;

namespace IRIS
{
    public partial class Startup
    {
        private void ConfigureAuth(IAppBuilder app)
        {
            var cookieAuthenticationOptions = new CookieAuthenticationOptions { ExpireTimeSpan = System.TimeSpan.FromMinutes(120), LoginPath = new PathString("/Account/Login") };
            app.UseCookieAuthentication(cookieAuthenticationOptions);
            app.SetDefaultSignInAsAuthenticationType(cookieAuthenticationOptions.AuthenticationType);
            app.UseGoogleAuthentication(new GoogleOAuth2AuthenticationOptions { ClientId = "<MyGoogleClientId>", ClientSecret = "<MyGoogleClientSecret>" });
            app.UseMicrosoftAccountAuthentication(new MicrosoftAccountAuthenticationOptions { ClientId = "<MyMicrosoftClientId>", ClientSecret = "<MyClientSecret>", Scope = { "wl.emails" } });
        }
    }
}

AccountController.cs

using System.Web;
using System.Web.Mvc;

namespace IRIS.Controllers
{
    public class AccountController : Controller
    {
        [AllowAnonymous]
        [OutputCache(NoStore = true, Location = System.Web.UI.OutputCacheLocation.None)] //Evita o seguinte erro de login: http://stackoverflow.com/questions/24376800/the-back-button-and-the-anti-forgery-token
        public ActionResult Login(string returnUrl)
        {
            ViewBag.ReturnUrl = returnUrl;
            return View();
        }

        [HttpPost]
        [AllowAnonymous]
        [ValidateAntiForgeryToken]
        public ActionResult ExternalLogin(string provider, string returnUrl)
        {
            return new ChallengeResult(provider, Url.Action("ExternalLoginCallback", "Account", new { ReturnUrl = returnUrl }));
        }

        [AllowAnonymous]
        public ActionResult ExternalLoginCallback(string error, string returnUrl)
        {
            string[] outputParameters = new string[4];
            if (error != "access_denied")
            {
                Models.Data.DbException dbException = Models.Data.Firebird.ExecuteProcedure("I_ACCOUNT_LOGIN", new string[] { System.Security.Claims.ClaimsPrincipal.Current.FindFirst(System.Security.Claims.ClaimTypes.Email).Value }, outputParameters);
                if (dbException.ErrorCode == null)
                    if (outputParameters[0] == "0")
                    {
                        Models.Utils.Cookies.Account.Save(outputParameters[1], outputParameters[2], outputParameters[3], System.Security.Claims.ClaimsPrincipal.Current.FindFirst(System.Security.Claims.ClaimTypes.Email).Value);
                        Models.Utils.Cookies.App.Save((new string[12] { "skin-black", "skin-black-light", "skin-blue", "skin-blue-light", "skin-green", "skin-green-light", "skin-purple", "skin-purple-light", "skin-red", "skin-red-light", "skin-yellow", "skin-yellow-light", })[new System.Random().Next(0, 12)], (new string[3] { "", "fixed", "layout-boxed" })[new System.Random().Next(0, 3)], (new string[2] { "sidebar-open", "sidebar-collapse" })[new System.Random().Next(0, 2)], (new string[2] { "true", "false" })[new System.Random().Next(0, 2)]);
                    }
                    else
                    {
                        Models.Utils.Cookies.Account.Save(outputParameters[0], System.Security.Claims.ClaimsPrincipal.Current.FindFirst(System.Security.Claims.ClaimTypes.Email).Value);
                        Models.Utils.Cookies.App.Delete();
                    }
                else
                {
                    Models.Utils.Cookies.Account.Delete();
                    Models.Utils.Cookies.App.Save(dbException.ErrorCode.ToString(), dbException.Message);
                }
            }
            return outputParameters[0] != null && outputParameters[0] == "0" ? RedirectToLocal(returnUrl) : RedirectToAction("Logout", "Account", new { ReturnUrl = returnUrl });
        }

        [AllowAnonymous]
        public ActionResult Logout(string returnUrl)
        {
            HttpContext.GetOwinContext().Authentication.SignOut();
            return returnUrl == null ? RedirectToAction("Index", "Home") : RedirectToLocal(returnUrl);
        }

        #region Helpers
        private ActionResult RedirectToLocal(string returnUrl)
        {
            if (Url.IsLocalUrl(returnUrl))
            {
                return Redirect(returnUrl);
            }
            return RedirectToAction("Index", "Home");
        }

        internal class ChallengeResult : HttpUnauthorizedResult
        {
            public ChallengeResult(string provider, string redirectUri)
            {
                LoginProvider = provider;
                RedirectUri = redirectUri;
            }

            public string LoginProvider { get; set; }
            public string RedirectUri { get; set; }

            public override void ExecuteResult(ControllerContext context)
            {
                var properties = new Microsoft.Owin.Security.AuthenticationProperties { RedirectUri = RedirectUri };
                context.HttpContext.GetOwinContext().Authentication.Challenge(properties, LoginProvider);
            }
        }
        #endregion
    }
}




Viewing all articles
Browse latest Browse all 4737

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>