Adding policies not functioning

[gerb0n]

I am trying to add a policy to have a certain scope required.

Normally you can add a policy like such inside the AddOpenIDConnect() extension:

config.AddPolicy("mypolicy", x => x.RequireAssertion(context =>
            {
               //debugger never reaches here
               //pseudocode: determine if certain scope is present
                return true;
            }));

The policy is added and is throwing UnauthorizedAccessException. But it is working incorrectly and I am not able to debug it because the code inside the RequireAssertion is never triggered. So my conclusion was that adding a policy does 'something' but it's not actually looking inside the policy to execute the correct implementation.

[gerb0n]

I am still not sure why it doesn't work but I ended up creating a IAuthorizationRequirement and registrated that with a handler.

public class ScopeRequirementHandler : AuthorizationHandler<ScopeRequirement>
{
    private static readonly IEnumerable<string> _scopeClaimTypes = new HashSet<string>(StringComparer.OrdinalIgnoreCase) {
        "http://schemas.microsoft.com/identity/claims/scope",
        "scope"
    };

    protected override Task HandleRequirementAsync(
        AuthorizationHandlerContext context, ScopeRequirement requirement)
    {
        var claim = context.User.Claims.First(c => _scopeClaimTypes.Contains(c.Type));
        if (claim == null)
        {
            context.Fail();
        }
        else
        {
            var scopeExists = claim.Value.Split(' ').Any(s =>
                requirement.OptionalScopes.Contains(s, StringComparer.Ordinal));

            if (scopeExists)
            {
                context.Succeed(requirement);
            }
        }

        return Task.CompletedTask;
    }
}

public class ScopeRequirement : IAuthorizationRequirement
{
    public IEnumerable<string> OptionalScopes { get; set; }

    public ScopeRequirement(params string[] optionalScopes) =>
        OptionalScopes = optionalScopes;
}

Register the handler inside the startup:

builder.Services.AddSingleton<IAuthorizationHandler, ScopeRequirementHandler>();

And inside the AddOpenIDConnect configuration the following:

configure.Requirements.Add(new ScopeRequirement(Auth0Scopes.Scope_UserManagement_RetrieveProfileFunction));

This did the job for me.

[cajuncoding]

This seemed to work exactly as expected in v0.71 Snowdrop, but was broken in the following release and ever since....