Skip to content

Commit 312229f

Browse files
GladwinJohnsonGladwinJohnson
committed
e2e test and CreateSha256HashHex
1 parent a51ffab commit 312229f

File tree

5 files changed

+74
-12
lines changed

5 files changed

+74
-12
lines changed

‎src/client/Microsoft.Identity.Client/ApiConfig/Parameters/AcquireTokenForManagedIdentityParameters.cs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ internal class AcquireTokenForManagedIdentityParameters : IAcquireTokenParameter
1818

1919
public string Claims { get; set; }
2020

21-
public string BadTokenHash { get; set; }
21+
public string RevokedTokenHash { get; set; }
2222

2323
public void LogParameters(ILoggerAdapter logger)
2424
{

‎src/client/Microsoft.Identity.Client/Internal/Requests/ManagedIdentityAuthRequest.cs‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -62,8 +62,8 @@ protected override async Task<AuthenticationResult> ExecuteAsync(CancellationTok
6262
// If there is a cached token, compute its hash for the “bad token” scenario
6363
if (cachedAccessTokenItem != null)
6464
{
65-
string cachedTokenHash = _cryptoManager.CreateSha256Hash(cachedAccessTokenItem.Secret);
66-
_managedIdentityParameters.BadTokenHash = cachedTokenHash;
65+
string cachedTokenHash = _cryptoManager.CreateSha256HashHex(cachedAccessTokenItem.Secret);
66+
_managedIdentityParameters.RevokedTokenHash = cachedTokenHash;
6767

6868
logger.Info("[ManagedIdentityRequest] Claims are present. Computed hash of the cached (bad) token. " +
6969
"Will now request a fresh token from the MI endpoint.");

‎src/client/Microsoft.Identity.Client/ManagedIdentity/AbstractManagedIdentity.cs‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -319,9 +319,9 @@ protected virtual void ApplyClaimsAndCapabilities(
319319

320320
// Only include 'token_sha256_to_refresh' if we have both Claims and the old token's hash
321321
if (!string.IsNullOrEmpty(parameters.Claims) &&
322-
!string.IsNullOrEmpty(parameters.BadTokenHash))
322+
!string.IsNullOrEmpty(parameters.RevokedTokenHash))
323323
{
324-
SetRequestParameter(request, "token_sha256_to_refresh", parameters.BadTokenHash);
324+
SetRequestParameter(request, "token_sha256_to_refresh", parameters.RevokedTokenHash);
325325
_requestContext.Logger.Info(
326326
"[Managed Identity] Passing SHA-256 of the 'bad' token to Managed Identity endpoint."
327327
);

‎tests/Microsoft.Identity.Test.Common/Core/Mocks/MockHttpManagerExtensions.cs‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -473,7 +473,7 @@ private static MockHttpMessageHandler BuildMockHandlerForManagedIdentitySource(
473473
}
474474

475475
var manager = new CommonCryptographyManager();
476-
var value = manager.CreateSha256Hash(TestConstants.ATSecret);
476+
var value = manager.CreateSha256HashHex(TestConstants.ATSecret);
477477

478478
// If capabilityEnabled, add "xms_cc": "cp1"
479479
if (capabilityEnabled)
@@ -494,12 +494,12 @@ private static MockHttpMessageHandler BuildMockHandlerForManagedIdentitySource(
494494
if (managedIdentitySourceType == ManagedIdentitySource.AppService
495495
|| managedIdentitySourceType == ManagedIdentitySource.ServiceFabric)
496496
{
497-
expectedQueryParams.Add("token_sha256_to_refresh", manager.CreateSha256Hash(TestConstants.ATSecret));
497+
expectedQueryParams.Add("token_sha256_to_refresh", manager.CreateSha256HashHex(TestConstants.ATSecret));
498498
}
499499
}
500500
else
501501
{
502-
notExpectedQueryParams.Add("token_sha256_to_refresh", manager.CreateSha256Hash(TestConstants.ATSecret));
502+
notExpectedQueryParams.Add("token_sha256_to_refresh", manager.CreateSha256HashHex(TestConstants.ATSecret));
503503
}
504504

505505
if (managedIdentitySourceType != ManagedIdentitySource.CloudShell)

‎tests/Microsoft.Identity.Test.Integration.netcore/HeadlessTests/ManagedIdentityTests.NetFwk.cs‎

Lines changed: 66 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,7 @@ public class ManagedIdentityTests
6060
//non existent Resource ID of the User Assigned Identity
6161
private const string Non_Existent_UamiResourceId = "/subscriptions/userAssignedIdentities/NO_ID";
6262

63-
//[DataTestMethod]
63+
[DataTestMethod]
6464
[DataRow(MsiAzureResource.WebApp, "", DisplayName = "System_Identity_Web_App")]
6565
//[DataRow(MsiAzureResource.Function, "", DisplayName = "System_Identity_Function_App")]
6666
//[DataRow(MsiAzureResource.VM, "", DisplayName = "System_Identity_Virtual_Machine")]
@@ -128,7 +128,69 @@ public async Task AcquireMSITokenAsync(MsiAzureResource azureResource, string us
128128
}
129129
}
130130

131-
//[TestMethod]
131+
[DataTestMethod]
132+
[DataRow(MsiAzureResource.WebApp, "", DisplayName = "System_Identity_Web_App")]
133+
[DataRow(MsiAzureResource.WebApp, UserAssignedClientID, UserAssignedIdentityId.ClientId, DisplayName = "ClientId_Web_App")]
134+
[DataRow(MsiAzureResource.WebApp, UamiResourceId, UserAssignedIdentityId.ResourceId, DisplayName = "ResourceID_Web_App")]
135+
[DataRow(MsiAzureResource.WebApp, UserAssignedObjectID, UserAssignedIdentityId.ObjectId, DisplayName = "ObjectID_Web_App")]
136+
public async Task AcquireMSITokenWithClaimsAsync(
137+
MsiAzureResource azureResource,
138+
string userIdentity,
139+
UserAssignedIdentityId userAssignedIdentityId = UserAssignedIdentityId.None)
140+
{
141+
using (new EnvVariableContext())
142+
{
143+
// ---------- Arrange ----------
144+
var envVariables = await GetEnvironmentVariablesAsync(azureResource).ConfigureAwait(false);
145+
SetEnvironmentVariables(envVariables);
146+
147+
string uri = s_baseURL + $"MSIToken?azureresource={azureResource}&uri=";
148+
149+
IManagedIdentityApplication mia =
150+
CreateMIAWithProxy(uri, userIdentity, userAssignedIdentityId);
151+
152+
// ---------- Act & Assert 1 ----------
153+
AuthenticationResult result1 = await mia
154+
.AcquireTokenForManagedIdentity(s_msi_scopes)
155+
.ExecuteAsync()
156+
.ConfigureAwait(false);
157+
158+
Assert.AreEqual("Bearer", result1.TokenType);
159+
Assert.AreEqual(TokenSource.IdentityProvider,
160+
result1.AuthenticationResultMetadata.TokenSource);
161+
CoreAssert.IsWithinRange(
162+
DateTimeOffset.UtcNow,
163+
result1.ExpiresOn,
164+
TimeSpan.FromHours(24));
165+
166+
// ---------- Act & Assert 2 (cache hit) ----------
167+
AuthenticationResult result2 = await mia
168+
.AcquireTokenForManagedIdentity(s_msi_scopes)
169+
.ExecuteAsync()
170+
.ConfigureAwait(false);
171+
172+
Assert.IsTrue(result2.Scopes.All(s_msi_scopes.Contains));
173+
Assert.AreEqual(TokenSource.Cache,
174+
result2.AuthenticationResultMetadata.TokenSource);
175+
Assert.AreEqual(result1.AccessToken, result2.AccessToken, // sanity
176+
"Second call should come from cache");
177+
178+
// ---------- Act & Assert 3 (claims → bypass_cache) ----------
179+
const string claimsJson = TestConstants.Claims;
180+
181+
AuthenticationResult result3 = await mia
182+
.AcquireTokenForManagedIdentity(s_msi_scopes)
183+
.WithClaims(claimsJson)
184+
.ExecuteAsync()
185+
.ConfigureAwait(false);
186+
187+
// Token source should now be IdentityProvider again
188+
Assert.AreEqual(TokenSource.IdentityProvider,
189+
result3.AuthenticationResultMetadata.TokenSource);
190+
}
191+
}
192+
193+
[TestMethod]
132194
public async Task AcquireMsiToken_ForTokenExchangeResource_Successfully()
133195
{
134196
string resource = "api://AzureAdTokenExchange";
@@ -183,7 +245,7 @@ public async Task AcquireMsiToken_ForTokenExchangeResource_Successfully()
183245
}
184246
}
185247

186-
//[TestMethod]
248+
[TestMethod]
187249
public async Task AcquireMsiToken_ExchangeForEstsToken_Successfully()
188250
{
189251
const string resource = "api://AzureAdTokenExchange";
@@ -449,7 +511,7 @@ private IManagedIdentityApplication CreateMIAWithProxy(string url, string userAs
449511
// Disabling shared cache options to avoid cross test pollution.
450512
builder.Config.AccessorOptions = null;
451513

452-
IManagedIdentityApplication mia = builder
514+
IManagedIdentityApplication mia = builder.WithClientCapabilities(new[] { "cp1" })
453515
.WithHttpManager(proxyHttpManager).Build();
454516

455517
return mia;

0 commit comments

Comments
 (0)