[Bug] Change RequiredScope to be based on policies

[plamber]

Which version of Microsoft Identity Web are you using?
1.6.0

Where is the issue?

• Web API
  • Protected web APIs (validating tokens)
  • Protected web APIs (validating scopes)
  • Protected web APIs call downstream web APIs

Repro
In your sample Function app application you are using the "RequiredScope" attribute to limit the access to the Function app. This does not work in this context codesnippet

To my understanding this is due to the different way Azure Functions follow the authorization life-cycle.

You can limit the access by using the deprecated "VerifyUserHasAnyAcceptedScope(ScopesRequired);"
Here an example on how to limit the required scope.

[FunctionName("token")]
[RequiredScope("Does not work")]
public async Task<IActionResult> Run(
    [HttpTrigger(AuthorizationLevel.Anonymous, "post", Route = null)] HttpRequest req)
{
    var (authenticationStatus, authenticationResponse) =
        await req.HttpContext.AuthenticateAzureFunctionAsync();

    await req.HttpContext.AuthenticateAzureFunctionAsync();
    if (!authenticationStatus) return authenticationResponse;

    // this works
    req.HttpContext.VerifyUserHasAnyAcceptedScope(ScopesRequired);

    string requestBody = await new StreamReader(req.Body).ReadToEndAsync();

    return new OkObjectResult(requestBody);
}

Expected behavior

• Required scope should work with Azure Functions

Actual behavior
RequiredScope is ignored. The only way is to use VerifyUserHasAnyAcceptedScope

Possible solution
Most likely you have to create a dedicated class for the Azure Functions. You can find an example how to implement this here. The challenge is that this feature is in preview a while.

Alternatively, provide a dedicated VerifyUserHasAnyAcceptedScope function intended for Azure Functions.

[jmprieur]

Thanks for the heads-up @plamber

[jennyf19]

@plamber we are removing the deprecated flag from the method VerifyUserHasAnyAcceptedScope, so that will be in our 1.7 release. thanks.

will take a look at the links you provided.

[jennyf19]

Included in 1.18.0 release