[Feature Request] Encryption strategy for Distributed token cache

[jmprieur]

Is your feature request related to a problem? Please describe.
Today the distributed token cache does not encrypt the blob for caches.

Describe the solution you'd like
Provide an optional way to enable apps developer to provide/choose an encryption strategy

[jmprieur]

One possibility: https://docs.microsoft.com/en-us/aspnet/core/security/data-protection/introduction

Configuration: https://docs.microsoft.com/en-us/aspnet/core/security/data-protection/configuration/overview?view=aspnetcore-5.0

for instance:

   // In startup.cs / or when adding cache
   services.AddDataProtection() 
      .PersistKeysToAzureBlobStorage(dataProtectionConnectionString, dataProtectionContainerName, dataProtectionKeyFile)                
      .ProtectKeysWithAzureKeyVault(new Uri(dataProtectionKeyKeyUri), cred)                
      .SetApplicationName(AuthenticationConstants.ApplicationName);

    // In the controller etc ...
    var dataProtectionProvider = serviceProvider.GetService<IDataProtectionProvider>

[jmprieur]

Proposed experience.

ASP.NET Core

ASP.NET Core developers who want to benefit from cache encryption will add a few lines in their startup.cs:

  services.AddAuthentication(OpenIdConnectDefaults.AuthenticationScheme)
               .AddMicrosoftIdentityWebApp(Configuration.GetSection("AzureAd"))
                 .EnableTokenAcquisitionToCallDownstreamApi()
                   .AddMicrosoftGraph(Configuration.GetSection("GraphBeta"))
                   .AddDownstreamWebApi("GraphBeta", Configuration.GetSection("GraphBeta"))
                   .AddDistributedTokenCache();

  services.AddDistributedMemoryCache();
  services.Configure<MsalDistributedTokenCacheAdapterOptions>(o =>
  {
   o.Encrypt = true;
  });
 });

It's also possible to control the data protector:

   services.AddDataProtection() 
      .PersistKeysToAzureBlobStorage(
          dataProtectionConnectionString, 
          dataProtectionContainerName, 
          dataProtectionKeyFile)            
      .ProtectKeysWithAzureKeyVault(new Uri(dataProtectionKeyKeyUri), cred)                
      .SetApplicationName(AuthenticationConstants.ApplicationName);

ASP.NET classic or .NET or .NET Core

 clientapp = ConfidentialClientApplicationBuilder.Create(AuthenticationConfig.ClientId)
                      .WithClientSecret(AuthenticationConfig.ClientSecret)
                      .WithRedirectUri(AuthenticationConfig.RedirectUri)
                      .WithAuthority(new Uri(AuthenticationConfig.Authority))
                      .Build();

 clientapp.AddDistributedTokenCache(services =>
 {
   services.AddDistributedMemoryCache();
   services.Configure<MsalDistributedTokenCacheAdapterOptions>(o =>
   {
     o.Encrypt = true;
   });
 });

Proposed design:

• Inject IServiceProvider in the MsalAbstractTokenCacheProvider constructor. Have a null default value to avoid a breaking change in existing token caches deriving from MsalAbstractTokenCacheProvider and not provided by us

• Add a member dataProtectionProvider of type IDataProtectionProvider computed from the service provider argument when it's not null

• Before writing, if dataProtectionProvider is not null, encrypt the cache

  microsoft-identity-web/src/Microsoft.Identity.Web/TokenCacheProviders/MsalAbstractTokenCacheProvider.cs

  Line 59 in cc51881

  await WriteCacheBytesAsync(args.SuggestedCacheKey, args.TokenCache.SerializeMsalV3(), cacheSerializerHints).ConfigureAwait(false);

• After reading, if dataProtectionProvider is not null, decrypt the cache.

• Inject a IServiceProvider in the constructor of all the classes derived from MsalAbstractTokenCacheProvider, and that would call the new constructor of MsalAbstractTokenCacheProvider.

Questions

• do we want to use IDataProtectionProvider or our own interface? (and in which case do we provide a default implementation that uses the IDataProtectionProvider ?

[jennyf19]

Included in 1.15 release