[Bug] ScopeAuthorizationHandler only checks first scope claim

[agilenut]

Which version of Microsoft Identity Web are you using?
1.23.1

Where is the issue?

• Web API
  • [x ] Protected web APIs (validating tokens)

Is this a new or an existing app?
This is a new app or an experiment.

Context

Using Okta, scopes are separated into multiple claims. Imo, this is the correct representation once parsed and in the claims collection (not space delimited).

When the ScopeAuthorizationHandler runs, it only checks for the first claim. If the first claim is one of the claims listed in the RequiredScope attribute, then the request is authorized. If the first claim is not in the RequiredScope attribute, then it is not authorized.

Expected behavior
All scopes (in all scope claims) should be tested such that, if a scope in any of the claims is listed in the RequiredScope attribute, then the request is authorized; otherwise, it should not be authorized.

Actual behavior
Only the first claim is tested. So, the authorization becomes based on the claim order which is incorrect.

Possible solution
Replace this

with

          var scopeClaims = context.User.FindAll(ClaimConstants.Scp)
              .Union(context.User.FindAll(ClaimConstants.Scope))
              .ToList();

          if (!scopeClaims.Any()) {
              return Task.CompletedTask;
          }

          var hasScope = scopeClaims.SelectMany(s => s.Value.Split(' ')).Intersect(scopes).Any();

          if (hasScope) {
              context.Succeed(requirement);
              return Task.CompletedTask;
          }

[jennyf19]

Released in 1.24.0.