Add message handlers for downstream api auth

[qetza]

Authentication message handlers to inject authorization header using token acquisition.

[ghost]

All CLA requirements met.

[qetza]

This is for the feature request #1131

[jmprieur]

Thanks @qetza
This looks good to me.

How would you use the message handler?
Would you have a sample app? unit tests?

Thanks!

[qetza]

Hi @jmprieur,
I will add some unit tests and copy an existing downstream webapi sample and rewrite it with using the message handler instead of the DownstreamWebApi

[qetza]

Hi @jmprieur,
I've refactor the code to have base options class between downstream and delegating handlers, fix the issue with existing header and added some unit tests.
For the sample part as they are in another repo i'll do a PR there later.

[jmprieur]

Thanks @qetza

[qetza]

I've rebased the code on the lastest version of master to resolve merge conflict.

[jmprieur]

Sorry @qetza : I missed that you had added tests.
We'll review. thanks for the head-up.

[jennyf19]

add

nit: adds

[jennyf19]

[jennyf19]

thanks @qetza i, too, missed the updates here. Could you resolve the merge conflict and then we will merge it? thanks so much.

[qetza]

@jennyf19, i've rebased the branch and fixed the merge conflict (on Microsoft.Identity.Web.xml as usual)

[NWessel]

@qetza Could you provide a link to a repo where you use it?
I really want to try it out right now :)

[qetza]

Hi @NWessel,
I've submitted a pull request on the sample repo with an example of using the MicrosoftIdentityUserAuthenticationMessageHandler class.

You can see the code here:
https://github.com/qetza/active-directory-aspnetcore-webapp-openidconnect-v2/blob/142a315a36293e25ba5e4fd42640a1a624519d13/3-WebApp-multi-APIs/Startup.cs#L49

[NWessel]

Just checked it out, looks like what i would expect it to be ^^
Probably could make the scope optional as well, and take the base url of the request and add /.default

So baseUrl + "/.default"
If no scope is provided.

What is the service name for ? I'm not sure I quite understand the usecase :)

[qetza]

You can always create your own extension method without a scope and do the magic in there 😄

The service name is used internally to link and retrieve the options if you have multiple clients which needs different options.