Azure ?appid= form of the shared-alias keys URL isn't recognized
Maintainers usually reply within 1 day
Assessment
This issue has not been assessed yet.
Description
Follow-up from #271's final review (thread on src/lib/azureIssuer.ts:94).
isAzureJwksUri and azureJwksSegment reject any keys URL with a query string (url.search !== ''), so they miss Azure's documented ?appid=<client-id> form of the shared-alias keys URL. Microsoft tells apps that use custom signing keys (claims mapping) to append it to jwks_uri, for example https://login.microsoftonline.com/common/discovery/keys?appid=<id>.
For an explicit-endpoint Azure config with that jwksUri and no tenantId:
- Unpinned (regression vs 2.8.1): not recognized as an Azure alias, so it falls into generic OIDC discovery. That fails, and the warning tells the operator to set
issuer. On 2.8.1 this config booted without discovery. - Pinned (same as 2.8.1): not recognized, so the pin isn't bound to the tenant's own keys. Keys still come from the shared pool with
issuerValidated: true, whichsrc/lib/DESIGN.mdsays must not be built. The bare v1 alias already throws for this reason.
Fix:
- In both matchers, accept a query made of exactly one
appidparameter and keep it. - A pinned v2 alias redirects to
/<guid>/discovery/v2.0/keys?appid=…, so custom-signedkids still resolve. - A pinned v1 alias throws, like the bare v1 alias.
- An unpinned alias in either form is excluded from discovery, like the bare alias.
Tests: pinned and unpinned, each in v1 and v2 form, all with ?appid=.
A complete fix with tests is pushed on branch fix/azure-appid-alias (b8e6200, 1832 tests passing); it needs a PR and review.
- Dominant language
- JavaScript
- Stars
- 1
- Forks
- 3
- Avg merge
- 1d 11h
- Merged PRs (30d)
- 28
Getting set up
- No Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from HarperFast/oauth
-
Open-issue triage and roadmap (post-2.9.0)Possibly taken @heskew claimed this 14 days ago. Open
HarperFast/oauth#278 · 1 assignee ·
Maintainers usually reply within 1 day
-
Session docs overstate expiry: no default lifetime, and invalidation clears fields rather than deleting the rowPossibly taken @heskew claimed this 14 days ago. Open
HarperFast/oauth#277 · 1 assignee ·
Maintainers usually reply within 1 day
-
Roleless OAuth session can inherit a role when a matching account is created laterPossibly taken @heskew claimed this 14 days ago. Open
HarperFast/oauth#273 · 1 assignee ·
Maintainers usually reply within 1 day
-
Azure multi-tenant: allow account adoption for an allowlist of tenants without restricting sign-inPossibly taken @heskew claimed this 14 days ago. Open
HarperFast/oauth#272 · 1 assignee ·
Maintainers usually reply within 1 day
-
Difficulty 3/5 1-2 days Newbie friendliness 48/100
HarperFast/oauth#258 ·
Maintainers usually reply within 1 day
All issues in HarperFast/oauth
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
apache/rocketmq-dashboard#6896 ·
Maintainers usually reply within 3 days
-
bug good first issue
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
Maintainers usually reply within 1 day
-
[workshop-sync] workshop/side-quest-17-06-output-injection.md: stale add_comment.cjs line referencesOpendocumentation
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
githubnext/gh-aw-workshop#4679 ·
Maintainers usually reply within 1 day
-
bug engine
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
frostney/GocciaScript#1746 ·
Maintainers usually reply within 1 day
-
Add: AVA MediaOpenchannels:add check:failed
Difficulty 2/5 1-3 hours Newbie friendliness 63/100