-
Notifications
You must be signed in to change notification settings - Fork 435
Description
Fix bug with AadIssuerValidator
Description
The current implementation of AadIssuerValidator always expects that token issuer length should be greater than templateTenantIdPosition + tenantId's length.
It's not true for the case when Issuer in token and Issuer template in OIDC configuration match, but don't have a trailing slash.
Example:
Issuer template in OIDC configuration: https://sts.windows.net/{tenantid}
Issuer in JWT token: https://sts.windows.net/f645ad92-e38d-4d1a-b510-d1b09a74a8ca
Condition tokenIssuer.Length <= templateTenantIdPosition + tenantId.Length of IsValidIssuer method results to true because tokenIssuer.Length equals to templateTenantIdPosition + tenantId.Length. As a result, the issuer is considered as invalid even when it matches to the issuer template from OIDC config.