the purpose is that you can take stuff from usertable and put into claims when an identity is created right?
yea, as for how you produce it... i guess that's up to you.
if you're using MR or AspId, then you can override the virtual for GetDisplayName
actually, sorry, that API is just for the display name on IdSvr.
if you want to tweak the actual token claims, then override GetClaimsFromAccount
@brockallen @leastprivilege I am in a yello screen of death situation due to oidc middleware doing an error (error:invalid_request
error_description:AADSTS16000: Session is invalid due to recent password change.) http://www.cloudidentity.com/blog/2014/05/11/openid-connect-and-ws-fed-owin-components-design-principles-object-model-and-pipeline/ shows how to redirect away. Is there any way to redirect the error into idsrvs views. Maybe we can set some properties on owinctx that idsrv can pickup. Just ideas in case its something more people will run into
error_description:AADSTS16000: Session is invalid due to recent password change.) http://www.cloudidentity.com/blog/2014/05/11/openid-connect-and-ws-fed-owin-components-design-principles-object-model-and-pipeline/ shows how to redirect away. Is there any way to redirect the error into idsrvs views. Maybe we can set some properties on owinctx that idsrv can pickup. Just ideas in case its something more people will run into
AuthenticationFailed = async (notice) =>{
notice.Response.Write(string.Format("Pleanse clear cookies from https://login.windows.net/. Exception: {0}", notice.Exception));
notice.Response.Write(string.Format("Pleanse clear cookies from https://login.windows.net/. Exception: {0}", notice.Exception));
notice.SkipToNextMiddleware();
},
I know this is a TAD out of scope, but @leastprivilege : have you any thoughts on this and the default login-view? (XSS-vuln in Android WebViews) http://arxiv.org/ftp/arxiv/papers/1304/1304.7451.pdf What mechanisms of idsrv makes this safe from XSS?
i have this entry in my logs a few times but havent experienced any issues from the user point of it.: [Thinktecture.IdentityServer.Core.Validation.TokenValidator]: 1/22/2015 10:57:03 AM +00:00 -- Token handle not found
{
"ValidateLifetime": true,
"AccessTokenType": "Reference",
"TokenHandle": "undefined"
}; TraceSource 'w3wp.exe' event
{
"ValidateLifetime": true,
"AccessTokenType": "Reference",
"TokenHandle": "undefined"
}; TraceSource 'w3wp.exe' event
Ahh, i think its because some default bearer token validation kicks in and it ask idsrv to validate it. Using the thinktecture access token validation middleware. Maybe this should not do the request if no token was given
yea, search for UTF8
it's the fine print :)
yes
that's always your job for anything like that
IViewService
we are misusing the acr_values param to add state to the login view
that's what the msft middleware does
also, BTW, for RTM i'm changing the config slightly for the default view service
the intent is to make it work better with the DI system
no functionality changes. just more how it's configured.
That AddHeaderAndFooter thing was also something we had to add to the defaultviewservice render method
to avoid "Do you want to re-submit" stuff from the browser
hitting F5 when you have any error in the LoginViewModel will get you the ugly browser "Confirm Form Resubmission" message