RequireScope() DI Registration from PolicyBuilderExtensions

[followynne]

Question

Hello all 😃,

I used RequireScope from Microsoft.Identity.Web.PolicyBuilderExtensions to register scopes from within AddAuthorization.

services.AddAuthorization(policy => {
    options.AddPolicy("ExamplePolicy", policy =>
    {
      policy.RequireAuthenticatedUser();
      policy.RequireScope("Scope1", "Scope2");
    });
});

I wrote a test on it but I wasn't able to make the policy work, until I found out that I needed to add the following extension method:

services.AddRequiredScopeAuthorization();

In the description of RequireScope there's no mention to this requirement, while in AddRequiredScopeAuthorization docs it refers specifically to the RequireScope as an attribute.

Is this the correct flow to register RequireScope extensions or should it work out-of-the-box?

If that's the case, could it be interesting a PR to add in the XML Doc of the file a reference to this detail?

(an example:)
/// Requires the registration of <see cref="Microsoft.Identity.Web.RequiredScopeExtensions.AddRequiredScopeAuthorization"/>

Thanks for the help 😊

Replicate the behavior (on xUnit project)

Test will fail - uncomment line at the end of the file to make it pass

<!--packages to add in the .csproj-->
<PackageReference Include="FluentAssertions" Version="6.7.0" />
<PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.3.1" />
<PackageReference Include="xunit" Version="2.4.2" />
<PackageReference Include="xunit.runner.visualstudio" Version="2.4.5">
  <PrivateAssets>all</PrivateAssets>
  <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
</PackageReference>

// RequiredScopeTest.cs
using System.Collections.Generic;
using System.Security.Claims;
using System.Threading.Tasks;
using FluentAssertions;
using Microsoft.AspNetCore.Authorization;
using Microsoft.Extensions.Configuration;
using Microsoft.Extensions.DependencyInjection;
using Microsoft.Identity.Web;
using Xunit;

public class RequiredScopeTest
{
        private readonly IAuthorizationService authorizationService;

        public RequiredScopeTest()
        {
            authorizationService = BuildAuthorizationService();
        }
        [Fact]
        public async Task It_unauthorizes_policies_by_scopes()
        {
            var authList = new List<AuthorizationResult>();

            var claim = new Claim(ClaimConstants.Scope, "Scope1");
            var user = new ClaimsPrincipal(new ClaimsIdentity(new List<Claim>()
            {
                claim,
            }, "Bearer"));
            authList.Add(await authorizationService.AuthorizeAsync(user, "ExamplePolicy"));

            authList.Should().OnlyContain(a => a.Succeeded);
        }

    private static IAuthorizationService BuildAuthorizationService()
        {
            var services = new ServiceCollection();
            // create a json file with an empty json object in it
            var configuration = new ConfigurationBuilder().AddJsonFile("appsettings.json").Build();
            services.AddAuthorizationCore();
            services.AddHttpContextAccessor();
            services.AddLogging();
            services.AddOptions();
            services.AddSingleton<IConfiguration>(configuration);
            services.AddAuthorization(options => {
              options.AddPolicy("ExamplePolicy", policy =>
              {
                   policy.RequireAuthenticatedUser();
                   policy.RequireScope("Scope1", "Scope2");
               });
              });

             /* uncomment this line to make the test pass */
            // services.AddRequiredScopeAuthorization();

            return services.BuildServiceProvider().GetRequiredService<IAuthorizationService>();
       }
}