Authorize everywhere solution breaks OIDC

[jchoca]

Description

I could be missing something, but it seems like this solution doesn't work for the MS OpenIdConnect libraries for ASP.NET:

var requireAuthPolicy = new AuthorizationPolicyBuilder()
    .RequireAuthenticatedUser()
    .Build();

builder.Services.AddAuthorizationBuilder()
    .SetFallbackPolicy(requireAuthPolicy);

When I used this, it seemed to cause the built-in OIDC endpoint(s) to require authorization, causing an infinite loop.

Page URL

https://learn.microsoft.com/en-us/aspnet/core/security/authentication/configure-oidc-web-authentication?view=aspnetcore-9.0

Content source URL

https://github.com/dotnet/AspNetCore.Docs/blob/main/aspnetcore/security/authentication/configure-oidc-web-authentication.md

Document ID

5d97b8bb-6505-9268-efbc-33fc2c02f4d8

Article author

@damienbod

Metadata

• ID: 5d97b8bb-6505-9268-efbc-33fc2c02f4d8
• Service: aspnet-core
• Sub-service: security

Related Issues

[guardrex]

Hello @jchoca ... Stand by for @damienbod to arrive and assist further. As you suggest, you can start with that policy per ...

https://learn.microsoft.com/aspnet/core/security/authentication/configure-oidc-web-authentication#force-authorization

... and then use [AllowAnonymous] to opt out for pages that shouldn't require authz, as shown in the next two sections ...

• https://learn.microsoft.com/aspnet/core/security/authentication/configure-oidc-web-authentication#add-a-new-logoutcshtml-and-signedoutcshtml-razor-pages-to-the-project
• https://learn.microsoft.com/aspnet/core/security/authentication/configure-oidc-web-authentication#implement-login-page

@damienbod will comment further when he gets on here. I'm 👀 on your issue for a separate reason: I might want to provide a cross-link or two in the Blazor OIDC article for this very common scenario.

[damienbod]

Yes, this sounds good. Lock everything down and opt out for the public endpoints with the [AllowAnonymous]

[guardrex]

Thanks, @damienbod. I'll take a quick stab at a few words in the section on Force authorization to this effect. I'll ping you for review on the PR in a few minutes.