Add None and OAuth synonyms #2610

sander1095 · 2025-03-03T15:20:05Z

Why make this change?

This issue adds the None and OAuth authentication providers. These are simple synonyms with no behavioural differences.

What is this change?

Several enums/constants have been changed by adding None and OAuth. Several places in the codebase have been changed to add if statements where necessary.

Several tests have also been added.

How was this tested?

Integration Tests
Unit Tests

Sample Request(s)

Use the new OAuth authentication provider:

"authentication": {
  "provider": "OAuth",
  "jwt": {
    "audience": "https://example.com",
    "issuer": "https://example.com"
  }
},

Or None:

"authentication": {
  "provider": "None"
},

sander1095 · 2025-03-03T15:20:41Z

src/Core/AuthenticationHelpers/ConfigureJwtBearerOptions.cs

@@ -59,6 +59,10 @@ public void Configure(string? name, JwtBearerOptions options)
            RoleClaimType = AuthenticationOptions.ROLE_CLAIM_TYPE
        };

+        // TODO: The PR says "This (OAuth) also opens up a future direction should we need to handle special cases with EntraId."


This needs a discussion :)

I don't understand how that would be a behavioral change? From my understanding (and correct me if I am wrong), EntraId will be the one that would need the behavioral changes in the future as it is EntraId the one that will handle the special cases.

sander1095 · 2025-03-03T15:31:07Z

This PR still needs some discussions with the team as the issue's requirements don't really match DAB's behaviour. These changes can be made, but I doubt that such big changes are intended in this simple PR. Therefore, let's discuss what changes are still required:

There is a TODO in the code where adding a synonym would cause behavioral differences, which isn't desired according to the issue. Please take a look at the comment and let's discuss!
The issue mentions adding properties to the JSON Schema. However, the JSON schema currently doesn't validate any authentication.provider entries. I can add this, but is this desired in this PR?
- Nor does it validate (in the json schema) that jwt should be null when the provider isn't AzureAd/EntraId/OAuth. This is validated in code. Is there a reason this is only validated at runtime and not in config? Are any changes desired in this PR?
DAB's documentation isn't updated in this PR because the docs aren't part of this repo, it seems. If desired, I can write some docs, or is this usually done by people at Microsoft?
Perhaps some more tests are desired. If so, please point out some locations!
I'm running on Windows with the git pre commit hook installed. When I run dotnet format and try to commit, the hook fails. Perhaps because of CRLF changes? In any case, I disabled the hook and ran dotnet format manually but this might still need some looking into.

sander1095 · 2025-03-03T15:33:58Z

@microsoft-github-policy-service agree

RubenCerna2079 · 2025-03-05T00:00:52Z

/azp run

JerryNixon · 2025-03-05T01:44:06Z

Important

Before this is merged, we need to make a change. This is my fault.

In addition to None we need the synonym EasyAuth which is what StaticWebApps always meant.

This would be an additional synonym and what we recommend to users deploying to ACA and ACI.

sander1095 · 2025-03-06T08:23:09Z

Hi @JerryNixon !

I've added some more code to the PR that implements your request. However, the PR is now littered with a few TODOs as your case seems to complicate some matters. I'd like to ask if someone from the team can take a look at it.

If my team agree that my TODO's require this PR to become more complex, it might be worth putting the generic EasyAuth auth provider in a seperate issue to keep this PR mergeable. Curious to hear what you think. I could simply revert the last 2 commits for this to happen (and then implement any comments the team might have)

Another reason to consider moving the EasyAuth provider to its own issue is that there's lots of places in the codebase that say StaticWebApps is the default (JSON Schema, XML Comments, etc..). Do you want EasyAuth to also be the new default? As in, should StaticWebApps actually become a synonym for EasyAuth, instead of the other way around?

…a-api-builder into add-auth-synonyms

sander1095 · 2025-03-06T14:46:22Z

src/Core/AuthenticationHelpers/EasyAuthAuthenticationHandler.cs

@@ -68,6 +68,8 @@ protected override Task<AuthenticateResult> HandleAuthenticateAsync()
            {
                EasyAuthType.StaticWebApps => StaticWebAppsAuthentication.Parse(Context, Logger),
                EasyAuthType.AppService => AppServiceAuthentication.Parse(Context, Logger),
+                EasyAuthType.EasyAuth => StaticWebAppsAuthentication.Parse(Context, Logger), // TODO: Is this correct?


@dab team: Please advise

sander1095 · 2025-03-06T14:46:39Z

src/Core/AuthenticationHelpers/EasyAuthAuthenticationBuilderExtensions.cs

@@ -27,7 +27,10 @@ public static AuthenticationBuilder AddEasyAuthAuthentication(
            throw new ArgumentNullException(nameof(builder));
        }

-        if (easyAuthAuthenticationProvider is EasyAuthType.StaticWebApps)
+        // TODO: Same question as in ClientRoleHeaderAuthenticationMiddleware. Jerry Nixon says that EASY_AUTH is also a synonym for STATIC_WEB_APPS/APP_SERVICE/NONE in DAB.


@dab team: Please advise

sander1095 · 2025-03-06T14:46:45Z

src/Core/AuthenticationHelpers/ClientRoleHeaderAuthenticationMiddleware.cs

@@ -179,8 +179,13 @@ public static bool IsSystemRole(string roleName)
    /// <returns>Authentication Scheme</returns>
    private static string ResolveConfiguredAuthNScheme(string? configuredProviderName)
    {
+        // TODO: Jerry Nixon says that EASY_AUTH is also a synonym for STATIC_WEB_APPS/APP_SERVICE/NONE in DAB.


@dab team: Please advise

RubenCerna2079 · 2025-03-08T00:34:14Z

/azp run

Aniruddh25 · 2025-03-24T04:25:45Z

There is a TODO in the code where adding a synonym would cause behavioral differences, which isn't desired according to the issue. Please take a look at the comment and let's discuss!

Got it, lets discuss in line with respect to each TODO

The issue mentions adding properties to the JSON Schema. However, the JSON schema currently doesn't validate any authentication.provider entries. I can add this, but is this desired in this PR?

Yes please add the properties in the schema in this PR or in an immediate subsequent one even though they are not being validated.

Nor does it validate (in the json schema) that jwt should be null when the provider isn't AzureAd/EntraId/OAuth. This is validated in code. Is there a reason this is only validated at runtime and not in config? Are any changes desired in this PR?

Lets create a separate PR to validate the config using the schema. It was simply a miss by previous contributors.

DAB's documentation isn't updated in this PR because the docs aren't part of this repo, it seems. If desired, I can write some docs, or is this usually done by people at Microsoft?

Could you please provide edits to the docs here:

https://learn.microsoft.com/en-us/azure/data-api-builder/authentication-local#use-the-simulator-provider

Perhaps some more tests are desired. If so, please point out some locations!
I'm running on Windows with the git pre commit hook installed. When I run dotnet format and try to commit, the hook fails. Perhaps because of CRLF changes? In any case, I disabled the hook and ran dotnet format manually but this might still need some looking into.

Will look into the PR this week. Thanks for your patience.

RubenCerna2079 · 2025-03-28T02:30:48Z

src/Cli.Tests/TestHelper.cs

@@ -175,6 +175,84 @@ public static Process ExecuteDabCommand(string command, string flags)
              }
          }";

+        /// <summary>
+        /// Only Runtime section containing both rest and graphql enabled, with None authentication.


Could you update the comment so that we know it changes the authentication to none?

RubenCerna2079 · 2025-03-28T02:30:59Z

src/Cli.Tests/TestHelper.cs

+          }";
+
+        /// <summary>
+        /// Only Runtime section containing both rest and graphql enabled. The authentication provider can be replaced with <>.


Same as the comment above

RubenCerna2079 · 2025-03-28T02:39:12Z

src/Cli.Tests/TestHelper.cs

+          }";
+
+        /// <summary>
+        /// Only Runtime section containing both rest and graphql enabled. The authentication provider can be replaced with <>.


Same as the comment above.

RubenCerna2079 · 2025-03-28T02:45:01Z

src/Cli.Tests/ValidateConfigTests.cs

+    }
+
+    /// <summary>
+    /// This Test is used to verify that the None authentication scheme is valid


Suggested change

/// This Test is used to verify that the None authentication scheme is valid

/// This test verifies that the 'None' authentication schema is valid

RubenCerna2079 · 2025-03-28T02:47:27Z

src/Cli.Tests/ValidateConfigTests.cs

+    }
+
+    /// <summary>
+    /// This Test is used to verify that the JWT properties must be added when the authentication scheme is Not easyAuth and not Simulator.


Suggested change

/// This Test is used to verify that the JWT properties must be added when the authentication scheme is Not easyAuth and not Simulator.

/// This test verifies that the JWT properties must be added when the authentication schema is not easyAuth and not Simulator.

RubenCerna2079 · 2025-03-28T02:53:10Z

src/Cli.Tests/ValidateConfigTests.cs

+    /// <summary>
+    /// This Test is used to verify that the JWT properties must be added when the authentication scheme is Not easyAuth and not Simulator.
+    /// </summary>


From my understanding this test is checking for situations in which there is missing information. Could you add a bit more detail to the description or add small comments through the test?

RubenCerna2079 · 2025-03-28T03:20:38Z

src/Core/AuthenticationHelpers/ConfigureJwtBearerOptions.cs

@@ -59,6 +59,10 @@ public void Configure(string? name, JwtBearerOptions options)
            RoleClaimType = AuthenticationOptions.ROLE_CLAIM_TYPE
        };

+        // TODO: The PR says "This (OAuth) also opens up a future direction should we need to handle special cases with EntraId."


I don't understand how that would be a behavioral change? From my understanding (and correct me if I am wrong), EntraId will be the one that would need the behavioral changes in the future as it is EntraId the one that will handle the special cases.

sander1095 added 5 commits March 3, 2025 15:12

Added several auth modes and started adding tests

132d9d6

Add CLI test for None

69d6eb9

Add comment for later

5d9de27

Add extra dab validate tests

1891bf5

Fix incorrect code

926eb59

sander1095 commented Mar 3, 2025

View reviewed changes

Merge branch 'main' into add-auth-synonyms

9376f46

sander1095 marked this pull request as ready for review March 4, 2025 19:20

sander1095 requested review from Aniruddh25, aaronburtle, abhishekkumams, RubenCerna2079, ravishetye, rohkhann, neeraj-sharma2592, sourabh1007 and sezal98 as code owners March 4, 2025 19:20

sander1095 added 3 commits March 6, 2025 15:29

Add tests for the EasyAuth type

0d3b553

add more code around EasyAuth

25b9244

Merge branch 'add-auth-synonyms' of https://github.com/sander1095/dat…

9fa2c78

…a-api-builder into add-auth-synonyms

sander1095 commented Mar 6, 2025

View reviewed changes

Merge branch 'main' into add-auth-synonyms

f4a5a45

RubenCerna2079 reviewed Mar 28, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add None and OAuth synonyms #2610

Add None and OAuth synonyms #2610

sander1095 commented Mar 3, 2025

sander1095 Mar 3, 2025

RubenCerna2079 Mar 28, 2025

sander1095 commented Mar 3, 2025 •

edited by RubenCerna2079

Loading

sander1095 commented Mar 3, 2025

RubenCerna2079 commented Mar 5, 2025

JerryNixon commented Mar 5, 2025

sander1095 commented Mar 6, 2025 •

edited

Loading

sander1095 Mar 6, 2025 •

edited

Loading

sander1095 Mar 6, 2025

sander1095 Mar 6, 2025

RubenCerna2079 commented Mar 8, 2025

Aniruddh25 commented Mar 24, 2025 •

edited

Loading

RubenCerna2079 Mar 28, 2025

RubenCerna2079 Mar 28, 2025

RubenCerna2079 Mar 28, 2025

RubenCerna2079 Mar 28, 2025

RubenCerna2079 Mar 28, 2025

RubenCerna2079 Mar 28, 2025

RubenCerna2079 Mar 28, 2025

	/// This Test is used to verify that the None authentication scheme is valid
	/// This test verifies that the 'None' authentication schema is valid

	/// This Test is used to verify that the JWT properties must be added when the authentication scheme is Not easyAuth and not Simulator.
	/// This test verifies that the JWT properties must be added when the authentication schema is not easyAuth and not Simulator.

Add None and OAuth synonyms #2610

Are you sure you want to change the base?

Add None and OAuth synonyms #2610

Conversation

sander1095 commented Mar 3, 2025

Why make this change?

What is this change?

How was this tested?

Sample Request(s)

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sander1095 commented Mar 3, 2025 • edited by RubenCerna2079 Loading

sander1095 commented Mar 3, 2025

RubenCerna2079 commented Mar 5, 2025

JerryNixon commented Mar 5, 2025

Important

sander1095 commented Mar 6, 2025 • edited Loading

sander1095 Mar 6, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

RubenCerna2079 commented Mar 8, 2025

Aniruddh25 commented Mar 24, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sander1095 commented Mar 3, 2025 •

edited by RubenCerna2079

Loading

sander1095 commented Mar 6, 2025 •

edited

Loading

sander1095 Mar 6, 2025 •

edited

Loading

Aniruddh25 commented Mar 24, 2025 •

edited

Loading