search

DuendeSoftware / Support

Support for Duende Software products
20 stars 0 forks source link

Using Parameterized Scopes to identify the tenant #1307

Closed braiinzz closed 2 weeks ago

braiinzz commented 2 weeks ago

Which version of Duende IdentityServer are you using? 7.0.1

Which version of .NET are you using? net8.0

Describe the bug

I tried to add parameterized scopes as described on this page: https://docs.duendesoftware.com/identityserver/v7/fundamentals/resources/api_scopes/#parameterized-scopes

However, the RawValue is everytime only the scope without the parameter part. In the example code the RawValue is only transaction and not transaction:id. I'm not sure if I understood it correctly how to configure the client itself (described at "To Reproduce")

To Reproduce

  1. Add the code as described in this section: https://docs.duendesoftware.com/identityserver/v7/fundamentals/resources/api_scopes/#parameterized-scopes
  2. Add an ApiScope with the name transaction
  3. Add a scope to the client with the name transaction
  4. Request a token with the client_credentials flow with the scope transaction:id

With the debugger you can now check the value of scopeContext.RawValue in my case it was transaction.

Expected behavior

The property scopeContext.RawValue in the class ParameterizedScopeParser is equal to transaction:id.

Additional context

We want to use the parameterized scope to identify the tenant the client requests the token for.

RolandGuijt commented 2 weeks ago

I can't find anything wrong in the steps you're describing. I did some debugging too and in my case RawValue has the value transaction:id. Can you please take a look at our example here and set the same breakpoint in ParameterizedScopeParser. And when client and identity provider are running choose the option "h" in the client console. That should give you the transaction:123 value in RawValue. Is that's the case you should be able to determine what's going wrong in your solution by comparing it with the example.

brockallen commented 2 weeks ago

In addition, IdentityServer already has some built-in support for a tenant parameter via the acr_values param:

https://docs.duendesoftware.com/identityserver/v7/reference/endpoints/authorize/#optional-parameters

braiinzz commented 2 weeks ago

Sorry, it was my fault. I requested the token with the parameter client_scopes and not scope 🤦