search

domaindrivendev / Swashbuckle.WebApi

Seamlessly adds a swagger to WebApi projects!
BSD 3-Clause "New" or "Revised" License
3.07k stars 678 forks source link

EnableOAuth2Support with additionalQueryStringParams requires clientSecret #1150

Open cmshawns opened 7 years ago

cmshawns commented 7 years ago

SwaggerUiConfig provides two signatures for EnableOAuth2Support():

EnableOAuth2Support(string clientId, string realm, string appName);
EnableOAuth2Support(string clientId, string clientSecret, string realm, string appName, string scopeSeperator = " ", Dictionary<string, string> additionalQueryStringParams = null);

Our service is authenticating against Azure Active Directory (AAD), so it needs an additional query parameter of resource, but authentication is using a native, multi-tenant app where individual service maintainers (e.g. tenants) should not have the client secret.

This also means that the authentication flow should not be redirecting back to a page provided by the service. Rather, after logging into their tenant, users should be directed back to the URL they started at to continue using the service.

dmitry-pavlov commented 5 years ago

Is it only me who is curious why scopeSeperator is not scopeSeparator?

wizofaus commented 5 years ago

Is it only me who is curious why scopeSeperator is not scopeSeparator?

Nope, noticed it myself and was going to report as a bug, but given the backlog seems unlikely anybody would fix...