feat: add requirement for denying guest users #2179
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
h3rmanj
commented
Apr 3, 2023
| /// Implements an <see cref="IAuthorizationRequirement"/> | ||
| /// which requires the current user to be a member of the tenant. | ||
| /// </summary> | ||
| public class DenyGuestsAuthorizationRequirement : IAuthorizationRequirement |
Contributor
Author
There was a problem hiding this comment.
Not locked on the naming of this. I see many requirements are prefixed with Require, but RequireTenantMembers or RequireNonGuests sounds weird and isn't as explicit in what it tries to achieve.
|
@microsoft-github-policy-service agree |
loekensgard
force-pushed
the
deny-guests-requirement
branch
2 times, most recently
from
8a2e238 to
1b0f918
Compare
Signed-off-by: Thorstein Løkensgard <thorstein.lokensgard@intility.no>
loekensgard
force-pushed
the
deny-guests-requirement
branch
from
1b0f918 to
1ae9fe3
Compare
Collaborator
Contributor
Author
|
Mind sharing your thoughts? This is how we've done it internally for now, but we'd love to hear the plans for actual implementation in the SDK or even Azure itself. |
Contributor
Author
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
As a developer, I expect to be able to easily allow all members of a tenant to access my application, without needing to set up roles and manual assignment.
However, Azure AD allows for guest users, that applications like Teams rely on. These guest users will then by default have access to applications that doesn't have any roles, but still only should be accessible by tenant members.
This PR introduces the
DenyGuestsextension toAuthorizationPolicyBuilder, which easily lets the developer deny guests users access to their applications with policies.I think that many enterprise application would want this behavior by default, and without it, the application would be exposed to some vulnerabilities.
//cc @loekensgard @JonasKs