OAuth with Azure Active Directory: Azure AD returns incorrect value for the State parameter after denying admin-consent scopes -


during oauth interaction azure ad, appears azure returns incorrect value state parameter after users deny grant admin-consent scopes.

when constructing url requesting authorization code azure ad via azure ad v2.0 endpoint https://login.microsoftonline.com/{tenant}/oauth2/v2.0/authorize, let specify state parameter a+b. url encoding state parameter value a%2bb , put in url requesting authorization code azure ad

if request specifies scopes require administrator consent , have not granted in past, azure returns following page expected:

app requires administrator consent

i trying verify application logic handling errors returning azure. denied consent clicking return application without granting consent link. after that, azure expectedly returned error response app's redirect uri. azure populated data in http body follows:

error response after denying admin-consent scopes

azure populated state parameter value a%252bb. not correct. expected value should a%2bb - i.e. same value specified earlier when calling azure authorization code request endpoint described earlier. looks azure somehow performed double url encoding - in other words, encoding url-encoded state parameter, changing a%2bb a%252bb. (% encoded %25. in addition strange b somehow became b)

it appears azure has issue in code path handling users clicking return application without granting consent link denying admin-consent scopes. other scenario of users denying user-consent scopes, appears azure not have issue. azure returns proper value state parameter illustrated follows:

error response after denying user-consent scopes

i tried again today. looks microsoft has removed return application without granting consent link. issue mentioned in post earlier no longer exists.

you can't access application page


Comments

Post a Comment

Popular posts from this blog

android - InAppBilling registering BroadcastReceiver in AndroidManifest -

i'm implementing inapp billing in android app. works well, however, i'm trying decouple broadcast receiver activity manifest. suggestion in android's trivialdrive sample: // important: dynamically register broadcast messages updated purchases. // register receiver here instead of <receiver> in manifest // because call getpurchases() @ startup, therefore can ignore // broadcasts sent while app isn't running. // note: registering listener in activity bad idea, done here // because sample. regardless, receiver must registered after // iabhelper setup, before first call getpurchases(). currently there's class extends broadcastreceiver : public class iabbroadcastreceiver extends broadcastreceiver { /** * intent action receiver should filter for. */ public static final string action = "com.android.vending.billing.purchases_updated"; private final iabbroadcastlistener mlistener; public iabbroadcastreceiver(iabbroadcastlistener listener) { m...
Read more

python Tkinter Capturing keyboard events save as one single string -

is possible store keyboard events 1 string? code below stores 1 char , prints it. card reader or bar code reader, contains collection of character/ string not 1 character @ time. goal save char pressed text variable. from tkinter import * root = tk() def key(event): text= event.char text+= event.char print ("pressed", text) def callback(event): frame.focus_set() print ("clicked at", event.x, event.y) frame = frame(root, width=100, height=100) frame.bind("<key>", key) frame.bind("<button-1>", callback) frame.pack() root.mainloop() currently, creating text variable , everytime key() function gets called, , text stores last character typed. you can define text module level variable , , use module level text inside key function - text = '' def key(event): global text text+= event.char print("pressed", text)
Read more

sql server - Why does Linq-to-SQL add unnecessary COUNT()? -

here tables: create table customer ( cid int primary key, name varchar(32) ) create table ord ( oid int primary key, cid int foreign key references customer, address varchar(20) ) here's linq-to-sql statement: var aaa = c in db.customer select new { c, o = c.ord.tolist() }; and here's inexplicable query generated linq-to-sql: select [t0].[cid] [cid], [t0].[name] [name], [t1].[oid] [oid], [t1].[cid] [cid2], [t1].[address] [address], (select count(*) [dbo].[ord] [t2] [t2].[cid] = [t0].[cid]) [value] [dbo].[customer] [t0] left outer join [dbo].[ord] [t1] on [t1].[cid] = [t0].[cid] order [t0].[cid], [t1].[oid] i want understand how rid of count(*) part. it's entirely uncalled for! linq needs count(*) in order determine number of entries returned o = c.ord.tolist() .
Read more