Remove support for setting default scheme from user-jwts (#42578)

captainsafia · Tratcher · web-flow · commit db855a52419c · 2022-07-06T00:19:35.000Z
* Revert "Fix up reading auth schemes and setting default scheme (#42452)" This reverts commit f0e1d1e. * Bring back non-default scheme related changes * Remove AuthenticationConfigureOptions * Update src/Tools/dotnet-user-jwts/src/Helpers/JwtAuthenticationSchemeSettings.cs Co-authored-by: Chris Ross <Tratcher@Outlook.com> Co-authored-by: Chris Ross <Tratcher@Outlook.com>
diff --git a/src/Http/Authentication.Core/src/AuthenticationService.cs b/src/Http/Authentication.Core/src/AuthenticationService.cs
@@ -14,7 +14,6 @@ namespace Microsoft.AspNetCore.Authentication;
 public class AuthenticationService : IAuthenticationService
 {
     private HashSet<ClaimsPrincipal>? _transformCache;
-    private const string defaultSchemesOptionsMsg = "The default schemes can be set using either AddAuthentication(string defaultScheme) or AddAuthentication(Action<AuthenticationOptions> configureOptions) or by setting the Authentication:DefaultScheme property in configuration.";
 
     /// <summary>
     /// Constructor.
@@ -65,7 +64,7 @@ public virtual async Task<AuthenticateResult> AuthenticateAsync(HttpContext cont
             scheme = defaultScheme?.Name;
             if (scheme == null)
             {
-                throw new InvalidOperationException($"No authenticationScheme was specified, and there was no DefaultAuthenticateScheme found. {defaultSchemesOptionsMsg}");
+                throw new InvalidOperationException($"No authenticationScheme was specified, and there was no DefaultAuthenticateScheme found. The default schemes can be set using either AddAuthentication(string defaultScheme) or AddAuthentication(Action<AuthenticationOptions> configureOptions).");
             }
         }
 
@@ -113,7 +112,7 @@ public virtual async Task ChallengeAsync(HttpContext context, string? scheme, Au
             scheme = defaultChallengeScheme?.Name;
             if (scheme == null)
             {
-                throw new InvalidOperationException($"No authenticationScheme was specified, and there was no DefaultChallengeScheme found. {defaultSchemesOptionsMsg}");
+                throw new InvalidOperationException($"No authenticationScheme was specified, and there was no DefaultChallengeScheme found. The default schemes can be set using either AddAuthentication(string defaultScheme) or AddAuthentication(Action<AuthenticationOptions> configureOptions).");
             }
         }
 
@@ -141,7 +140,7 @@ public virtual async Task ForbidAsync(HttpContext context, string? scheme, Authe
             scheme = defaultForbidScheme?.Name;
             if (scheme == null)
             {
-                throw new InvalidOperationException($"No authenticationScheme was specified, and there was no DefaultForbidScheme found. {defaultSchemesOptionsMsg}");
+                throw new InvalidOperationException($"No authenticationScheme was specified, and there was no DefaultForbidScheme found. The default schemes can be set using either AddAuthentication(string defaultScheme) or AddAuthentication(Action<AuthenticationOptions> configureOptions).");
             }
         }
 
@@ -187,7 +186,7 @@ public virtual async Task SignInAsync(HttpContext context, string? scheme, Claim
             scheme = defaultScheme?.Name;
             if (scheme == null)
             {
-                throw new InvalidOperationException($"No authenticationScheme was specified, and there was no DefaultSignInScheme found. {defaultSchemesOptionsMsg}");
+                throw new InvalidOperationException($"No authenticationScheme was specified, and there was no DefaultSignInScheme found. The default schemes can be set using either AddAuthentication(string defaultScheme) or AddAuthentication(Action<AuthenticationOptions> configureOptions).");
             }
         }
 
@@ -221,7 +220,7 @@ public virtual async Task SignOutAsync(HttpContext context, string? scheme, Auth
             scheme = defaultScheme?.Name;
             if (scheme == null)
             {
-                throw new InvalidOperationException($"No authenticationScheme was specified, and there was no DefaultSignOutScheme found. {defaultSchemesOptionsMsg}");
+                throw new InvalidOperationException($"No authenticationScheme was specified, and there was no DefaultSignOutScheme found. The default schemes can be set using either AddAuthentication(string defaultScheme) or AddAuthentication(Action<AuthenticationOptions> configureOptions).");
             }
         }
 
diff --git a/src/Security/Authentication/Core/src/AuthenticationConfigureOptions.cs b/src/Security/Authentication/Core/src/AuthenticationConfigureOptions.cs
diff --git a/src/Security/Authentication/Core/src/AuthenticationServiceCollectionExtensions.cs b/src/Security/Authentication/Core/src/AuthenticationServiceCollectionExtensions.cs
@@ -3,7 +3,6 @@
 
 using Microsoft.AspNetCore.Authentication;
 using Microsoft.Extensions.DependencyInjection.Extensions;
-using Microsoft.Extensions.Options;
 
 namespace Microsoft.Extensions.DependencyInjection;
 
@@ -29,7 +28,6 @@ public static AuthenticationBuilder AddAuthentication(this IServiceCollection se
         services.AddWebEncoders();
         services.TryAddSingleton<ISystemClock, SystemClock>();
         services.TryAddSingleton<IAuthenticationConfigurationProvider, DefaultAuthenticationConfigurationProvider>();
-        services.TryAddEnumerable(ServiceDescriptor.Singleton<IConfigureOptions<AuthenticationOptions>, AuthenticationConfigureOptions>());
 
         return new AuthenticationBuilder(services);
     }
diff --git a/src/Security/Authentication/test/JwtBearerTests.cs b/src/Security/Authentication/test/JwtBearerTests.cs
@@ -885,41 +885,6 @@ public async Task ExpirationAndIssuedNullWhenMinOrMaxValue()
         Assert.Equal(JsonValueKind.Null, dom.RootElement.GetProperty("issued").ValueKind);
     }
 
-    [Fact]
-    public async Task ForwardSchemeOverridesSchemeFromConfig()
-    {
-        // Arrange
-        var defaultSchemeFromConfig = "DefaultSchemeFromConfig";
-        var defaultSchemeFromForward = "DefaultSchemeFromForward";
-        var services = new ServiceCollection().AddLogging();
-        var config = new ConfigurationBuilder().AddInMemoryCollection(new[]
-        {
-            new KeyValuePair<string, string>("Authentication:DefaultScheme", defaultSchemeFromConfig)
-        }).Build();
-        services.AddSingleton<IConfiguration>(config);
-
-        // Act
-        var builder = services.AddAuthentication(o =>
-        {
-            o.AddScheme<TestHandler>(defaultSchemeFromForward, defaultSchemeFromForward);
-        });
-        builder.AddJwtBearer(defaultSchemeFromConfig, o => o.ForwardAuthenticate = defaultSchemeFromForward);
-        var forwardAuthentication = new TestHandler();
-        services.AddSingleton(forwardAuthentication);
-
-        var sp = services.BuildServiceProvider();
-        var context = new DefaultHttpContext();
-        context.RequestServices = sp;
-
-        // Assert
-        Assert.Equal(0, forwardAuthentication.AuthenticateCount);
-        await context.AuthenticateAsync();
-        Assert.Equal(1, forwardAuthentication.AuthenticateCount);
-        var schemeProvider = sp.GetRequiredService<IAuthenticationSchemeProvider>();
-        var defaultSchemeFromServices = await schemeProvider.GetDefaultAuthenticateSchemeAsync();
-        Assert.Equal(defaultSchemeFromConfig, defaultSchemeFromServices.Name);
-    }
-
     class InvalidTokenValidator : ISecurityTokenValidator
     {
         public InvalidTokenValidator()
diff --git a/src/Security/Authentication/test/SharedAuthenticationTests.cs b/src/Security/Authentication/test/SharedAuthenticationTests.cs
@@ -545,92 +545,4 @@ public async Task VerifySchemeDefaults()
         Assert.Equal(HandlerType, scheme.HandlerType);
         Assert.Equal(DisplayName, scheme.DisplayName);
     }
-
-    [Fact]
-    public async Task RespectsDefaultSchemeInConfig()
-    {
-        // Arrange
-        var defaultSchemeFromConfig = "DefaultSchemeFromConfig";
-        var services = new ServiceCollection();
-        var config = new ConfigurationBuilder().AddInMemoryCollection(new[]
-        {
-            new KeyValuePair<string, string>("Authentication:DefaultScheme", defaultSchemeFromConfig)
-        }).Build();
-        services.AddSingleton<IConfiguration>(config);
-
-        // Act
-        var builder = services.AddAuthentication(o =>
-        {
-            o.AddScheme<TestHandler>(defaultSchemeFromConfig, defaultSchemeFromConfig);
-        });
-        RegisterAuth(builder, _ => { });
-        var sp = services.BuildServiceProvider();
-
-        // Assert
-        var schemeProvider = sp.GetRequiredService<IAuthenticationSchemeProvider>();
-        var defaultSchemeFromServices = await schemeProvider.GetDefaultAuthenticateSchemeAsync();
-        Assert.Equal(defaultSchemeFromConfig, defaultSchemeFromServices.Name);
-    }
-
-    [Fact]
-    public async Task CanOverrideDefaultInConfigViaAddAuthentication()
-    {
-        // Arrange
-        var defaultSchemeFromConfig = "DefaultSchemeFromConfig";
-        var defaultSchemeFromAddAuth = "DefaultSchemeFromAddAuth";
-        var services = new ServiceCollection();
-        var config = new ConfigurationBuilder().AddInMemoryCollection(new[]
-        {
-            new KeyValuePair<string, string>("Authentication:DefaultScheme", defaultSchemeFromConfig)
-        }).Build();
-        services.AddSingleton<IConfiguration>(config);
-
-        // Act
-        var builder = services.AddAuthentication(o =>
-        {
-            o.DefaultScheme = defaultSchemeFromAddAuth;
-            o.AddScheme<TestHandler>(defaultSchemeFromConfig, defaultSchemeFromConfig);
-            o.AddScheme<TestHandler>(defaultSchemeFromAddAuth, defaultSchemeFromAddAuth);
-        });
-        RegisterAuth(builder, _ => { });
-        var sp = services.BuildServiceProvider();
-
-        // Assert
-        var schemeProvider = sp.GetRequiredService<IAuthenticationSchemeProvider>();
-        var defaultSchemeFromServices = await schemeProvider.GetDefaultAuthenticateSchemeAsync();
-        Assert.Equal(defaultSchemeFromAddAuth, defaultSchemeFromServices.Name);
-    }
-
-    [Fact]
-    public async Task DoesNotOverrideDefaultSchemeSetViaOptions()
-    {
-        // Arrange
-        var defaultSchemeFromConfig = "DefaultSchemeFromConfig";
-        var defaultSchemeFromOptions = "DefaultSchemeFromOptions";
-        var services = new ServiceCollection();
-        var config = new ConfigurationBuilder().AddInMemoryCollection(new[]
-        {
-            new KeyValuePair<string, string>("Authentication:DefaultScheme", defaultSchemeFromConfig)
-        }).Build();
-        services.AddSingleton<IConfiguration>(config);
-
-        // Act
-        services.Configure<AuthenticationOptions>(options =>
-        {
-            options.DefaultScheme = defaultSchemeFromOptions;
-        });
-        var builder = services.AddAuthentication(o =>
-        {
-            o.AddScheme<TestHandler>(defaultSchemeFromConfig, defaultSchemeFromConfig);
-            o.AddScheme<TestHandler>(defaultSchemeFromOptions, defaultSchemeFromOptions);
-        });
-        RegisterAuth(builder, _ => { });
-        var sp = services.BuildServiceProvider();
-
-        // Assert
-        var schemeProvider = sp.GetRequiredService<IAuthenticationSchemeProvider>();
-        var defaultSchemeFromServices = await schemeProvider.GetDefaultAuthenticateSchemeAsync();
-        Assert.Equal(defaultSchemeFromOptions, defaultSchemeFromServices.Name);
-
-    }
 }
diff --git a/src/Tools/dotnet-user-jwts/src/Helpers/JwtAuthenticationSchemeSettings.cs b/src/Tools/dotnet-user-jwts/src/Helpers/JwtAuthenticationSchemeSettings.cs
@@ -10,7 +10,6 @@ namespace Microsoft.AspNetCore.Authentication.JwtBearer.Tools;
 internal sealed record JwtAuthenticationSchemeSettings(string SchemeName, List<string> Audiences, string ClaimsIssuer)
 {
     private const string AuthenticationKey = "Authentication";
-    private const string DefaultSchemeKey = "DefaultScheme";
     private const string SchemesKey = "Schemes";
 
     private static readonly JsonSerializerOptions _jsonSerializerOptions = new JsonSerializerOptions
@@ -57,15 +56,6 @@ public void Save(string filePath)
             };
         }
 
-        // Set the DefaultScheme if it has not already been set
-        // and only a single scheme has been configured thus far
-        if (config[AuthenticationKey][DefaultSchemeKey] is null
-            && config[AuthenticationKey][SchemesKey] is JsonObject setSchemes
-            && setSchemes.Count == 1)
-        {
-            config[AuthenticationKey][DefaultSchemeKey] = SchemeName;
-        }
-
         using var writer = new FileStream(filePath, FileMode.Open, FileAccess.Write);
         JsonSerializer.Serialize(writer, config, _jsonSerializerOptions);
     }
@@ -80,11 +70,6 @@ public static void RemoveScheme(string filePath, string name)
             authentication[SchemesKey] is JsonObject schemes)
         {
             schemes.Remove(name);
-            if (authentication[DefaultSchemeKey] is JsonValue defaultScheme
-                && defaultScheme.GetValue<string>() == name)
-            {
-                authentication.Remove(DefaultSchemeKey);
-            }
         }
 
         using var writer = new FileStream(filePath, FileMode.Create, FileAccess.Write);
diff --git a/src/Tools/dotnet-user-jwts/test/UserJwtsTestFixture.cs b/src/Tools/dotnet-user-jwts/test/UserJwtsTestFixture.cs
@@ -62,7 +62,7 @@ public class UserJwtsTestFixture : IDisposable
   }
 }";
 
-    public string CreateProject(bool hasSecret = true, string appSettingsContent = "{}")
+    public string CreateProject(bool hasSecret = true)
     {
         var projectPath = Directory.CreateDirectory(Path.Combine(Path.GetTempPath(), "userjwtstest", Guid.NewGuid().ToString()));
         Directory.CreateDirectory(Path.Combine(projectPath.FullName, "Properties"));
@@ -81,7 +81,7 @@ public string CreateProject(bool hasSecret = true, string appSettingsContent = "
 
         File.WriteAllText(
             Path.Combine(projectPath.FullName, "appsettings.Development.json"),
-            appSettingsContent);
+            "{}");
 
         if (hasSecret)
         {
diff --git a/src/Tools/dotnet-user-jwts/test/UserJwtsTests.cs b/src/Tools/dotnet-user-jwts/test/UserJwtsTests.cs

Original file line number	Diff line number	Diff line change
`@@ -14,7 +14,6 @@ namespace Microsoft.AspNetCore.Authentication;`
`14`	`14`	`public class AuthenticationService : IAuthenticationService`
`15`	`15`	`{`
`16`	`16`	`private HashSet<ClaimsPrincipal>? _transformCache;`
`17`		`- private const string defaultSchemesOptionsMsg = "The default schemes can be set using either AddAuthentication(string defaultScheme) or AddAuthentication(Action<AuthenticationOptions> configureOptions) or by setting the Authentication:DefaultScheme property in configuration.";`
`18`	`17`
`19`	`18`	`/// <summary>`
`20`	`19`	`/// Constructor.`
`@@ -65,7 +64,7 @@ public virtual async Task<AuthenticateResult> AuthenticateAsync(HttpContext cont`
`65`	`64`	`scheme = defaultScheme?.Name;`
`66`	`65`	`if (scheme == null)`
`67`	`66`	`{`
`68`		`- throw new InvalidOperationException($"No authenticationScheme was specified, and there was no DefaultAuthenticateScheme found. {defaultSchemesOptionsMsg}");`
	`67`	`+ throw new InvalidOperationException($"No authenticationScheme was specified, and there was no DefaultAuthenticateScheme found. The default schemes can be set using either AddAuthentication(string defaultScheme) or AddAuthentication(Action<AuthenticationOptions> configureOptions).");`
`69`	`68`	`}`
`70`	`69`	`}`
`71`	`70`
`@@ -113,7 +112,7 @@ public virtual async Task ChallengeAsync(HttpContext context, string? scheme, Au`
`113`	`112`	`scheme = defaultChallengeScheme?.Name;`
`114`	`113`	`if (scheme == null)`
`115`	`114`	`{`
`116`		`- throw new InvalidOperationException($"No authenticationScheme was specified, and there was no DefaultChallengeScheme found. {defaultSchemesOptionsMsg}");`
	`115`	`+ throw new InvalidOperationException($"No authenticationScheme was specified, and there was no DefaultChallengeScheme found. The default schemes can be set using either AddAuthentication(string defaultScheme) or AddAuthentication(Action<AuthenticationOptions> configureOptions).");`
`117`	`116`	`}`
`118`	`117`	`}`
`119`	`118`
`@@ -141,7 +140,7 @@ public virtual async Task ForbidAsync(HttpContext context, string? scheme, Authe`
`141`	`140`	`scheme = defaultForbidScheme?.Name;`
`142`	`141`	`if (scheme == null)`
`143`	`142`	`{`
`144`		`- throw new InvalidOperationException($"No authenticationScheme was specified, and there was no DefaultForbidScheme found. {defaultSchemesOptionsMsg}");`
	`143`	`+ throw new InvalidOperationException($"No authenticationScheme was specified, and there was no DefaultForbidScheme found. The default schemes can be set using either AddAuthentication(string defaultScheme) or AddAuthentication(Action<AuthenticationOptions> configureOptions).");`
`145`	`144`	`}`
`146`	`145`	`}`
`147`	`146`
`@@ -187,7 +186,7 @@ public virtual async Task SignInAsync(HttpContext context, string? scheme, Claim`
`187`	`186`	`scheme = defaultScheme?.Name;`
`188`	`187`	`if (scheme == null)`
`189`	`188`	`{`
`190`		`- throw new InvalidOperationException($"No authenticationScheme was specified, and there was no DefaultSignInScheme found. {defaultSchemesOptionsMsg}");`
	`189`	`+ throw new InvalidOperationException($"No authenticationScheme was specified, and there was no DefaultSignInScheme found. The default schemes can be set using either AddAuthentication(string defaultScheme) or AddAuthentication(Action<AuthenticationOptions> configureOptions).");`
`191`	`190`	`}`
`192`	`191`	`}`
`193`	`192`
`@@ -221,7 +220,7 @@ public virtual async Task SignOutAsync(HttpContext context, string? scheme, Auth`
`221`	`220`	`scheme = defaultScheme?.Name;`
`222`	`221`	`if (scheme == null)`
`223`	`222`	`{`
`224`		`- throw new InvalidOperationException($"No authenticationScheme was specified, and there was no DefaultSignOutScheme found. {defaultSchemesOptionsMsg}");`
	`223`	`+ throw new InvalidOperationException($"No authenticationScheme was specified, and there was no DefaultSignOutScheme found. The default schemes can be set using either AddAuthentication(string defaultScheme) or AddAuthentication(Action<AuthenticationOptions> configureOptions).");`
`225`	`224`	`}`
`226`	`225`	`}`
`227`	`226`
Original file line number	Diff line number	Diff line change
`@@ -62,7 +62,7 @@ public class UserJwtsTestFixture : IDisposable`
`62`	`62`	`}`
`63`	`63`	`}";`
`64`	`64`
`65`		`- public string CreateProject(bool hasSecret = true, string appSettingsContent = "{}")`
	`65`	`+ public string CreateProject(bool hasSecret = true)`
`66`	`66`	`{`
`67`	`67`	`var projectPath = Directory.CreateDirectory(Path.Combine(Path.GetTempPath(), "userjwtstest", Guid.NewGuid().ToString()));`
`68`	`68`	`Directory.CreateDirectory(Path.Combine(projectPath.FullName, "Properties"));`
`@@ -81,7 +81,7 @@ public string CreateProject(bool hasSecret = true, string appSettingsContent = "`
`81`	`81`
`82`	`82`	`File.WriteAllText(`
`83`	`83`	`Path.Combine(projectPath.FullName, "appsettings.Development.json"),`
`84`		`- appSettingsContent);`
	`84`	`+ "{}");`
`85`	`85`
`86`	`86`	`if (hasSecret)`
`87`	`87`	`{`