Skip to content

[3.x] Handle missing scope and app permission configuration - #4045

Merged
Iarek Kovtunenko (iarekk) merged 2 commits into
rel/3vfrom
iinglese/3x-authorization-config-validation
Sep 14, 2026
Merged

Iarek Kovtunenko (iarekk) merged 2 commits into
rel/3vfrom
iinglese/3x-authorization-config-validation

Conversation

@iNinja

Copy link
Copy Markdown
Contributor

Summary

  • Backport Handle missing scope and app permission configuration #4010 to the 3.x servicing branch.
  • Treat explicitly declared but unresolved scope or app-permission configuration as empty requirements.
  • Preserve existing behavior when no configuration key is declared.
  • Preserve independent scope-or-app-permission OR evaluation.

Release notes

Authorization now fails when a declared scope or app-permission configuration key
cannot be resolved. Applications that do not declare a configuration key retain
their existing behavior.

Testing

  • 28 focused tests passed on each of .NET 6, .NET 7, .NET 8, and .NET 9.
  • Microsoft.Identity.Web built successfully across its configured target frameworks.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@iNinja
Ignacio Inglese (iNinja) requested a review from a team as a code owner September 14, 2026 14:49
@iarekk
Iarek Kovtunenko (iarekk) requested a review from a team as a code owner September 14, 2026 17:43
@iarekk
Iarek Kovtunenko (iarekk) merged commit bead99a into rel/3v Sep 14, 2026
6 checks passed
@iarekk
Iarek Kovtunenko (iarekk) deleted the iinglese/3x-authorization-config-validation branch September 14, 2026 17:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants