Replace Windows Live authentication with Microsoft

build/update-config-next.sh

@@ -9,7 +9,7 @@ IFS=';' read -a oauthParts <<< "$OAuth"
 for part in ${oauthParts[@]}
 do
   key="$( cut -d '=' -f 1 <<< $part )"; echo "key: $key"
-  value="$( cut -d '=' -f 2- <<< $part )"; echo "value: $value"
+  value="$( cut -d '=' -f 2- <<< $part )"
 
   if [ "$key" == "FacebookId" ]; then
     FacebookAppId=$value

build/update-config.sh

@@ -10,7 +10,7 @@ IFS=';' read -a oauthParts <<< "$OAuth"
 for part in ${oauthParts[@]}
 do
   key="$( cut -d '=' -f 1 <<< $part )"; echo "key: $key"
-  value="$( cut -d '=' -f 2- <<< $part )"; echo "value: $value"
+  value="$( cut -d '=' -f 2- <<< $part )"
 
   if [ "$key" == "FacebookId" ]; then
     FacebookAppId=$value
@@ -45,7 +45,7 @@ config="
     .constant('GITHUB_APPID', '$GitHubAppId')
     .constant('GOOGLE_APPID', '$GoogleAppId')
     .constant('INTERCOM_APPID', '$IntercomAppId')
-    .constant('LIVE_APPID', '$MicrosoftAppId')
+    .constant('MICROSOFT_APPID', '$MicrosoftAppId')
     .constant('SLACK_APPID', '$SlackAppId')
     .constant('STRIPE_PUBLISHABLE_KEY', '$EX_StripePublishableApiKey')
     .constant('SYSTEM_NOTIFICATION_MESSAGE', '$EX_NotificationMessage')

src/Exceptionless.Job/appsettings.Production.yml

@@ -7,7 +7,7 @@ ConnectionStrings:
 #  Storage: ''
 #  Email: 'smtps://user:password@domain.com:587'
 #  LDAP: ''
-  OAuth: FacebookId=395178683904310;GitHubId=7ef1dd5bfbc4ccf7f5ef;GoogleId=809763155066-enkkdmt4ierc33q9cft9nf5d5c02h30q.apps.googleusercontent.com;MicrosoftId=000000004C137E8B;SlackId=34500115540.177239122322;
+  OAuth: FacebookId=395178683904310;GitHubId=7ef1dd5bfbc4ccf7f5ef;GoogleId=809763155066-enkkdmt4ierc33q9cft9nf5d5c02h30q.apps.googleusercontent.com;MicrosoftId=;SlackId=34500115540.177239122322;
 
 # Base url for the ui used to build links in emails and other places.
 BaseURL: https://be.exceptionless.io

src/Exceptionless.Job/appsettings.Staging.yml

@@ -6,7 +6,7 @@ ConnectionStrings:
 #  MessageBus: provider=redis;
 #  Queue: provider=redis;
 # Storage: provider=folder;path=.\storage=
-  OAuth: FacebookId=395178683904310;GitHubId=7ef1dd5bfbc4ccf7f5ef;GoogleId=809763155066-enkkdmt4ierc33q9cft9nf5d5c02h30q.apps.googleusercontent.com;MicrosoftId=000000004C137E8B;SlackId=34500115540.177239122322;
+  OAuth: FacebookId=395178683904310;GitHubId=7ef1dd5bfbc4ccf7f5ef;GoogleId=809763155066-enkkdmt4ierc33q9cft9nf5d5c02h30q.apps.googleusercontent.com;MicrosoftId=;SlackId=34500115540.177239122322;
 
 # Base url for the ui used to build links in emails and other places.
 BaseURL: https://dev.exceptionless.io

src/Exceptionless.Web/Api/Endpoints/AuthEndpoints.cs

@@ -151,9 +151,9 @@ headers api_key input box.
             }
         });
 
-        group.MapPost("live", async (IMediator mediator, IMediatorResultMapper<HttpIResult> resultMapper, HttpContext httpContext, [FromBody] ExternalAuthInfo value) =>
+        group.MapPost("microsoft", async (IMediator mediator, IMediatorResultMapper<HttpIResult> resultMapper, HttpContext httpContext, [FromBody] ExternalAuthInfo value) =>
         {
-            return (await mediator.InvokeAsync<Result<TokenResult>>(new AuthMessages.LiveLogin(value, httpContext))).ToHttpResult(resultMapper);
+            return (await mediator.InvokeAsync<Result<TokenResult>>(new AuthMessages.MicrosoftLogin(value, httpContext))).ToHttpResult(resultMapper);
         })
         .AllowAnonymous()
         .Accepts<ExternalAuthInfo>("application/json", "application/*+json")
@@ -164,7 +164,7 @@ headers api_key input box.
         .WithMetadata(new EndpointDocumentation {
             ResponseDescriptions = new() {
                 ["200"] = "User Authentication Token",
-                ["403"] = "Account Creation is currently disabled",
+                ["403"] = "Account creation is disabled or the existing account must be signed into before linking Microsoft",
                 ["422"] = "Validation error",
             }
         });

src/Exceptionless.Web/Api/Handlers/AuthHandler.cs

@@ -35,6 +35,10 @@ public class AuthHandler(
     TimeProvider timeProvider,
     ILogger<AuthHandler> logger)
 {
+    private sealed record ExternalLoginUser(User User, bool SendVerificationEmail);
+
+    private const string LegacyMicrosoftOAuthProvider = "WindowsLive";
+    private const string MicrosoftOAuthProvider = "Microsoft";
     private readonly ScopedCacheClient _cache = new(cacheClient, "Auth");
     private static bool _isFirstUserChecked;
     private static readonly TimeSpan IntercomJwtLifetime = TimeSpan.FromMinutes(60);
@@ -285,7 +289,7 @@ public Task<Result<TokenResult>> Handle(FacebookLogin message)
         );
     }
 
-    public Task<Result<TokenResult>> Handle(LiveLogin message)
+    public Task<Result<TokenResult>> Handle(MicrosoftLogin message)
     {
         return ExternalLoginAsync(message.AuthInfo, message.Context,
             authOptions.MicrosoftId,
@@ -532,9 +536,15 @@ private async Task<Result<TokenResult>> ExternalLoginAsync(ExternalAuthInfo auth
         }
 
         User? user;
+        bool sendVerificationEmail;
         try
         {
-            user = await FromExternalLoginAsync(userInfo, authInfo.InviteToken, httpContext);
+            var result = await FromExternalLoginAsync(userInfo, authInfo.InviteToken, httpContext);
+            if (!result.IsSuccess)
+                return Result<TokenResult>.FromResult(result);
+
+            user = result.Value.User;
+            sendVerificationEmail = result.Value.SendVerificationEmail;
         }
         catch (ApplicationException ex)
         {
@@ -550,16 +560,20 @@ private async Task<Result<TokenResult>> ExternalLoginAsync(ExternalAuthInfo auth
         if (!String.IsNullOrWhiteSpace(authInfo.InviteToken))
             await AddInvitedUserToOrganizationAsync(authInfo.InviteToken, user, httpContext);
 
+        if (sendVerificationEmail && !user.IsEmailAddressVerified)
+            await mailer.SendUserEmailVerifyAsync(user);
+
         logger.UserLoggedIn(user.EmailAddress);
         return new TokenResult { Token = await GetOrCreateAuthenticationTokenAsync(user) };
     }
 
-    private async Task<User> FromExternalLoginAsync(UserInfo userInfo, string? inviteToken, HttpContext httpContext)
+    private async Task<Result<ExternalLoginUser>> FromExternalLoginAsync(UserInfo userInfo, string? inviteToken, HttpContext httpContext)
     {
         ArgumentException.ThrowIfNullOrWhiteSpace(userInfo.Id);
         ArgumentException.ThrowIfNullOrWhiteSpace(userInfo.ProviderName);
         ArgumentException.ThrowIfNullOrWhiteSpace(userInfo.Email);
 
+        bool isMicrosoft = String.Equals(userInfo.ProviderName, MicrosoftOAuthProvider, StringComparison.OrdinalIgnoreCase);
         var existingUser = await userRepository.GetUserByOAuthProviderAsync(userInfo.ProviderName, userInfo.Id);
         using var _ = logger.BeginScope(new ExceptionlessState().Tag("External Login").Tag(userInfo.ProviderName).Identity(userInfo.Email).SetHttpContext(httpContext));
 
@@ -577,26 +591,38 @@ private async Task<User> FromExternalLoginAsync(UserInfo userInfo, string? invit
                 }
                 else
                 {
-                    return currentUser;
+                    if (RemoveLegacyMicrosoftOAuthAccounts(currentUser, userInfo.ProviderName))
+                        return new ExternalLoginUser(await userRepository.SaveAsync(currentUser, o => o.Cache()), false);
+
+                    return new ExternalLoginUser(currentUser, false);
                 }
             }
 
             currentUser.AddOAuthAccount(userInfo.ProviderName, userInfo.Id, userInfo.Email);
-            return await userRepository.SaveAsync(currentUser, o => o.Cache());
+            RemoveLegacyMicrosoftOAuthAccounts(currentUser, userInfo.ProviderName);
+            return new ExternalLoginUser(await userRepository.SaveAsync(currentUser, o => o.Cache()), false);
         }
 
         if (existingUser is not null)
         {
-            if (!existingUser.IsEmailAddressVerified)
+            bool hasChanges = RemoveLegacyMicrosoftOAuthAccounts(existingUser, userInfo.ProviderName);
+            if (!isMicrosoft && !existingUser.IsEmailAddressVerified)
             {
                 existingUser.MarkEmailAddressVerified();
-                await userRepository.SaveAsync(existingUser, o => o.Cache());
+                hasChanges = true;
             }
 
-            return existingUser;
+            if (hasChanges)
+                await userRepository.SaveAsync(existingUser, o => o.Cache());
+
+            return new ExternalLoginUser(existingUser, false);
         }
 
         var user = !String.IsNullOrEmpty(userInfo.Email) ? await userRepository.GetByEmailAddressAsync(userInfo.Email) : null;
+        // Microsoft Graph mail is editable and does not prove ownership of an existing account.
+        if (isMicrosoft && user is not null)
+            return Result.Forbidden("Sign in to your existing account first, then link Microsoft from your account settings.");
+
         if (user is null)
         {
             if (!await IsAccountCreationEnabledAsync(inviteToken))
@@ -608,15 +634,32 @@ private async Task<User> FromExternalLoginAsync(UserInfo userInfo, string? invit
             await AddGlobalAdminRoleIfFirstUserAsync(user);
         }
 
-        user.MarkEmailAddressVerified();
+        if (isMicrosoft)
+            user.ResetVerifyEmailAddressTokenAndExpiration(timeProvider);
+        else
+            user.MarkEmailAddressVerified();
         user.AddOAuthAccount(userInfo.ProviderName, userInfo.Id, userInfo.Email);
 
         if (String.IsNullOrEmpty(user.Id))
             await userRepository.AddAsync(user, o => o.Cache());
         else
             await userRepository.SaveAsync(user, o => o.Cache());
 
-        return user;
+        return new ExternalLoginUser(user, isMicrosoft);
+    }
+
+    private static bool RemoveLegacyMicrosoftOAuthAccounts(User user, string providerName)
+    {
+        if (!String.Equals(providerName, MicrosoftOAuthProvider, StringComparison.OrdinalIgnoreCase))
+            return false;
+
+        var legacyAccounts = user.OAuthAccounts
+            .Where(account => String.Equals(account.Provider, LegacyMicrosoftOAuthProvider, StringComparison.OrdinalIgnoreCase))
+            .ToArray();
+        foreach (var account in legacyAccounts)
+            user.OAuthAccounts.Remove(account);
+
+        return legacyAccounts.Length > 0;
     }
 
     private async Task<bool> IsAccountCreationEnabledAsync(string? token)

src/Exceptionless.Web/Api/Messages/AuthMessages.cs

@@ -9,7 +9,7 @@ public record SignupMessage(Signup Model, HttpContext Context);
 public record GitHubLogin(ExternalAuthInfo AuthInfo, HttpContext Context);
 public record GoogleLogin(ExternalAuthInfo AuthInfo, HttpContext Context);
 public record FacebookLogin(ExternalAuthInfo AuthInfo, HttpContext Context);
-public record LiveLogin(ExternalAuthInfo AuthInfo, HttpContext Context);
+public record MicrosoftLogin(ExternalAuthInfo AuthInfo, HttpContext Context);
 public record RemoveExternalLogin(string ProviderName, ValueFromBody<string> ProviderUserId, HttpContext Context);
 public record ChangePassword(ChangePasswordModel Model, HttpContext Context);
 public record CheckEmailAddress(string Email, HttpContext Context);

src/Exceptionless.Web/ClientApp.angular/app.config.js

@@ -10,7 +10,7 @@
         .constant("GITHUB_APPID")
         .constant("GOOGLE_APPID")
         .constant("INTERCOM_APPID")
-        .constant("LIVE_APPID")
+        .constant("MICROSOFT_APPID")
         .constant("SLACK_APPID")
         .constant("STRIPE_PUBLISHABLE_KEY")
         .constant("SYSTEM_NOTIFICATION_MESSAGE")

src/Exceptionless.Web/ClientApp.angular/app/account/manage-controller.js

@@ -14,7 +14,7 @@
                 FACEBOOK_APPID,
                 GOOGLE_APPID,
                 GITHUB_APPID,
-                LIVE_APPID,
+                MICROSOFT_APPID,
                 notificationService,
                 projectService,
                 userService,
@@ -194,7 +194,7 @@
 
                 function isExternalLoginEnabled(provider) {
                     if (!provider) {
-                        return !!FACEBOOK_APPID || !!GITHUB_APPID || !!GOOGLE_APPID || !!LIVE_APPID;
+                        return !!FACEBOOK_APPID || !!GITHUB_APPID || !!GOOGLE_APPID || !!MICROSOFT_APPID;
                     }
 
                     switch (provider) {
@@ -204,8 +204,8 @@
                             return !!GITHUB_APPID;
                         case "google":
                             return !!GOOGLE_APPID;
-                        case "live":
-                            return !!LIVE_APPID;
+                        case "microsoft":
+                            return !!MICROSOFT_APPID;
                         default:
                             return false;
                     }

src/Exceptionless.Web/ClientApp.angular/app/account/manage.tpl.html

@@ -339,8 +339,8 @@ <h4>{{::'Add an external login' | translate}}</h4>
                                 <button
                                     type="button"
                                     role="button"
-                                    ng-click="vm.authenticate('live')"
-                                    ng-if="vm.isExternalLoginEnabled('live')"
+                                    ng-click="vm.authenticate('microsoft')"
+                                    ng-if="vm.isExternalLoginEnabled('microsoft')"
                                     class="btn btn-large image-button icon-login-microsoft"
                                     title="{{::'Log in using your Microsoft account' | translate}}"
                                 ></button>

src/Exceptionless.Web/ClientApp.angular/app/auth/auth.js

@@ -1,6 +1,19 @@
 (function () {
     "use strict";
 
+    function createOAuthState() {
+        if (typeof window.crypto.randomUUID === "function") {
+            return window.crypto.randomUUID();
+        }
+
+        var bytes = window.crypto.getRandomValues(new Uint8Array(16));
+        return Array.prototype.map
+            .call(bytes, function (value) {
+                return ("0" + value.toString(16)).slice(-2);
+            })
+            .join("");
+    }
+
     angular
         .module("app.auth", [
             "directives.inputMatch",
@@ -20,8 +33,39 @@
             "exceptionless.validators",
         ])
         .config(
-            function ($authProvider, $stateProvider, BASE_URL, FACEBOOK_APPID, GOOGLE_APPID, GITHUB_APPID, LIVE_APPID) {
+            function (
+                $authProvider,
+                $httpProvider,
+                $stateProvider,
+                BASE_URL,
+                FACEBOOK_APPID,
+                GOOGLE_APPID,
+                GITHUB_APPID,
+                MICROSOFT_APPID
+            ) {
                 $authProvider.baseUrl = BASE_URL + "/api/v2";
+                var microsoftLoginUrl = BASE_URL.replace(/\/$/, "") + "/api/v2/auth/microsoft";
+                $httpProvider.interceptors.push(function ($q, SatellizerStorage) {
+                    return {
+                        request: function (config) {
+                            if (config.method !== "POST" || config.url !== microsoftLoginUrl) {
+                                return config;
+                            }
+
+                            var expectedState = SatellizerStorage.get("microsoft_state");
+                            if (!expectedState || !config.data || config.data.state !== expectedState) {
+                                return $q.reject({
+                                    status: 400,
+                                    data: { message: "Microsoft authentication state is missing or invalid." },
+                                });
+                            }
+
+                            SatellizerStorage.remove("microsoft_state");
+                            return config;
+                        },
+                    };
+                });
+
                 $authProvider.facebook({
                     clientId: FACEBOOK_APPID,
                 });
@@ -34,9 +78,19 @@
                     clientId: GITHUB_APPID,
                 });
 
-                $authProvider.live({
-                    clientId: LIVE_APPID,
-                    scope: ["wl.emails"],
+                $authProvider.oauth2({
+                    name: "microsoft",
+                    url: "/auth/microsoft",
+                    authorizationEndpoint: "https://login.microsoftonline.com/common/oauth2/v2.0/authorize",
+                    clientId: MICROSOFT_APPID,
+                    redirectUri: window.location.origin,
+                    requiredUrlParams: ["scope", "state"],
+                    scope: ["User.Read"],
+                    scopeDelimiter: " ",
+                    state: function () {
+                        return createOAuthState();
+                    },
+                    popupOptions: { width: 500, height: 560 },
                 });
 
                 $stateProvider.state("auth", {

src/Exceptionless.Web/ClientApp.angular/app/auth/login-controller.js

@@ -15,7 +15,7 @@
                 FACEBOOK_APPID,
                 GOOGLE_APPID,
                 GITHUB_APPID,
-                LIVE_APPID,
+                MICROSOFT_APPID,
                 ENABLE_ACCOUNT_CREATION,
                 notificationService,
                 projectService,
@@ -64,7 +64,7 @@
 
                 function isExternalLoginEnabled(provider) {
                     if (!provider) {
-                        return !!FACEBOOK_APPID || !!GITHUB_APPID || !!GOOGLE_APPID || !!LIVE_APPID;
+                        return !!FACEBOOK_APPID || !!GITHUB_APPID || !!GOOGLE_APPID || !!MICROSOFT_APPID;
                     }
 
                     switch (provider) {
@@ -74,8 +74,8 @@
                             return !!GITHUB_APPID;
                         case "google":
                             return !!GOOGLE_APPID;
-                        case "live":
-                            return !!LIVE_APPID;
+                        case "microsoft":
+                            return !!MICROSOFT_APPID;
                         default:
                             return false;
                     }

src/Exceptionless.Web/ClientApp.angular/app/auth/login.tpl.html

@@ -32,8 +32,8 @@ <h4>
                                         <button
                                             type="button"
                                             role="button"
-                                            ng-click="vm.authenticate('live')"
-                                            ng-if="vm.isExternalLoginEnabled('live')"
+                                            ng-click="vm.authenticate('microsoft')"
+                                            ng-if="vm.isExternalLoginEnabled('microsoft')"
                                             class="btn btn-large image-button icon-login-microsoft"
                                             title="{{::'Log in using your Microsoft account' | translate}}"
                                         ></button>