{"action":"created","issue":{"url":"https://api.github.com/repos/ironmansoftware/universal-dashboard/issues/378","repository_url":"https://api.github.com/repos/ironmansoftware/universal-dashboard","labels_url":"https://api.github.com/repos/ironmansoftware/universal-dashboard/issues/378/labels{/name}","comments_url":"https://api.github.com/repos/ironmansoftware/universal-dashboard/issues/378/comments","events_url":"https://api.github.com/repos/ironmansoftware/universal-dashboard/issues/378/events","html_url":"https://github.com/ironmansoftware/universal-dashboard/issues/378","id":363735419,"node_id":"MDU6SXNzdWUzNjM3MzU0MTk=","number":378,"title":"AuthorizationPolicy and AuthorizedRole not working.","user":{"login":"gerane","id":6662208,"node_id":"MDQ6VXNlcjY2NjIyMDg=","avatar_url":"https://avatars0.githubusercontent.com/u/6662208?v=4","gravatar_id":"","url":"https://api.github.com/users/gerane","html_url":"https://github.com/gerane","followers_url":"https://api.github.com/users/gerane/followers","following_url":"https://api.github.com/users/gerane/following{/other_user}","gists_url":"https://api.github.com/users/gerane/gists{/gist_id}","starred_url":"https://api.github.com/users/gerane/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gerane/subscriptions","organizations_url":"https://api.github.com/users/gerane/orgs","repos_url":"https://api.github.com/users/gerane/repos","events_url":"https://api.github.com/users/gerane/events{/privacy}","received_events_url":"https://api.github.com/users/gerane/received_events","type":"User","site_admin":false},"labels":[{"id":806338688,"node_id":"MDU6TGFiZWw4MDYzMzg2ODg=","url":"https://api.github.com/repos/ironmansoftware/universal-dashboard/labels/bug","name":"bug","color":"ee0701","default":true},{"id":997562580,"node_id":"MDU6TGFiZWw5OTc1NjI1ODA=","url":"https://api.github.com/repos/ironmansoftware/universal-dashboard/labels/enterprise","name":"enterprise","color":"8af940","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":6,"created_at":"2018-09-25T19:38:45Z","updated_at":"2018-11-13T15:13:07Z","closed_at":null,"author_association":"NONE","body":"Version: 2.0.1\r\n\r\n I am trying to get the Authorized Roles working with AzureAD, but they are either ignored or cause errors.\r\n\r\nHere is the basic setup.\r\n\r\n[Example Setup Gist](https://gist.github.com/gerane/7c6e5e5f972fb6189c738c9dad9ee763)\r\n\r\n# New-UDPage\r\n## Example 1\r\nIf I do the following, no auth is respected. All users can access everything and login.\r\n\r\n```powershell\r\nNew-UDPage -Name \"Home\" -Icon home -AuthorizedRole Login -Content {\r\n\r\n}\r\n```\r\n\r\n## Example 2\r\nIf I do the following using `AuthorizationPolicy` and the string name of a policy, the server errors and returns only white pages.\r\n\r\n```powershell\r\nNew-UDPage -Name \"Home\" -Icon home -AuthorizationPolicy Login -Content {\r\n\r\n}\r\n```\r\n\r\nErrors in logs\r\n\r\n```txt\r\n14:08:30 Microsoft.AspNetCore.Authorization.DefaultAuthorizationService Authorization failed.\r\n14:08:30 Microsoft.AspNetCore.Authorization.DefaultAuthorizationService Authorization failed.\r\n14:08:30 Microsoft.AspNetCore.Mvc.Internal.ControllerActionInvoker Authorization failed for the request at filter 'Microsoft.AspNetCore.Mvc.Authorization.AuthorizeFilter'.\r\n14:08:30 Microsoft.AspNetCore.Mvc.Internal.ControllerActionInvoker Authorization failed for the request at filter 'Microsoft.AspNetCore.Mvc.Authorization.AuthorizeFilter'.\r\n14:08:30 Microsoft.AspNetCore.Mvc.ChallengeResult Executing ChallengeResult with authentication schemes ().\r\n14:08:30 Microsoft.AspNetCore.Mvc.ChallengeResult Executing ChallengeResult with authentication schemes ().\r\n14:08:30 Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationHandler AuthenticationScheme: Cookies was challenged.\r\n14:08:30 Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationHandler AuthenticationScheme: Cookies was challenged.\r\n14:08:30 Microsoft.AspNetCore.Mvc.Internal.ControllerActionInvoker Executed action UniversalDashboard.Controllers.DashboardController.Index (UniversalDashboard) in 79.5276ms\r\n14:08:30 Microsoft.AspNetCore.Mvc.Internal.ControllerActionInvoker Executed action UniversalDashboard.Controllers.DashboardController.Theme (UniversalDashboard) in 92.468ms\r\n14:08:30 Microsoft.AspNetCore.Mvc.Internal.ControllerActionInvoker Route matched with {action = \"Index\", controller = \"Redirect\", area = \"\", page = \"\"}. Executing action UniversalDashboard.Controllers.RedirectController.Index (UniversalDashboard)\r\n14:08:31 Microsoft.AspNetCore.Mvc.Internal.ControllerActionInvoker Route matched with {action = \"Index\", controller = \"Redirect\", area = \"\", page = \"\"}. Executing action UniversalDashboard.Controllers.RedirectController.Index (UniversalDashboard)\r\n14:08:31 Microsoft.AspNetCore.Mvc.Internal.ControllerActionInvoker Executing action method UniversalDashboard.Controllers.RedirectController.Index (UniversalDashboard) with arguments (401) - Validation state: Valid\r\n14:08:31 Microsoft.AspNetCore.Mvc.Internal.ControllerActionInvoker Executing action method UniversalDashboard.Controllers.RedirectController.Index (UniversalDashboard) with arguments (401) - Validation state: Valid\r\n14:08:31 Microsoft.AspNetCore.Mvc.Internal.ControllerActionInvoker Executed action method UniversalDashboard.Controllers.RedirectController.Index (UniversalDashboard), returned result Microsoft.AspNetCore.Mvc.PhysicalFileResult in 0.0739ms.\r\n14:08:31 Microsoft.AspNetCore.Mvc.Internal.ControllerActionInvoker Executed action method UniversalDashboard.Controllers.RedirectController.Index (UniversalDashboard), returned result Microsoft.AspNetCore.Mvc.PhysicalFileResult in 0.0724ms.\r\n14:08:31 Microsoft.AspNetCore.Mvc.Infrastructure.PhysicalFileResultExecutor Executing Microsoft.AspNetCore.Mvc.PhysicalFileResult, sending file 'C:\\Program Files\\WindowsPowerShell\\Modules\\UniversalDashboard\\2.0.1\\net471\\..\\client/index.html' with download name '' ...\r\n14:08:31 Microsoft.AspNetCore.Mvc.Infrastructure.PhysicalFileResultExecutor Executing Microsoft.AspNetCore.Mvc.PhysicalFileResult, sending file 'C:\\Program Files\\WindowsPowerShell\\Modules\\UniversalDashboard\\2.0.1\\net471\\..\\client/index.html' with download name '' ...\r\n14:08:31 Microsoft.AspNetCore.Mvc.Internal.ControllerActionInvoker Executed action UniversalDashboard.Controllers.RedirectController.Index (UniversalDashboard) in 49.4402ms\r\n14:08:31 Microsoft.AspNetCore.Mvc.Internal.ControllerActionInvoker Executed action UniversalDashboard.Controllers.RedirectController.Index (UniversalDashboard) in 69.0533ms\r\n```\r\n\r\nWhen AzureAD is challenged, the page isn't redirecting properly. Normally this would redirect to \"/home\", but when `AuthorizationPolicy` is used like this it redirects to a white page at \"/\"\r\n\r\n```\r\n14:08:32 Microsoft.AspNetCore.Mvc.ChallengeResult Executing ChallengeResult with authentication schemes (AzureAD).\r\n14:08:33 Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler AuthenticationScheme: AzureADOpenID was challenged.\r\n14:08:33 Microsoft.AspNetCore.Mvc.Internal.ControllerActionInvoker Executed action UniversalDashboard.Controllers.AuthenticationController.SignIn (UniversalDashboard) in 500.4674ms\r\n14:08:33 Microsoft.AspNetCore.Hosting.Internal.WebHost Request finished in 548.3859ms 302 \r\n14:08:49 Microsoft.AspNetCore.Hosting.Internal.WebHost Request starting HTTP/1.1 POST http://localhost:10001/signin-oidc application/x-www-form-urlencoded 1928\r\n14:08:49 Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationHandler AuthenticationScheme: Cookies signed in.\r\n14:08:49 Microsoft.AspNetCore.Hosting.Internal.WebHost Request finished in 198.9174ms 302 \r\n14:08:49 Microsoft.AspNetCore.Hosting.Internal.WebHost Request starting HTTP/1.1 GET http://localhost:10001/signin  \r\n14:08:49 Microsoft.AspNetCore.Mvc.Internal.ControllerActionInvoker Route matched with {action = \"SignIn\", controller = \"Authentication\", area = \"\", page = \"\"}. Executing action UniversalDashboard.Controllers.AuthenticationController.SignIn (UniversalDashboard)\r\n14:08:49 Microsoft.AspNetCore.Mvc.Internal.ControllerActionInvoker Executing action method UniversalDashboard.Controllers.AuthenticationController.SignIn (UniversalDashboard) - Validation state: Valid\r\n14:08:49 Microsoft.AspNetCore.Mvc.Internal.ControllerActionInvoker Executed action method UniversalDashboard.Controllers.AuthenticationController.SignIn (UniversalDashboard), returned result Microsoft.AspNetCore.Mvc.RedirectResult in 1.1531ms.\r\n14:08:49 Microsoft.AspNetCore.Mvc.Infrastructure.RedirectResultExecutor Executing RedirectResult, redirecting to /.\r\n```\r\n\r\nThen later you see there errors in the logs.\r\n\r\n```txt\r\n14:08:50 DashboardController Failed to evaluate authorization policy. The term '​' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again.\r\n```\r\n\r\n```txt\r\n14:08:50 Microsoft.AspNetCore.Server.Kestrel Connection id \"XXXXXXXXXXXX\", Request id \"XXXXXXXXXXXX:XXXXXXX\": An unhandled exception was thrown by the application.\r\n```\r\n\r\n## Example 3\r\nIf I do the following using `AuthorizationPolicy` and a policy object, the server has almost the same errors as above and returns only white pages. \r\n\r\n```powershell\r\nNew-UDPage -Name \"Home\" -Icon home -AuthorizationPolicy $LoginPolicy -Content {\r\n\r\n}\r\n```\r\n\r\nAny use of `AuthorizationPolicy` leads to the errors and white screens. The logs for this example look the same as when using the string name instead of object, except the \"DashboardController Failed to evaluate authorization policy\" error was not present.\r\n\r\n# New-UDLoginPage\r\n\r\nI can't seem to get any sort of Role to work with the `New-UDLoginPage` command. If I login with a user that isn't in the \"APP_PSDashboard_UsersLogin_Allowed\" group, they are able to login without issue.\r\n\r\n```powershell\r\n$MicrosoftLogin = New-UDAuthenticationMethod -ClientId \"blah\" -Instance 'https://login.microsoftonline.com' -Domain 'blah' -TenantId 'blah'\r\n\r\n$AuthorizationPolicy = New-UDAuthorizationPolicy -Name \"Login\" -Endpoint {\r\n    param($User)\r\n​\r\n    $User.HasClaim(\"groups\", \"APP_PSDashboard_UsersLogin_Allowed\")\r\n}\r\n\r\nNew-UDLoginPage -AuthenticationMethod $MicrosoftLogin -AuthorizationPolicy $AuthorizationPolicy\r\n```\r\n\r\nWhen the page is in a broken state and viewing a white page, the view source body looks like the following.\r\n\r\n```html\r\n<body>\r\n    <div id=\"app\" class=\"app\">\r\n        <div class=\"ud-dashboard\">\r\n            <div class=\"loadingWrapper\" style=\"height: 100%; width: 100%; display: flex;\">\r\n                <div class=\"row\" style=\"height: 90vh; min-height: 90vh; display: none;\">\r\n                    <div class=\"valign-wrapper center-align\" style=\"height: 90vh;\">\r\n                        <div>\r\n                            <h1>PowerShell Universal Dashboard</h1>\r\n                           <div class=\"progress\">\r\n                                <div class=\"indeterminate\"></div>\r\n                            </div>\r\n                        </div>\r\n                    </div>\r\n                </div>\r\n            </div>\r\n        </div>\r\n    </div>\r\n    <div class=\"hiddendiv common\"></div>\r\n</body>\r\n```\r\n"},"comment":{"url":"https://api.github.com/repos/ironmansoftware/universal-dashboard/issues/comments/438301230","html_url":"https://github.com/ironmansoftware/universal-dashboard/issues/378#issuecomment-438301230","issue_url":"https://api.github.com/repos/ironmansoftware/universal-dashboard/issues/378","id":438301230,"node_id":"MDEyOklzc3VlQ29tbWVudDQzODMwMTIzMA==","user":{"login":"neossian","id":1648915,"node_id":"MDQ6VXNlcjE2NDg5MTU=","avatar_url":"https://avatars3.githubusercontent.com/u/1648915?v=4","gravatar_id":"","url":"https://api.github.com/users/neossian","html_url":"https://github.com/neossian","followers_url":"https://api.github.com/users/neossian/followers","following_url":"https://api.github.com/users/neossian/following{/other_user}","gists_url":"https://api.github.com/users/neossian/gists{/gist_id}","starred_url":"https://api.github.com/users/neossian/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/neossian/subscriptions","organizations_url":"https://api.github.com/users/neossian/orgs","repos_url":"https://api.github.com/users/neossian/repos","events_url":"https://api.github.com/users/neossian/events{/privacy}","received_events_url":"https://api.github.com/users/neossian/received_events","type":"User","site_admin":false},"created_at":"2018-11-13T15:13:07Z","updated_at":"2018-11-13T15:13:07Z","author_association":"NONE","body":"I have the same issue using Version 2.1.0 using your code as a template - I have added wait-debugger to the authorization policy.\r\n\r\nWith -AllowHTTPForLogin I get the login screen but login keeps looping back to the login screen and never hits the Wait-debugger\r\n\r\nWith a -certificate I get the error \"cannot read property of 'url' of underfined\" shown by @gerane. No login page appears - this is true without any Authorization policy\r\n"}}
{"actor":{"display_login":"neossian"}}