3 ms·
ohhhh the gifts multi-tenant app authorization keeps giving! (laid off) Microsoft PM here that worked on the patch described as a result of the research from W
by medhir 1y ago
ohhhh the gifts multi-tenant app authorization keeps giving!
(laid off) Microsoft PM here that worked on the patch described as a result of the research from Wiz.
One correction I’d like to suggest to the article: the guidance given is to check either the “iss” or “tid” claim when authorizing multi-tenant apps.
The actual recommended guidance we provided is slightly more involved. There is a chance that when only validating the tenant, any service principal could be granted authorized access.
You should always validate the subject in addition to validating the tenant for the token being authorized. One method for this would be to validate the token using a combined key (for example, tid+oid) or perform checks on both the tenant and subject before authorizing access. More info can be found here:
https://learn.microsoft.com/en-us/entra/identity-platform/claims-validation?_gl=1*qakqci*_gcl_au*MzU5NjMzMTg2LjE3NTQ3ODMyMTI.#validate-the-subject https://learn.microsoft.com/en-us/entra/identity-platform/cl...
- reactordev 1y agoAssume every token is forged. Secure by default. Even if it wastes cpu, validate each and every field. Signatures only work if verified. While you're at it, validate it against your identity database as well. Double check, triple check if you must. This is what I taught my devs. Tenant, User, Group, Resource - validate it all before allowing it through.
- Permik 1y agoAlso knowing the difference between authentication and authorization is crucial and should not be forgotten.
- xtajv 1y agoUsage of the slang "auth" is my current favorite indicator of complete cryptographic snakeoil.
- 8note 1y agoalso assume that the valid credentials have been stolen and are being used by a hacker. make sure anything done in a session can be undone as part of sanitizing the user
- JB_Dev 1y agoYou are 100% correct but really these engineers should go read the guidance - it’s pretty clear what is required: https://learn.microsoft.com/en-us/entra/identity-platform/claims-validation https://learn.microsoft.com/en-us/entra/identity-platform/cl...
- sidewndr46 1y agoHow is their "guidance" on what to check? Shouldn't it be a yes / no type thing? I've never worked on a system that had some checkbox for permissions that was labelled something like "maybe users in this group should be able to read everyone's personal notes".