v4.1.1-preview-240816-18

Adding specific target versions of .NET to ensure the correct Microsoft.IdentityModel package is referenced for consuming projects.

v4.1.1-preview-240719-1

During authentication not all available information is stored in the user identity/the service principal. Normally ASP.NET stores the full authentication result (AuthenticateResult) in a feature via HttpContext.Features. This PR adds support for storing the authenticate result in the HttpContext. This should promote maximum compatibility with other authentication/authorization middleware designed to use these features.

The AuthenticateResult is also stored in the FunctionContext.Features for ease of use.

v4.1.0

• [Breaking] Removing support for Bearer scheme and adding FunctionsBearer

  Recent security updates in the Azure Functions runtime are clashing with the use of the default, well known Bearer scheme.
  
  One of the effects of this change is the portal not able to interact with the functions app to retrieve runtime information and in some cases not able to retrieve functions information.
  In the past this was not an issue and application was able to replace the default Bearer configuration to enable the functionality provided by this package.
  
  Starting from this version, using the default AddJwtBearer with no custom name, will produce an error. You will have 2 options: you can switch your app to use AddJwtFunctionsBearer method without providing any name which will map your configuration to the FunctionsBearer scheme, or you can use AddJwtBearer("<your-custom-scheme>", ...) to specify something different.

v4.1.0-preview-240521-1

• [Breaking] Removing support for Bearer scheme and adding FunctionsBearer

  Recent security updates in the Azure Functions runtime are clashing with the use of the default, well known Bearer scheme.
  
  One of the effects of this change is the portal not able to interact with the functions app to retrieve runtime information and in some cases not able to retrieve functions information.
  In the past this was not an issue and application was able to replace the default Bearer configuration to enable the functionality provided by this package.
  
  Starting from this version, using the default AddJwtBearer with no custom name, will produce an error. You will have 2 options: you can switch your app to use AddJwtFunctionsBearer method without providing any name which will map your configuration to the FunctionsBearer scheme, or you can use AddJwtBearer("<your-custom-scheme>", ...) to specify something different.

v4.0.1

Deprecating DarkLoop.Azure.Functions.Authorize and renaming it DarkLoop.Azure.Functions.Authorization.InProcess

v4.0.0

4.0.0

Starting from 4.0.0, support for Azure Functions V4 Isolated mode with ASPNET Core integration is added.
The package is now split into two separate packages, one for each mode.

The package for Azure Functions V3+ In-Proc mode is now called DarkLoop.Azure.Functions.Authorization.InProcess and the package for Azure Functions V4 Isolated mode with ASPNET Core integration is called DarkLoop.Azure.Functions.Authorize.Isolated.

• .NET 6 support

  Starting with version 4.0.0, the package is now targeting .NET 6.0. This means that the package is no longer compatible with .NET 5 or lower. If you are using .NET 5 or lower, you should use version 3.1.3 of the package.

• DarkLoop.Azure.Functions.Authorize v4.0.0

  This package is published but is now deprecated in favor of DarkLoop.Azure.Functions.Authorization.InProcess. All it's functionality remains the same. It's just a way to keep package naming in sync.

• Introducing IFunctionsAuthorizationProvider interface

  The IFunctionsAuthorizationProvider interface is introduced to allow for custom authorization filter provisioning to the framework.
  By default the framework relies on decorating the function or type with [FunctionAuthorize]. You could skip this decoration and provide the middleware with an authorization filter sourced from your own mechanism, for example a database.
  At this moment this can be done only with Isolated mode even when the interface is defined in the shared package.
  
  Support for In-Process will be added in a future version, once source generators are introduced, as the in-process framework relies on Invocation Filters to enable authorization.
  Replacing the service in the application services would break the authorization for in-process mode at this point.

v4.0.0-preview-240319-1

Final preview version before release of v4.0.0

Includes:

• Bug fix on app reporting 500 status instead of 401 or 403 when deployed to Azure (#38)

v4.0.0-preview-240311-16

• Fixing bug where authorization is not handled due to not having scheme in formation in authorize data
• Multiple optimizations
• Adding tests

v4.0.0-preview-240304-38

Refactoring project to welcome Azure Functions Isolated model with ASP.NET Core integration

v3.1.3

• Support for disabling FunctionAuthorize effect at the application level.

  Adding support for disabling the effect of [FunctionAuthorize] attribute at the application level.
  This is useful when wanting to disable authorization for a specific environment, such as local development.

• Remove Functions bult-in JwtBearer configuration by default

  Azure Functions recently added configuration for issuer and audience validation for the default authentication flows, not the one supported by this package through FunctionAuthorizeAttribute, which interferes with token validation when using our own Bearer scheme token configuration.
  In prior versions, this package has functionality to clear Functions built-in configuration, but it was not enabled by default when using AddJwtBearer(Action<JwtBearerOptions> configure, bool removeBuiltInConfig = false). Since the use of this package is commonly used for custom JWT token, the default value of removeBuiltInConfig is now true.