Îõ³h&Ǹ٠     !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWX Safe-Inferred"8;?Ñãms-auth3Possible exception states of authentication requestYms-authìdecoded claims from the JWT token, valid (at least) for the Google OpenID implementation as of February 2021ms-auth/intended audience of the token (== API key ID ) ms-authsub field ms-authDecode a string into a Zms-auth subms-auth expms-auth nbfms-auth emailms-auth aud[ms-authDecode and validate the aud, \ and nbf fields of the JWT]ms-auth Validate the aud, \ and nbf fields^ms-auth Fails if the \iry field is not at least nsecs seconds in the future_ms-auth(Fails if the current time is before the nbf time (= token is not yet valid)`ms-auth Fails if the aud4ience field is not equal to the supplied ApiAudiencems-auth current timems-auth current time[ms-authÍintended token audience (its meaning depends on the OAuth identity provider )ms-authÊbuffer period to allow for API roundtrip delays (defaults to 0 if Nothing)ms-auth;JWT-encoded string, e.g. the contents of the id_token field]ms-authÍintended token audience (its meaning depends on the OAuth identity provider )^ms-authdefaults to 0 if Nothing`ms-auth/intended audience of the token (== API key ID )ms-authdecoded from the JWT    Safe-Inferred"%&1;?ÌÑÚèï ø 3ms-auth Éhttps://learn.microsoft.com/en-us/azure/active-directory/develop/userinfo4ms-auth.Configuration object of the OAuth2 application6ms-authapplication name7ms-authapp client ID : see $https://stackoverflow.com/a/706709618ms-authapp client secret "9ms-authOAuth2 and OIDC scopes:ms-authOAuth2 state (a random string,  4https://www.rfc-editor.org/rfc/rfc6749#section-10.12 );ms-authOAuth2 redirect URI=ms-auth7Azure OAuth application (i.e. with user consent screen) NB : scope offline_access is ALWAYS requestedcreate app at /https://go.microsoft.com/fwlink/?linkid=20839080also be aware to find the right client id. see $https://stackoverflow.com/a/70670961>ms-auth7Azure OAuth application (i.e. with user consent screen) NB : scopes openid and offline_accessÞ are ALWAYS requested since the library assumes we have access to refresh tokens and ID tokens+Reference on Microsoft Graph permissions : =https://learn.microsoft.com/en-us/graph/permissions-referencecreate app at /https://go.microsoft.com/fwlink/?linkid=20839080also be aware to find the right client id. see $https://stackoverflow.com/a/70670961ams-auth Îhttps://login.microsoftonline.com/common/v2.0/.well-known/openid-configuration=ms-authapplication namems-authscopes>ms-authOAuth configuration 3456789:;<=> <=456789:;3> Safe-Inferred "16;?ÌÑÚã”Ems-authtransactional token storebms-auth The JWT identity token from the X-MS-TOKEN-AAD-ID-TOKENà header injected by App Service can be decoded for its claims e.g. sub0 (which is unique for each user for a given app) ähttps://bogdan.bynapse.com/azure/the-app-service-token-store-was-added-to-app-service-authentication-authorization-and-it-is-a-repository-of-oauth-tokens-associated-with-your-app-users-when-a-user-logs-into-your-app-via-an-iden/ Ðhttps://stackoverflow.com/questions/46757665/authentication-for-azure-functions/Ims-auth'Decode the App Service ID token header X-MS-TOKEN-AAD-ID-TOKEN:, look its user up in the local token store, supply token t to continuation. If the user subÏ cannot be found in the token store the browser is redirected to the login URI.Special case of bMms-authÖFetch an OAuth token and keep it updated. Should be called as a first thing in the app%NB : forks a thread in the background âhttps://learn.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-client-creds-grant-flowNms-authLogin endpointsee =cms-authlogin endpoint handlerOms-auth2The identity provider redirects the client to the reply& endpoint as part of the OAuth flow : éhttps://learn.microsoft.com/en-us/graph/auth-v2-user?view=graph-rest-1.0&tabs=http#authorization-responseÆNB : forks a thread per logged in user to keep their tokens up to datedms-authå1) the ExchangeToken arrives with the redirect once the user has approved the scopes in the browser éhttps://learn.microsoft.com/en-us/graph/auth-v2-user?view=graph-rest-1.0&tabs=http#authorization-responseems-auth72) fork a thread and start token refresh loop for user uidfms-auth Insert or update a token in the E objectPms-auth?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnoð&ms-auth-0.1.0.0-EuTDDsRmOO22dXIsHerdJHNetwork.OAuth2.JWTNetwork.OAuth2.Provider.AzureADNetwork.OAuth2.Session JWTExceptionJEMalformedJWTJEClaimNotFoundJEAudienceNotFoundJEExpiredToken JENotYetValid JENoToken ApiAudience apiAudience UserEmail userEmailUserSubuserSub jwtClaims decValidSub decValidExp decValidNbf decValidEmail decValidAud$fToJSONApiAudience$fToJSONJWTException$fExceptionJWTException$fShowJWTException$fEqJWTException$fOrdJWTException$fGenericJWTException $fEqJWTClaims$fShowJWTClaims$fEqApiAudience$fOrdApiAudience$fShowApiAudience$fGenericApiAudience$fIsStringApiAudience $fEqUserEmail$fOrdUserEmail$fGenericUserEmail$fIsStringUserEmail$fShowUserEmail$fToJSONUserEmail$fFromJSONUserEmail$fToJSONKeyUserEmail$fFromJSONKeyUserEmail $fEqUserSub $fOrdUserSub$fGenericUserSub$fIsStringUserSub $fShowUserSub$fToJSONUserSub$fFromJSONUserSub$fToJSONKeyUserSub$fFromJSONKeyUserSub AzureADUserOAuthCfg$sel:oacAppName:OAuthCfg$sel:oacClientId:OAuthCfg$sel:oacClientSecret:OAuthCfg$sel:oacScopes:OAuthCfg$sel:oacAuthState:OAuthCfg$sel:oacRedirectURI:OAuthCfgAzureAD azureADAppazureOAuthADApp$fFromJSONAzureADUser$fEqAzureADUser$fOrdAzureADUser$fShowAzureADUser $fEqAzureAD $fShowAzureADTokensTokenScottyAction withAADUser newNoToken expireToken readTokenfetchUpdateToken loginEndpoint replyEndpoint expireUser lookupUser tokensToList newTokens$fShowOAuthSessionError$fExceptionOAuthSessionError$fEqTokensData$fShowTokensData$fEqOAuthSessionError JWTClaims!jwt-0.11.0-EQ9sh3Lfdp0EfTUWL0sI0OWeb.JWT JWTClaimsSetdecodeValidateJWTbase GHC.Floatexp validateJWT validateExp validateNbf validateAuddefaultAzureADIdpaadHeaderIdTokenloginHfetchUpdateTokenDelegrefreshLoopDeleg upsertTokendecValidIdTokenexcepttToActionM