Add checks to protect the internal claims used by MIW. Ref: issue #2968

src/Microsoft.Identity.Web.OWIN/AppBuilderExtension.cs

@@ -175,6 +175,23 @@ public static IAppBuilder AddMicrosoftIdentityWebApp(
 
                                 if (clientInfoFromServer != null && clientInfoFromServer.UniqueTenantIdentifier != null && clientInfoFromServer.UniqueObjectIdentifier != null)
                                 {
+                                    var uniqueTenantIdentifierClaim = context.AuthenticationTicket.Identity.FindFirst(c => c.Type == ClaimConstants.UniqueTenantIdentifier);
+                                    var uniqueObjectIdentifierClaim = context.AuthenticationTicket.Identity.FindFirst(c => c.Type == ClaimConstants.UniqueObjectIdentifier);
+                                    if (uniqueTenantIdentifierClaim != null && !string.Equals(clientInfoFromServer.UniqueTenantIdentifier, uniqueTenantIdentifierClaim.Value, StringComparison.OrdinalIgnoreCase))
+                                    {
+                                        throw new InternalClaimDetectedException($"The claim \"{ClaimConstants.UniqueTenantIdentifier}\" is reserved for internal use by this library. To ensure proper functionality and avoid conflicts, please remove or rename this claim in your ID Token.")
+                                        {
+                                            Claim = uniqueTenantIdentifierClaim,
+                                        };
+                                    }
+                                    if (uniqueObjectIdentifierClaim != null && !string.Equals(clientInfoFromServer.UniqueObjectIdentifier, uniqueObjectIdentifierClaim.Value, StringComparison.OrdinalIgnoreCase))
+                                    {
+                                        throw new InternalClaimDetectedException($"The claim \"{ClaimConstants.UniqueObjectIdentifier}\" is reserved for internal use by this library. To ensure proper functionality and avoid conflicts, please remove or rename this claim in your ID Token.")
+                                        {
+                                            Claim = uniqueObjectIdentifierClaim
+                                        };
+                                    }
+
                                     context.AuthenticationTicket.Identity.AddClaim(new Claim(ClaimConstants.UniqueTenantIdentifier, clientInfoFromServer.UniqueTenantIdentifier));
                                     context.AuthenticationTicket.Identity.AddClaim(new Claim(ClaimConstants.UniqueObjectIdentifier, clientInfoFromServer.UniqueObjectIdentifier));
                                 }
@@ -187,6 +204,23 @@ public static IAppBuilder AddMicrosoftIdentityWebApp(
 
                             if (clientInfoFromServer != null && clientInfoFromServer.UniqueTenantIdentifier != null && clientInfoFromServer.UniqueObjectIdentifier != null)
                             {
+                                var uniqueTenantIdentifierClaim = context.AuthenticationTicket.Identity.FindFirst(c => c.Type == ClaimConstants.UniqueTenantIdentifier);
+                                var uniqueObjectIdentifierClaim = context.AuthenticationTicket.Identity.FindFirst(c => c.Type == ClaimConstants.UniqueObjectIdentifier);
+                                if (uniqueTenantIdentifierClaim != null && !string.Equals(clientInfoFromServer.UniqueTenantIdentifier, uniqueTenantIdentifierClaim.Value, StringComparison.OrdinalIgnoreCase))
+                                {
+                                    throw new InternalClaimDetectedException($"The claim \"{ClaimConstants.UniqueTenantIdentifier}\" is reserved for internal use by this library. To ensure proper functionality and avoid conflicts, please remove or rename this claim in your ID Token.")
+                                    {
+                                        Claim = uniqueTenantIdentifierClaim
+                                    };
+                                }
+                                if (uniqueObjectIdentifierClaim != null && !string.Equals(clientInfoFromServer.UniqueObjectIdentifier, uniqueObjectIdentifierClaim.Value, StringComparison.OrdinalIgnoreCase))
+                                {
+                                    throw new InternalClaimDetectedException($"The claim \"{ClaimConstants.UniqueObjectIdentifier}\" is reserved for internal use by this library. To ensure proper functionality and avoid conflicts, please remove or rename this claim in your ID Token.")
+                                    {
+                                        Claim = uniqueObjectIdentifierClaim
+                                    };
+                                }
+
                                 context.AuthenticationTicket.Identity.AddClaim(new Claim(ClaimConstants.UniqueTenantIdentifier, clientInfoFromServer.UniqueTenantIdentifier));
                                 context.AuthenticationTicket.Identity.AddClaim(new Claim(ClaimConstants.UniqueObjectIdentifier, clientInfoFromServer.UniqueObjectIdentifier));
                             }

src/Microsoft.Identity.Web.OWIN/InternalClaimDetectedException.cs

@@ -0,0 +1,31 @@
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License.
+
+using System;
+using System.Security.Claims;
+
+namespace Microsoft.Identity.Web.OWIN
+{
+    /// <summary>
+    /// The exception that is thrown when an internal ID Token claim used by Microsoft.Identity.Web internally is detected in the user's ID Token.
+    /// </summary>
+    public class InternalClaimDetectedException : Exception
+    {
+        /// <summary>
+        /// Gets or sets the invalid claim.
+        /// </summary>
+        public Claim Claim { get; set; }
+
+        public InternalClaimDetectedException()
+        {
+        }
+
+        public InternalClaimDetectedException(string message) : base(message)
+        {
+        }
+
+        public InternalClaimDetectedException(string message, Exception innerException) : base(message, innerException)
+        {
+        }
+    }
+}

src/Microsoft.Identity.Web/InternalClaimDetectedException.cs

@@ -0,0 +1,31 @@
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License.
+
+using System;
+using System.Security.Claims;
+
+namespace Microsoft.Identity.Web
+{
+    /// <summary>
+    /// The exception that is thrown when an internal ID Token claim used by Microsoft.Identity.Web internally is detected in the user's ID Token.
+    /// </summary>
+    public class InternalClaimDetectedException : Exception
+    {
+        /// <summary>
+        /// Gets or sets the invalid claim.
+        /// </summary>
+        public Claim Claim { get; set; }
+
+        public InternalClaimDetectedException()
+        {
+        }
+
+        public InternalClaimDetectedException(string message) : base(message)
+        {
+        }
+
+        public InternalClaimDetectedException(string message, Exception innerException) : base(message, innerException)
+        {
+        }
+    }
+}

src/Microsoft.Identity.Web/WebAppExtensions/MicrosoftIdentityWebAppAuthenticationBuilder.cs

@@ -179,8 +179,31 @@ internal static void WebAppCallsWebApiImplementation(
 
                                if (clientInfoFromServer != null && clientInfoFromServer.UniqueTenantIdentifier != null && clientInfoFromServer.UniqueObjectIdentifier != null)
                                {
-                                   context!.Principal!.Identities.FirstOrDefault()?.AddClaim(new Claim(ClaimConstants.UniqueTenantIdentifier, clientInfoFromServer.UniqueTenantIdentifier));
-                                   context!.Principal!.Identities.FirstOrDefault()?.AddClaim(new Claim(ClaimConstants.UniqueObjectIdentifier, clientInfoFromServer.UniqueObjectIdentifier));
+                                   var identity = context!.Principal!.Identities.FirstOrDefault();
+                                   if (identity != null)
+                                   {
+                                       var uniqueTenantIdentifierClaim = identity.FindFirst(c => c.Type == ClaimConstants.UniqueTenantIdentifier);
+                                       var uniqueObjectIdentifierClaim = identity.FindFirst(c => c.Type == ClaimConstants.UniqueObjectIdentifier);
+                                       if (uniqueTenantIdentifierClaim != null && !string.Equals(clientInfoFromServer.UniqueTenantIdentifier, uniqueTenantIdentifierClaim.Value, StringComparison.OrdinalIgnoreCase))
+                                       {
+                                           context.Fail(new InternalClaimDetectedException($"The claim \"{ClaimConstants.UniqueTenantIdentifier}\" is reserved for internal use by this library. To ensure proper functionality and avoid conflicts, please remove or rename this claim in your ID Token.")
+                                           {
+                                               Claim = uniqueTenantIdentifierClaim
+                                           });
+                                           return;
+                                       }
+                                       if (uniqueObjectIdentifierClaim != null && !string.Equals(clientInfoFromServer.UniqueObjectIdentifier, uniqueObjectIdentifierClaim.Value, StringComparison.OrdinalIgnoreCase))
+                                       {
+                                           context.Fail(new InternalClaimDetectedException($"The claim \"{ClaimConstants.UniqueObjectIdentifier}\" is reserved for internal use by this library. To ensure proper functionality and avoid conflicts, please remove or rename this claim in your ID Token.")
+                                           {
+                                               Claim = uniqueObjectIdentifierClaim
+                                           });
+                                           return;
+                                       }
+
+                                       identity.AddClaim(new Claim(ClaimConstants.UniqueTenantIdentifier, clientInfoFromServer.UniqueTenantIdentifier));
+                                       identity.AddClaim(new Claim(ClaimConstants.UniqueObjectIdentifier, clientInfoFromServer.UniqueObjectIdentifier));
+                                   }
                                }
                            }
                            await onTokenValidatedHandler(context).ConfigureAwait(false);

tests/Microsoft.Identity.Web.Test.Common/TestHelpers/HttpContextUtilities.cs

@@ -1,6 +1,7 @@
 // Copyright (c) Microsoft Corporation. All rights reserved.
 // Licensed under the MIT License.
 
+using System.Collections.Generic;
 using System.IO;
 using System.Security.Claims;
 using Microsoft.AspNetCore.Http;
@@ -44,5 +45,14 @@ public static HttpContext CreateHttpContext(
 
             return httpContext;
         }
+
+        public static HttpContext CreateHttpContext(IEnumerable<Claim> claims)
+        {
+            var httpContext = CreateHttpContext();
+
+            httpContext.User = new ClaimsPrincipal(new CaseSensitiveClaimsIdentity(claims));
+
+            return httpContext;
+        }
     }
 }