DnnRoleProfile.config and DnnProfileMappings.config settings should be setup by portal

[davidjrh]

Since the Azure AD B2C settings are setup by portal, the sync mappings (DnnRoleProfile.config and the DnnProfileMappings.config) should be setup in the same way.

This could be accomplished by storing these files under the /Portals/_default and /Portals/ folders.

[tscheffel]

Hey David, I have questions about the DNN B2C module's message handler web.config setting. Specifically, the defaultInclude="false" parameter.

What is the rationale for setting defaultInclude=”false” for the DNN B2C message handler in web.config?

I set it to true to enable both our mobile app (via B2C JWT) and our DNN SPA modules to access our one shared controller. Do you know of any negative ramifications by setting that parameter to true?

If there are indeed negative ramifications, do you know of a reasonable alternative to setting it to true that still enables our mobile app & SPA modules to pass auth scrutiny when accessing the one shared controller?

I Googled for alternatives to try to find a workaround, e.g. [DnnAuthorize(AuthTypes = “JWT,DNN”)], but obviously that failed. There may well be an alternative that Googling did not reveal.

Thanks for your time!

Troy

[davidjrh]

Hi @tscheffel, can you try with [DnnAuthorize(AuthTypes = "JWT,Basic")] and see if that works?

The fact is that when I was implementing this, I was going to set 'Bearer' as the AuthType, but then everybody that used the DNN "JWT" implementation would need to explicitly add the AuthType "Bearer" on the current controllers. I preferred to maintain the "JWT" word, but IMHO, the "JWT" should be replaced by "Bearer" to avoid this confusing situation.

[davidjrh]

BTW, the issue referred on this subject has been completed, all the mappings are now being stored on the database, and can be setup globally or per portal.

Closing this issue.