[Bug]: Array in claims taken as duplicate claims with "Duplicate claims are not allowed within a request."

[andrew-at-v]

What happened?

The claim type is "scope", stored as "array" value
Data api builder simply crash because we have array in our access token

Version

Microsoft.DataApiBuilder 0.9.7+e560142426d1c080b9fd7b7fabff51a276f6bf61

What database are you using?

Azure SQL

What hosting model are you using?

Local (including CLI)

Which API approach are you accessing DAB through?

REST

Relevant log output

No response

Code of Conduct

• I agree to follow this project's Code of Conduct

[seantleonard]

Thank you for reporting, @abratv. I agree this is an issue and I'm looking into it. Few questions:

1. What identity provider are you using, EntraID/Azure AD?
2. Out of curiosity, do you use the scope claims (scp) in any DAB Database authorization policy rules?

[andrew-at-v]

1. It's our internal open id provider
   Like what I said in another issue, I'm aware officially its Az AD but there is no "technical" limitation other than "business decision" here, Msft promote this as open source and can run it on premise so... (does not mean i want to fork it :P)
2. No, normally scope claim is used to authorize the api endpoint, say "api:person:read", then this indicate the access token can only be used to reach GET /person, it does not even hit the database yet
   Having saying that, because DAB simply throw all claims to sp_sessions_context? (there was discussion to configure this instead of using all claims but it does not made it?), it should be up to us to decide which claims to be used in session context
   DAB should simply give us "example/best practice" and not limit the possibility of using DAB

[andrew-at-v]

@seantleonard i saw your PR, seems that means we can't use any stored claims with JSON array, why not simply using "scope_0", "scope_1",... but again this should be configurable