[SM-394] Secrets Manager (#2164)

Long lived feature branch for Secrets Manager

Co-authored-by: Thomas Avery <43214426+Thomas-Avery@users.noreply.github.com>
Co-authored-by: cd-bitwarden <106776772+cd-bitwarden@users.noreply.github.com>
Co-authored-by: CarleyDiaz-Bitwarden <103955722+CarleyDiaz-Bitwarden@users.noreply.github.com>
Co-authored-by: Thomas Avery <tavery@bitwarden.com>
Co-authored-by: Colton Hurst <colton@coltonhurst.com>

src/Identity/IdentityServer/ApiResources.cs

@@ -1,4 +1,6 @@
-using IdentityModel;
+using Bit.Core.Identity;
+using Bit.Core.IdentityServer;
+using IdentityModel;
 using IdentityServer4.Models;
 
 namespace Bit.Identity.IdentityServer;
@@ -9,27 +11,27 @@ public class ApiResources
     {
         return new List<ApiResource>
         {
-            new ApiResource("api", new string[] {
+            new("api", new[] {
                 JwtClaimTypes.Name,
                 JwtClaimTypes.Email,
                 JwtClaimTypes.EmailVerified,
-                "sstamp", // security stamp
-                "premium",
-                "device",
-                "orgowner",
-                "orgadmin",
-                "orgmanager",
-                "orguser",
-                "orgcustom",
-                "providerprovideradmin",
-                "providerserviceuser",
+                Claims.SecurityStamp,
+                Claims.Premium,
+                Claims.Device,
+                Claims.OrganizationOwner,
+                Claims.OrganizationAdmin,
+                Claims.OrganizationManager,
+                Claims.OrganizationUser,
+                Claims.OrganizationCustom,
+                Claims.ProviderAdmin,
+                Claims.ProviderServiceUser,
             }),
-            new ApiResource("internal", new string[] { JwtClaimTypes.Subject }),
-            new ApiResource("api.push", new string[] { JwtClaimTypes.Subject }),
-            new ApiResource("api.licensing", new string[] { JwtClaimTypes.Subject }),
-            new ApiResource("api.organization", new string[] { JwtClaimTypes.Subject }),
-            new ApiResource("api.provider", new string[] { JwtClaimTypes.Subject }),
-            new ApiResource("api.installation", new string[] { JwtClaimTypes.Subject }),
+            new(ApiScopes.Internal, new[] { JwtClaimTypes.Subject }),
+            new(ApiScopes.ApiPush, new[] { JwtClaimTypes.Subject }),
+            new(ApiScopes.ApiLicensing, new[] { JwtClaimTypes.Subject }),
+            new(ApiScopes.ApiOrganization, new[] { JwtClaimTypes.Subject }),
+            new(ApiScopes.ApiInstallation, new[] { JwtClaimTypes.Subject }),
+            new(ApiScopes.ApiSecrets, new[] { JwtClaimTypes.Subject, Claims.Organization }),
         };
     }
 }

src/Identity/IdentityServer/ApiScopes.cs

@@ -1,19 +0,0 @@
-using IdentityServer4.Models;
-
-namespace Bit.Identity.IdentityServer;
-
-public class ApiScopes
-{
-    public static IEnumerable<ApiScope> GetApiScopes()
-    {
-        return new List<ApiScope>
-        {
-            new ApiScope("api", "API Access"),
-            new ApiScope("api.push", "API Push Access"),
-            new ApiScope("api.licensing", "API Licensing Access"),
-            new ApiScope("api.organization", "API Organization Access"),
-            new ApiScope("api.installation", "API Installation Access"),
-            new ApiScope("internal", "Internal Access")
-        };
-    }
-}

src/Identity/IdentityServer/BaseRequestValidator.cs

@@ -31,12 +31,11 @@ public abstract class BaseRequestValidator<T> where T : class
     private readonly IOrganizationUserRepository _organizationUserRepository;
     private readonly IApplicationCacheService _applicationCacheService;
     private readonly IMailService _mailService;
-    private readonly ILogger<ResourceOwnerPasswordValidator> _logger;
+    private readonly ILogger _logger;
     private readonly ICurrentContext _currentContext;
     private readonly GlobalSettings _globalSettings;
     private readonly IPolicyRepository _policyRepository;
     private readonly IUserRepository _userRepository;
-    private readonly ICaptchaValidationService _captchaValidationService;
 
     public BaseRequestValidator(
         UserManager<User> userManager,
@@ -49,12 +48,11 @@ public abstract class BaseRequestValidator<T> where T : class
         IOrganizationUserRepository organizationUserRepository,
         IApplicationCacheService applicationCacheService,
         IMailService mailService,
-        ILogger<ResourceOwnerPasswordValidator> logger,
+        ILogger logger,
         ICurrentContext currentContext,
         GlobalSettings globalSettings,
         IPolicyRepository policyRepository,
-        IUserRepository userRepository,
-        ICaptchaValidationService captchaValidationService)
+        IUserRepository userRepository)
     {
         _userManager = userManager;
         _deviceRepository = deviceRepository;
@@ -71,7 +69,6 @@ public abstract class BaseRequestValidator<T> where T : class
         _globalSettings = globalSettings;
         _policyRepository = policyRepository;
         _userRepository = userRepository;
-        _captchaValidationService = captchaValidationService;
     }
 
     protected async Task ValidateAsync(T context, ValidatedTokenRequest request,
@@ -172,7 +169,7 @@ public abstract class BaseRequestValidator<T> where T : class
 
         if (device != null)
         {
-            claims.Add(new Claim("device", device.Identifier));
+            claims.Add(new Claim(Claims.Device, device.Identifier));
         }
 
         var customResponse = new Dictionary<string, object>();

src/Identity/IdentityServer/ClientStore.cs

@@ -2,6 +2,9 @@
 using System.Security.Claims;
 using Bit.Core.Context;
 using Bit.Core.Enums;
+using Bit.Core.Identity;
+using Bit.Core.IdentityServer;
+using Bit.Core.Models.Data;
 using Bit.Core.Repositories;
 using Bit.Core.Services;
 using Bit.Core.Settings;
@@ -23,8 +26,8 @@ public class ClientStore : IClientStore
     private readonly ICurrentContext _currentContext;
     private readonly IOrganizationUserRepository _organizationUserRepository;
     private readonly IProviderUserRepository _providerUserRepository;
-    private readonly IProviderOrganizationRepository _providerOrganizationRepository;
     private readonly IOrganizationApiKeyRepository _organizationApiKeyRepository;
+    private readonly IApiKeyRepository _apiKeyRepository;
 
     public ClientStore(
         IInstallationRepository installationRepository,
@@ -36,8 +39,8 @@ public class ClientStore : IClientStore
         ICurrentContext currentContext,
         IOrganizationUserRepository organizationUserRepository,
         IProviderUserRepository providerUserRepository,
-        IProviderOrganizationRepository providerOrganizationRepository,
-        IOrganizationApiKeyRepository organizationApiKeyRepository)
+        IOrganizationApiKeyRepository organizationApiKeyRepository,
+        IApiKeyRepository apiKeyRepository)
     {
         _installationRepository = installationRepository;
         _organizationRepository = organizationRepository;
@@ -48,133 +51,219 @@ public class ClientStore : IClientStore
         _currentContext = currentContext;
         _organizationUserRepository = organizationUserRepository;
         _providerUserRepository = providerUserRepository;
-        _providerOrganizationRepository = providerOrganizationRepository;
         _organizationApiKeyRepository = organizationApiKeyRepository;
+        _apiKeyRepository = apiKeyRepository;
     }
 
     public async Task<Client> FindClientByIdAsync(string clientId)
     {
         if (!_globalSettings.SelfHosted && clientId.StartsWith("installation."))
         {
-            var idParts = clientId.Split('.');
-            if (idParts.Length > 1 && Guid.TryParse(idParts[1], out Guid id))
-            {
-                var installation = await _installationRepository.GetByIdAsync(id);
-                if (installation != null)
-                {
-                    return new Client
-                    {
-                        ClientId = $"installation.{installation.Id}",
-                        RequireClientSecret = true,
-                        ClientSecrets = { new Secret(installation.Key.Sha256()) },
-                        AllowedScopes = new string[] { "api.push", "api.licensing", "api.installation" },
-                        AllowedGrantTypes = GrantTypes.ClientCredentials,
-                        AccessTokenLifetime = 3600 * 24,
-                        Enabled = installation.Enabled,
-                        Claims = new List<ClientClaim>
-                        {
-                            new ClientClaim(JwtClaimTypes.Subject, installation.Id.ToString())
-                        }
-                    };
-                }
-            }
+            return await CreateInstallationClientAsync(clientId);
         }
-        else if (_globalSettings.SelfHosted && clientId.StartsWith("internal.") &&
+
+        if (_globalSettings.SelfHosted && clientId.StartsWith("internal.") &&
             CoreHelpers.SettingHasValue(_globalSettings.InternalIdentityKey))
         {
-            var idParts = clientId.Split('.');
-            if (idParts.Length > 1)
-            {
-                var id = idParts[1];
-                if (!string.IsNullOrWhiteSpace(id))
-                {
-                    return new Client
-                    {
-                        ClientId = $"internal.{id}",
-                        RequireClientSecret = true,
-                        ClientSecrets = { new Secret(_globalSettings.InternalIdentityKey.Sha256()) },
-                        AllowedScopes = new string[] { "internal" },
-                        AllowedGrantTypes = GrantTypes.ClientCredentials,
-                        AccessTokenLifetime = 3600 * 24,
-                        Enabled = true,
-                        Claims = new List<ClientClaim>
-                        {
-                            new ClientClaim(JwtClaimTypes.Subject, id)
-                        }
-                    };
-                }
-            }
-        }
-        else if (clientId.StartsWith("organization."))
-        {
-            var idParts = clientId.Split('.');
-            if (idParts.Length > 1 && Guid.TryParse(idParts[1], out var id))
-            {
-                var org = await _organizationRepository.GetByIdAsync(id);
-                if (org != null)
-                {
-                    var orgApiKey = (await _organizationApiKeyRepository
-                        .GetManyByOrganizationIdTypeAsync(org.Id, OrganizationApiKeyType.Default))
-                        .First();
-                    return new Client
-                    {
-                        ClientId = $"organization.{org.Id}",
-                        RequireClientSecret = true,
-                        ClientSecrets = { new Secret(orgApiKey.ApiKey.Sha256()) },
-                        AllowedScopes = new string[] { "api.organization" },
-                        AllowedGrantTypes = GrantTypes.ClientCredentials,
-                        AccessTokenLifetime = 3600 * 1,
-                        Enabled = org.Enabled && org.UseApi,
-                        Claims = new List<ClientClaim>
-                        {
-                            new ClientClaim(JwtClaimTypes.Subject, org.Id.ToString())
-                        }
-                    };
-                }
-            }
-        }
-        else if (clientId.StartsWith("user."))
-        {
-            var idParts = clientId.Split('.');
-            if (idParts.Length > 1 && Guid.TryParse(idParts[1], out var id))
-            {
-                var user = await _userRepository.GetByIdAsync(id);
-                if (user != null)
-                {
-                    var claims = new Collection<ClientClaim>()
-                    {
-                        new ClientClaim(JwtClaimTypes.Subject, user.Id.ToString()),
-                        new ClientClaim(JwtClaimTypes.AuthenticationMethod, "Application", "external")
-                    };
-                    var orgs = await _currentContext.OrganizationMembershipAsync(_organizationUserRepository, user.Id);
-                    var providers = await _currentContext.ProviderMembershipAsync(_providerUserRepository, user.Id);
-                    var isPremium = await _licensingService.ValidateUserPremiumAsync(user);
-                    foreach (var claim in CoreHelpers.BuildIdentityClaims(user, orgs, providers, isPremium))
-                    {
-                        var upperValue = claim.Value.ToUpperInvariant();
-                        var isBool = upperValue == "TRUE" || upperValue == "FALSE";
-                        claims.Add(isBool ?
-                            new ClientClaim(claim.Key, claim.Value, ClaimValueTypes.Boolean) :
-                            new ClientClaim(claim.Key, claim.Value)
-                        );
-                    }
-
-                    return new Client
-                    {
-                        ClientId = clientId,
-                        RequireClientSecret = true,
-                        ClientSecrets = { new Secret(user.ApiKey.Sha256()) },
-                        AllowedScopes = new string[] { "api" },
-                        AllowedGrantTypes = GrantTypes.ClientCredentials,
-                        AccessTokenLifetime = 3600 * 1,
-                        ClientClaimsPrefix = null,
-                        Claims = claims
-                    };
-                }
-            }
+            return CreateInternalClient(clientId);
         }
 
-        return _staticClientStore.ApiClients.ContainsKey(clientId) ?
-            _staticClientStore.ApiClients[clientId] : null;
+        if (clientId.StartsWith("organization."))
+        {
+            return await CreateOrganizationClientAsync(clientId);
+        }
+
+        if (clientId.StartsWith("user."))
+        {
+            return await CreateUserClientAsync(clientId);
+        }
+
+        if (_staticClientStore.ApiClients.ContainsKey(clientId))
+        {
+            return _staticClientStore.ApiClients[clientId];
+        }
+
+        return await CreateApiKeyClientAsync(clientId);
+    }
+
+    private async Task<Client> CreateApiKeyClientAsync(string clientId)
+    {
+        var apiKey = await _apiKeyRepository.GetDetailsByIdAsync(new Guid(clientId));
+
+        if (apiKey == null || apiKey.ExpireAt <= DateTime.Now)
+        {
+            return null;
+        }
+
+        var client = new Client
+        {
+            ClientId = clientId,
+            RequireClientSecret = true,
+            ClientSecrets = { new Secret(apiKey.ClientSecret.Sha256()) },
+            AllowedScopes = apiKey.GetScopes(),
+            AllowedGrantTypes = GrantTypes.ClientCredentials,
+            AccessTokenLifetime = 3600 * 1,
+            ClientClaimsPrefix = null,
+            Properties = new Dictionary<string, string> {
+                {"encryptedPayload", apiKey.EncryptedPayload},
+            },
+            Claims = new List<ClientClaim>
+            {
+                new(JwtClaimTypes.Subject, apiKey.ServiceAccountId.ToString()),
+            },
+        };
+
+        switch (apiKey)
+        {
+            case ServiceAccountApiKeyDetails key:
+                client.Claims.Add(new ClientClaim(Claims.Organization, key.ServiceAccountOrganizationId.ToString()));
+                break;
+        }
+
+        return client;
+    }
+
+    private async Task<Client> CreateUserClientAsync(string clientId)
+    {
+        var idParts = clientId.Split('.');
+        if (idParts.Length <= 1 || !Guid.TryParse(idParts[1], out var id))
+        {
+            return null;
+        }
+
+        var user = await _userRepository.GetByIdAsync(id);
+        if (user == null)
+        {
+            return null;
+        }
+
+        var claims = new Collection<ClientClaim>
+        {
+            new(JwtClaimTypes.Subject, user.Id.ToString()),
+            new(JwtClaimTypes.AuthenticationMethod, "Application", "external"),
+        };
+        var orgs = await _currentContext.OrganizationMembershipAsync(_organizationUserRepository, user.Id);
+        var providers = await _currentContext.ProviderMembershipAsync(_providerUserRepository, user.Id);
+        var isPremium = await _licensingService.ValidateUserPremiumAsync(user);
+        foreach (var claim in CoreHelpers.BuildIdentityClaims(user, orgs, providers, isPremium))
+        {
+            var upperValue = claim.Value.ToUpperInvariant();
+            var isBool = upperValue is "TRUE" or "FALSE";
+            claims.Add(isBool
+                ? new ClientClaim(claim.Key, claim.Value, ClaimValueTypes.Boolean)
+                : new ClientClaim(claim.Key, claim.Value)
+            );
+        }
+
+        return new Client
+        {
+            ClientId = clientId,
+            RequireClientSecret = true,
+            ClientSecrets = { new Secret(user.ApiKey.Sha256()) },
+            AllowedScopes = new[] { "api" },
+            AllowedGrantTypes = GrantTypes.ClientCredentials,
+            AccessTokenLifetime = 3600 * 1,
+            ClientClaimsPrefix = null,
+            Claims = claims,
+        };
+    }
+
+    private async Task<Client> CreateOrganizationClientAsync(string clientId)
+    {
+        var idParts = clientId.Split('.');
+        if (idParts.Length <= 1 || !Guid.TryParse(idParts[1], out var id))
+        {
+            return null;
+        }
+
+        var org = await _organizationRepository.GetByIdAsync(id);
+        if (org == null)
+        {
+            return null;
+        }
+
+        var orgApiKey = (await _organizationApiKeyRepository
+            .GetManyByOrganizationIdTypeAsync(org.Id, OrganizationApiKeyType.Default))
+            .First();
+
+        return new Client
+        {
+            ClientId = $"organization.{org.Id}",
+            RequireClientSecret = true,
+            ClientSecrets = { new Secret(orgApiKey.ApiKey.Sha256()) },
+            AllowedScopes = new[] { ApiScopes.ApiOrganization },
+            AllowedGrantTypes = GrantTypes.ClientCredentials,
+            AccessTokenLifetime = 3600 * 1,
+            Enabled = org.Enabled && org.UseApi,
+            Claims = new List<ClientClaim>
+            {
+                new(JwtClaimTypes.Subject, org.Id.ToString()),
+            },
+        };
+    }
+
+    private Client CreateInternalClient(string clientId)
+    {
+        var idParts = clientId.Split('.');
+        if (idParts.Length <= 1)
+        {
+            return null;
+        }
+
+        var id = idParts[1];
+        if (string.IsNullOrWhiteSpace(id))
+        {
+            return null;
+        }
+
+        return new Client
+        {
+            ClientId = $"internal.{id}",
+            RequireClientSecret = true,
+            ClientSecrets = { new Secret(_globalSettings.InternalIdentityKey.Sha256()) },
+            AllowedScopes = new[] { ApiScopes.Internal },
+            AllowedGrantTypes = GrantTypes.ClientCredentials,
+            AccessTokenLifetime = 3600 * 24,
+            Enabled = true,
+            Claims = new List<ClientClaim>
+            {
+                new(JwtClaimTypes.Subject, id),
+            },
+        };
+    }
+
+    private async Task<Client> CreateInstallationClientAsync(string clientId)
+    {
+        var idParts = clientId.Split('.');
+        if (idParts.Length <= 1 || !Guid.TryParse(idParts[1], out Guid id))
+        {
+            return null;
+        }
+
+        var installation = await _installationRepository.GetByIdAsync(id);
+        if (installation == null)
+        {
+            return null;
+        }
+
+        return new Client
+        {
+            ClientId = $"installation.{installation.Id}",
+            RequireClientSecret = true,
+            ClientSecrets = { new Secret(installation.Key.Sha256()) },
+            AllowedScopes = new[]
+            {
+                ApiScopes.ApiPush,
+                ApiScopes.ApiLicensing,
+                ApiScopes.ApiInstallation,
+            },
+            AllowedGrantTypes = GrantTypes.ClientCredentials,
+            AccessTokenLifetime = 3600 * 24,
+            Enabled = installation.Enabled,
+            Claims = new List<ClientClaim>
+            {
+                new(JwtClaimTypes.Subject, installation.Id.ToString()),
+            },
+        };
     }
 }

src/Identity/IdentityServer/CustomTokenRequestValidator.cs

@@ -2,6 +2,7 @@
 using Bit.Core.Context;
 using Bit.Core.Entities;
 using Bit.Core.Identity;
+using Bit.Core.IdentityServer;
 using Bit.Core.Repositories;
 using Bit.Core.Services;
 using Bit.Core.Settings;
@@ -17,7 +18,6 @@ public class CustomTokenRequestValidator : BaseRequestValidator<CustomTokenReque
 {
     private UserManager<User> _userManager;
     private readonly ISsoConfigRepository _ssoConfigRepository;
-    private readonly IOrganizationRepository _organizationRepository;
 
     public CustomTokenRequestValidator(
         UserManager<User> userManager,
@@ -30,21 +30,19 @@ public class CustomTokenRequestValidator : BaseRequestValidator<CustomTokenReque
         IOrganizationUserRepository organizationUserRepository,
         IApplicationCacheService applicationCacheService,
         IMailService mailService,
-        ILogger<ResourceOwnerPasswordValidator> logger,
+        ILogger<CustomTokenRequestValidator> logger,
         ICurrentContext currentContext,
         GlobalSettings globalSettings,
         IPolicyRepository policyRepository,
         ISsoConfigRepository ssoConfigRepository,
-        IUserRepository userRepository,
-        ICaptchaValidationService captchaValidationService)
+        IUserRepository userRepository)
         : base(userManager, deviceRepository, deviceService, userService, eventService,
               organizationDuoWebTokenProvider, organizationRepository, organizationUserRepository,
               applicationCacheService, mailService, logger, currentContext, globalSettings, policyRepository,
-              userRepository, captchaValidationService)
+              userRepository)
     {
         _userManager = userManager;
         _ssoConfigRepository = ssoConfigRepository;
-        _organizationRepository = organizationRepository;
     }
 
     public async Task ValidateAsync(CustomTokenRequestValidationContext context)
@@ -53,10 +51,18 @@ public class CustomTokenRequestValidator : BaseRequestValidator<CustomTokenReque
         if (!allowedGrantTypes.Contains(context.Result.ValidatedRequest.GrantType)
             || context.Result.ValidatedRequest.ClientId.StartsWith("organization")
             || context.Result.ValidatedRequest.ClientId.StartsWith("installation")
-            || context.Result.ValidatedRequest.ClientId.StartsWith("internal"))
+            || context.Result.ValidatedRequest.ClientId.StartsWith("internal")
+            || context.Result.ValidatedRequest.Client.AllowedScopes.Contains(ApiScopes.ApiSecrets))
         {
+            if (context.Result.ValidatedRequest.Client.Properties.TryGetValue("encryptedPayload", out var payload) &&
+                !string.IsNullOrWhiteSpace(payload))
+            {
+                context.Result.CustomResponse = new Dictionary<string, object> { { "encrypted_payload", payload } };
+            }
+
             return;
         }
+
         await ValidateAsync(context, context.Result.ValidatedRequest,
             new CustomValidatorRequestContext { KnownDevice = true });
     }

src/Identity/IdentityServer/ProfileService.cs

@@ -1,5 +1,6 @@
 using System.Security.Claims;
 using Bit.Core.Context;
+using Bit.Core.Identity;
 using Bit.Core.Repositories;
 using Bit.Core.Services;
 using Bit.Core.Utilities;
@@ -70,7 +71,7 @@ public class ProfileService : IProfileService
 
     public async Task IsActiveAsync(IsActiveContext context)
     {
-        var securityTokenClaim = context.Subject?.Claims.FirstOrDefault(c => c.Type == "sstamp");
+        var securityTokenClaim = context.Subject?.Claims.FirstOrDefault(c => c.Type == Claims.SecurityStamp);
         var user = await _userService.GetUserByPrincipalAsync(context.Subject);
 
         if (user != null && securityTokenClaim != null)

src/Identity/IdentityServer/ResourceOwnerPasswordValidator.cs

@@ -41,7 +41,7 @@ public class ResourceOwnerPasswordValidator : BaseRequestValidator<ResourceOwner
         : base(userManager, deviceRepository, deviceService, userService, eventService,
               organizationDuoWebTokenProvider, organizationRepository, organizationUserRepository,
               applicationCacheService, mailService, logger, currentContext, globalSettings, policyRepository,
-              userRepository, captchaValidationService)
+              userRepository)
     {
         _userManager = userManager;
         _userService = userService;

src/Identity/Utilities/ServiceCollectionExtensions.cs

@@ -1,4 +1,5 @@
-using Bit.Core.Settings;
+using Bit.Core.IdentityServer;
+using Bit.Core.Settings;
 using Bit.Identity.IdentityServer;
 using Bit.SharedWeb.Utilities;
 using IdentityServer4.ResponseHandling;

src/Identity/packages.lock.json

@@ -548,6 +548,15 @@
           "Microsoft.Extensions.DependencyModel": "6.0.0"
         }
       },
+      "Microsoft.EntityFrameworkCore.SqlServer": {
+        "type": "Transitive",
+        "resolved": "6.0.12",
+        "contentHash": "bdKnSz1w+WZz9QYWhs3wwGuMn4YssjdR+HOBpzChQ6C3+dblq4Pammm5fzugcPOhTgCiWftOT2jPOT5hEy4bYg==",
+        "dependencies": {
+          "Microsoft.Data.SqlClient": "2.1.4",
+          "Microsoft.EntityFrameworkCore.Relational": "6.0.12"
+        }
+      },
       "Microsoft.Extensions.Caching.Abstractions": {
         "type": "Transitive",
         "resolved": "6.0.0",
@@ -2776,6 +2785,7 @@
           "AutoMapper.Extensions.Microsoft.DependencyInjection": "[11.0.0, )",
           "Core": "[2022.12.0, )",
           "Microsoft.EntityFrameworkCore.Relational": "[6.0.12, )",
+          "Microsoft.EntityFrameworkCore.SqlServer": "[6.0.12, )",
           "Microsoft.EntityFrameworkCore.Sqlite": "[6.0.12, )",
           "Npgsql.EntityFrameworkCore.PostgreSQL": "[6.0.8, )",
           "Pomelo.EntityFrameworkCore.MySql": "[6.0.2, )",