PnpCoreAuthentication in Blazor Server App

[vroesgen]

If I try to get a site context in a service of a blazor server app the exception:
Microsoft.Identity.Web.MicrosoftIdentityWebChallengeUserException: IDW10502: An MsalUiRequiredException was thrown due to a challenge for the user. See https://aka.ms/ms-id-web/ca_incremental-consent. ---> MSAL.NetCore.4.36.1.0.MsalUiRequiredException: ErrorCode: user_null
is thrown.

This problem only occurs when I run the blazor app from a server. When I test it local from Visual Studio it works.

startup.cs:

       services.AddMicrosoftIdentityWebAppAuthentication(Configuration)
            .EnableTokenAcquisitionToCallDownstreamApi(new string[] { "User.Read" })
            .AddInMemoryTokenCaches();


      services.AddRazorPages().AddMvcOptions(options =>
        {
            var policy = new AuthorizationPolicyBuilder()
                .RequireAuthenticatedUser()
                .Build();
            options.Filters.Add(new AuthorizeFilter(policy));
        }).AddMicrosoftIdentityUI();

        services.AddServerSideBlazor();

        services.AddPnPCore();
        services.Configure<PnPCoreOptions>(Configuration.GetSection("PnPCore"));
        services.AddPnPCoreAuthentication();
        services.Configure<PnPCoreAuthenticationOptions>(Configuration.GetSection("PnPCore"));

        services.AddTransient<IGraphSpoService, GraphSpoService>();

GraphSpoService.cs:

    private readonly ILogger _logger;
    private readonly IConfiguration _configuration;
    private readonly IPnPContextFactory _pnpContextFactory;
    private readonly PnPCoreOptions _pnpCoreOptions;
    private readonly ITokenAcquisition _tokenAcquisition;

    public GraphSpoService(
         IConfiguration configuration,
         IPnPContextFactory pnpContextFactory,
         IOptions<PnPCoreOptions> pnpCoreOptions,
         IServiceProvider serviceProvider,
         ILoggerFactory logger)
     {
         _logger = logger.CreateLogger(nameof(GraphSpoService));
         _configuration = configuration;
         _pnpContextFactory = pnpContextFactory;
         _pnpCoreOptions = pnpCoreOptions?.Value;
         var scope = serviceProvider.CreateScope();
         _tokenAcquisition = scope.ServiceProvider.GetService<ITokenAcquisition>();
    }

   public async Task OpenSopDocument(string documentName)
    {
        try
        {
            using var context = await createSiteContextAsync();
            . . .  
        }
   }  

   private async Task<PnPContext> createSiteContextAsync()
    {
        var siteUrl = new Uri(_pnpCoreOptions.Sites["ServiceSite"].SiteUrl);

        return await _pnpContextFactory.CreateAsync(siteUrl,
            new ExternalAuthenticationProvider((resourceUri, scopes) =>
                _tokenAcquisition?.GetAccessTokenForUserAsync(scopes).GetAwaiter().GetResult()));
    }

Thanks for any help...
Frank

[jansenbe]

Hi @vroesgen ,

Here's a sample Blazor app: https://pnp.github.io/pnpcore/demos/Demo.Blazor/README.html. It uses a custom auth provider (MsalWrappedTokenProvider.cs) to tap into the loaded token provider.

[vroesgen]

but that is a WebAssembly Blazor App.
In a Blazor Server App you don´t need a custom auth provider.

Meanwhile I found the problem: I had to activate WebSockets on the IIS Konfiguration.

[TimDol64]

@jansenbe Is it possible to add a Demo.BlazorServer project to the solution? I realize it is more or less out of scope for PnPCore itself, but it would be very much appreciated.

I am trying to adapt code from the Demo.ASPNetCore project (and tried to adapt it with the code from vroesgen on this page), but no luck so far. I would like to have a working Blazor server app first, and then try to catch up on everything there is to know about Microsoft Identity Platform :-(.

First, I got an 'AADSTS700025: Client is public so neither 'client_assertion' nor 'client_secret' should be presented' error. I tried to fix that by commenting out AzureAd.ClientSecret from appsettings.json, but that results in an 'AADSTS700025: Client is public so neither 'client_assertion' nor 'client_secret' should be presented' error.
From what I could find, the client is regarded public if the app registration on the Azure portal has 'Yes' selected for 'Allow public client flows' on the Authentication, but this is not the case.