Blazor Server authentication documentation is all over the place

mayur-ekbote commented 11 months ago

Is there an existing issue for this?

[X] I have searched the existing issues

Describe the bug

I have used Blazor server authentication before the recent changes (azure AD). With Microsoft Entra, one needs to make changes. The simple ask for a basic app with a single tenant is as follows:

Make the user login in case he is not logged in
Provide a logout button once he logs in

There is no documentation that addresses both. The link on the app registration page has a 'tutorial' for Blazor server

It is barely useful because it does not cover CascadingAuthenticationState or AuthorizeRouteView. Once it covers the "sync tool" it simply jumps to a generic tutorial that has nothing related to Blazor. It has only .net core, asp.core and other OSS platforms.

Then we also have the official documentation on Blazor. It is much more detailed. Yet even this does not have any mention of the process to be followed to implement a sign out button!

From 30000 I understand that Blazor documentation team wants to be platform agnostic and the azure team might be doing its own thing. But would it be possible to have one single document somewhere that has the entire login - logout flow for a single tenant in Azure?

Expected Behavior

No response

Steps To Reproduce

No response

Exceptions (if any)

No response

.NET Version

No response

Anything else?

No response

mayur-ekbote commented 11 months ago

Thank you for your reply.

... and the LogoutModel in code-behind is like this ...

Actually, the signin/ signout Blazor code looks like this:

<AuthorizeView>
    <Authorized>
        Hello, @context.User.Identity.Name!
        <a href="MicrosoftIdentity/Account/SignOut">Sign Out</a>
    </Authorized>
    <NotAuthorized>
        <a href="MicrosoftIdentity/Account/SignIn">Sign In</a>
    </NotAuthorized>
</AuthorizeView>

That's it (at least I hope so, since it is part of the samples). As you can see, there is no explicit reference to asp.net style controllers or areas or anything. However this is provided if you add the following to the startup class:

var builder = WebApplication.CreateBuilder(args);
builder.Services.AddMicrosoftIdentityWebAppAuthentication(builder.Configuration, "AzureAd");
builder.Services.AddControllersWithViews()
                .AddMicrosoftIdentityUI();

builder.Services.AddAuthorization(options =>
{
    options.FallbackPolicy = options.DefaultPolicy;
});

// Add services to the container.

builder.Services.AddRazorPages();
builder.Services.AddServerSideBlazor().AddMicrosoftIdentityConsentHandler(); 
// other stuff
app.UseHttpsRedirection();

app.UseStaticFiles();

app.UseRouting();

app.UseAuthentication();
app.UseAuthorization();
app.MapControllers();

And of course, update the config file with the client and app IDs, along with updating the endpoint settings in Azure portal (that documentation is a little vague - it doesn't specify exactly how exactly the callback URLs work.)

But I hope you see the source of frustration - one needs to google and stitch the pieces together and then do some trial and error to figure out how these things work ( AzureAD related stuff is now in Microsoft.Identity.Web)

At least for Microsoft technologies (Blazor+Azure) it is only reasonable to expect a cohesive document. At least an official blog post, if not an official doc?

guardrex commented 11 months ago

You're right, @mayur-ekbote ... I forgot that scaffolded code for Identity won't target Microsoft Identity Platform endpoints. I think Jeremy's plans are to sort out better Blazor Server coverage.

I think the correct cross-reference for guidance is ...

https://learn.microsoft.com/en-us/azure/active-directory/develop/scenario-web-app-sign-user-sign-in?tabs=aspnetcore#sign-out

... which isn't specific to Blazor and doesn't show a Razor component example.

dotnet / aspnetcore