Extra details on how to authenticate with Entra ID

[LapinskasL]

Description

I've been having severe trouble implementing authentication and authorization in Blazor Hybrid apps.

While the guide has a lot of code, I'm not quite sure how to properly integrate Entra ID into it. I find myself left with a lot of questions.

"What will happen when the token expires?"
"Is it automatically renewed when it expires?"
"How do I reduce token expiration time so I can test it?"
"Why is the AuthorizeView tag working, but not its Roles attribute?"
"Why is the [Authorize] attribute not working?"

It would help if the docs used implementation with Entra ID (or provide a sample with it) and also addressed those questions. Coming from the MVC framework, I can't help but feel like there's missing features and the answers to these questions are hard to find.

I've made a post on reddit too if you want to see how far I got: https://www.reddit.com/r/dotnet/comments/1e05wel/how_to_fully_integrate_entra_id_authorization/

Page URL

https://learn.microsoft.com/en-us/aspnet/core/blazor/hybrid/security/?view=aspnetcore-8.0&pivots=maui

Content source URL

https://github.com/dotnet/AspNetCore.Docs/blob/main/aspnetcore/blazor/hybrid/security/index.md

Document ID

cb3ca917-28cc-126f-a7ff-3ff00ad30677

Article author

@guardrex

[guardrex]

Hello @LapinskasL ... This article is only about integrating Identity with Blazor (which it calls out in the intro). Tokens/token expiration/token renewal are identity provider subjects covered by the Entra/MS Identity Web docs (or OIDC docs if you use OIDC with Entra) and perhaps .NET MAUI docs/samples. This isn't an article about how to implement Identity generally.

WRT the roles not working with AuthorizeView, it's probably because the role claim is missing or not mapped to the new claims identity properly ... again, something covered in external doc sets (for example, part of the MAUI tutorial series that deals with roles, Entra doc: Configure the role claim, OIDC role claim mapping, etc.).

The .NET MAUI docs point to a tutorial in the External ID doc set's tutorial area 👉 https://learn.microsoft.com/entra/external-id/customers/tutorial-mobile-app-maui-sign-in-prepare-tenant.

@BethMassi ... These are the potential cross-links that I scared up for an Additional Resources section added to this article. Which of these are these OK? Are there any other resources that I should cross-link?

I'll make checkboxes out of these, and you can edit this and check off the ones I should use if that's fast 🏃 ..........

• https://learn.microsoft.com/entra/external-id/customers/tutorial-mobile-app-maui-sign-in-prepare-tenant
• https://learn.microsoft.com/entra/external-id/customers/how-to-mobile-app-maui-sample-sign-in
• https://learn.microsoft.com/entra/external-id/customers/how-to-desktop-app-maui-sample-sign-in
• https://learn.microsoft.com/azure/developer/mobile-apps/azure-mobile-apps/quickstarts/maui/authentication
• https://learn.microsoft.com/entra/msal/dotnet/acquiring-tokens/desktop-mobile/mobile-applications
• Sample app: https://github.com/Azure-Samples/ms-identity-dotnetcore-maui
• Sample app: https://learn.microsoft.com/samples/azure-samples/ms-identity-docs-code-dotnet/ms-identity-docs-code-csharp-maui/
• Sample app: https://learn.microsoft.com/samples/azure-samples/ms-identity-ciam-dotnet-tutorial/ms-identity-ciam-dotnet-tutorial-2-sign-in-maui/

[LapinskasL]

@guardrex Thanks for all the info. I was able to gather some bits and improve my code.

However, the information on how to integrate Entra ID auth into a Blazor Hybrid app is scattered across many places. You can see this by the amount of links you needed to provide and how only a potion of information within them is applicable to Blazor Hybrid.

I'd think Microsoft would have a single page dedicated to adding and explaining Blazor Hybrid auth with Entra ID. They're both Microsoft products after all and, ideally for you, I should have minimal trouble guiding myself into a greater dependency on your products. My research tells me I'm not alone in struggling with this specific issue.

That said, I do think atm I have enough figured out to be sufficient for a production environment. It just took really long to put the pieces together.

Also, I am struggling with mapping the role claim name. I don't have the .AddOpenIdConnect() method and having cookie authentication does not make sense.

To be clear, I do appreciate all the help. I understand Blazor Hybrid is new and will take effort and time to improve and provide solid documentation, especially when you have thousands of other people asking you for stuff.