Blazor webassembly azure ad authentication issue after migration to .net5

[rubeesh]

Blazor webassembly azure ad authentication issue after migration to .net5

Error: AADSTS28000: Provided value for the input parameter scope is not valid because it contains more than one resource. Scope https://graph.microsoft.com/User.Read api://861be009-5e73-4c6c-a095-b6e193522222/API. Access openid profile is not valid.

Scope Code(web assembly):

builder.Configuration.Bind("AzureAd", options.ProviderOptions.Authentication);
    options.ProviderOptions.DefaultAccessTokenScopes.Add("https://graph.microsoft.com/User.Read");
    options.ProviderOptions.DefaultAccessTokenScopes.Add("api://861be009-5e73-4c6c-a095-b6e193522222/API.Access");

[javiercn]

@rubeesh thanks for contacting us.

You need to add one of the scopes to DefaultScopesToConsent. This hasn't changed in 5.0 from 3.1.

[rubeesh]

@rubeesh thanks for contacting us.

You need to add one of the scopes to DefaultScopesToConsent. This hasn't changed in 5.0 from 3.1.

I couldnt find any method 'DefaultScopetoConsent'.
If you are referring to AdditionalScopesToConsent, I tried it and didnt work.

[javiercn]

@rubeesh checkout here for details. If that doesn't work, please provide a minimal repro project so that we can help determine what's missing.

[rubeesh]

Webassembly code:
Programs.cs

           var httpClientName = "AbcApp.Api";
            var apiUrl = "https://localhost:44367/";
            var apiScope = "api://861be009-5e73-4c6c-a095-b6e193522222/API.Access";

            var builder = WebAssemblyHostBuilder.CreateDefault(args);
            builder.RootComponents.Add<App>("app");

            builder.Services.AddHttpClient(httpClientName,
                client => client.BaseAddress = new Uri(apiUrl))
                   .AddHttpMessageHandler(sp => sp.GetRequiredService<AuthorizationMessageHandler>()
                    .ConfigureHandler(new[] { apiUrl }, new[] { apiScope }));

            builder.Services.AddTransient(sp => sp.GetRequiredService<IHttpClientFactory>()
                                .CreateClient(httpClientName));

        builder.Services.AddMsalAuthentication(options =>
            {
                builder.Configuration.Bind("AzureAd", options.ProviderOptions.Authentication);
                       
                
                options.ProviderOptions.DefaultAccessTokenScopes.Add(apiScope );
options.ProviderOptions.AdditionalScopesToConsent.Add("https://graph.microsoft.com/User.Read");
                options.UserOptions.RoleClaim = "roles";
            }).AddAccountClaimsPrincipalFactory<ClaimsFactory>(); 

     //Dependency injections removed code

     await builder.Build().RunAsync();

ClaimsFactory.cs

   public class ClaimsFactory : AccountClaimsPrincipalFactory<RemoteUserAccount>
    {
        public ClaimsFactory(IAccessTokenProviderAccessor accessor) : base(accessor)
        {
        }

        public override async ValueTask<ClaimsPrincipal> CreateUserAsync(RemoteUserAccount account, RemoteAuthenticationUserOptions options)
        {
            var user = await base.CreateUserAsync(account, options);
            if (user.Identity.IsAuthenticated)
            {
                var identity = (ClaimsIdentity)user.Identity;
                var roleClaims = identity.FindAll(identity.RoleClaimType);
                if (roleClaims != null && roleClaims.Any())
                {
                    foreach (var existingClaim in roleClaims)
                    {
                        identity.RemoveClaim(existingClaim);
                    }

                    var rolesElem = account.AdditionalProperties[identity.RoleClaimType];
                    if (rolesElem is JsonElement roles)
                    {
                        if (roles.ValueKind == JsonValueKind.Array)
                        {
                            foreach (var role in roles.EnumerateArray())
                            {
                                identity.AddClaim(new Claim(options.RoleClaim, role.GetString()));
                            }
                        }
                        else
                        {
                            identity.AddClaim(new Claim(options.RoleClaim, roles.GetString()));
                        }
                    }
                }
            }

            return user;
        }
    }

[ghost]

This issue has been resolved and has not had any activity for 1 day. It will be closed for housekeeping purposes.

See our Issue Management Policies for more information.

[rubeesh]

This issue has been resolved and has not had any activity for 1 day. It will be closed for housekeeping purposes.

See our Issue Management Policies for more information.

Not yet resolved

[manasimahajann]

were you able to get it to work?

[rubeesh]

were you able to get it to work?

Followed
https://github.com/guardrex/HostedWASM50AADGroupsAndRolesSample

[javiercn]

@rubeesh Did you get a resolution for this?

[rubeesh]

@rubeesh Did you get a resolution for this?
Resolved.
https://github.com/guardrex/HostedWASM50AADGroupsAndRolesSample