Blazor Authentication (Hosted Web Assembly) via External Social Login Providers doesn't redirect to server endpoint on callback url to complete authentication state in deployed environment (Azure App Service)

[codemonarchs]

Is there an existing issue for this?

• I have searched the existing issues

Describe the bug

I added social login providers to a blazor WebAssembly hosted application but after authenticating successfully with the external provider (Google, Facebook, Microsoft), when redirected back to the application the Blazor Web Assembly says "Sorry, there's nothing at this address". This happens online in an app service but works just fine locally and completes the auth flow.

The callback URL is this after successfully authenticating with Google (in the cloud):
https://salonbook.azurewebsites.net/signin-google?state=CfDJ8OUpBNa5vkxGsVDiDNN1Ofny2tL4FoD_iq5ziBb0xJyxhVbw2pCW9egSkk85-gw6D1IAWytmhgu4AfibpNTIWe7cX_Bo2zZjXlznSiPmZ2AD_Nv2X_bOcihyhhHsYvY_KswlmYDp6oppy95jR0T6RX_DwlxdXE6XrhmaSXKZ1v7dBMbY4prI_-SyG__vUpSkE-jP69weJ4Ry5thnJaC-jLO-x3dy4_ZIcc4bCFpnmz1fQiFqGzfp2rUJD73Pk9StBbGb2gkNbI2ovo2eIk9DmztjgVN5aTsW3v5XQA56bRQVAI10sI3iXR_YfN6whiPlEw8F7RevJWzvVD5WJXEIi-hxRI7l2rnvm12lfm9QVh1O7C14YaabFae_-EZH6cLVwa8mYBV9EAj6GqiktNku81eP392h2VnVssNPC0I96xacHd90FjDzU-eqLn70f-Bk6F-mviNSJjtyHnRNW4M_VfItXKtwEsN6LcfYetVZpW-pothkS5t4Wbwf9yYzn-TR-LxRQpRrUUS4kQSjXzopHVFQqV1_oO5p8iwnvR3-vk44x251gLq3ssByesQDxYctBpYPOlpzrFkefkbs6ON0EkBepxKER61JIhA2W9YfctDF6gpwHF1y7lCGt9t1AceW9wHFtHmfjtjL0GF8IR13hgrsYJiTRkjXlIEvfls5GfstDOnYYEWp2Q6LPwbAYyTn0I14I1spX2K2UubUvWaCv1hklgeWDxkNxerY48swsDg1n04Kia1EgT6UYhqDSJqwN3V8XdFitXUBoi834g8DXLHJ72PKmucO7ViD1YRfCz1YQgGH1m4FWtFIX3XJXzwimR8wu7FdvcKmSft2LFdd9-I&code=4%2F0AfgeXvshtWBC4pvOTJk4SB5_esQtqWr2MN9YonL-IDEHePpvjQ9CTHRROmUCuSDqiOnIiA&scope=email+profile+https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fuserinfo.email+openid+https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fuserinfo.profile&authuser=0&prompt=none

The resulting page it navigates to looks like this in the cloud:

The resulting page it navigates to looks like this locally:

As mentioned before, locally this isn't an issue and the auth flow completes but doesn't complete when deployed to the cloud. Perhaps there's some server configuration that needs to happen in the App Service? I'm just not sure anymore. Username/password authentication works just fine for registering/logging in but external does not.

The GitHub repo with code is here (app settings removed): https://github.com/codemonarchs/salonbook-debug

Expected Behavior

1. Login in with external auth provider (Google, Facebook, Microsoft).
2. Returns to application and logs in successfully.

Steps To Reproduce

1. Create a Blazor Web Assembly ASP.NET Core Hosted Progressive Web Application using Duende Identity server and configure social login providers.
2. Deploy to the cloud.
3. Login with social login provider.
4. Observe login flow doesn't complete in the cloud but does locally.

The GitHub repo with code is here (app settings removed): https://github.com/codemonarchs/salonbook-debug

Exceptions (if any)

No response

.NET Version

6.0.402

Anything else?

.NET SDK (reflecting any global.json):
Version: 6.0.402
Commit: 6862418796

Runtime Environment:
OS Name: Windows
OS Version: 10.0.22621
OS Platform: Windows
RID: win10-x64
Base Path: C:\Program Files\dotnet\sdk\6.0.402\

global.json file:
Not found

Host:
Version: 6.0.10
Architecture: x64
Commit: 5a400c212a

.NET SDKs installed:
5.0.302 [C:\Program Files\dotnet\sdk]
6.0.401 [C:\Program Files\dotnet\sdk]
6.0.402 [C:\Program Files\dotnet\sdk]

.NET runtimes installed:
Microsoft.AspNetCore.All 2.1.28 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.All]
Microsoft.AspNetCore.App 2.1.28 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 3.1.17 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 3.1.30 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 5.0.8 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 6.0.10 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.NETCore.App 2.1.28 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 3.1.17 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 3.1.30 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 5.0.8 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 6.0.8 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 6.0.10 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.WindowsDesktop.App 3.1.17 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
Microsoft.WindowsDesktop.App 3.1.30 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
Microsoft.WindowsDesktop.App 5.0.8 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
Microsoft.WindowsDesktop.App 6.0.8 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
Microsoft.WindowsDesktop.App 6.0.10 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]

Download .NET:
https://aka.ms/dotnet-download

Learn about .NET Runtimes and SDKs:
https://aka.ms/dotnet/runtimes-sdk-info

[codemonarchs]

I guess just another note. Not sure if this helps or not:

Looking at the logs from the app service I'm seeing this:
[Information] "Duende.IdentityServer.Events.DefaultEventService": TokenIssuedFailureEvent { ClientId: "SalonBook.Client", ClientName: "SalonBook.Client", RedirectUri: "https://salonbook.azurewebsites.net/authentication/login-callback", Endpoint: "Authorize", SubjectId: null, Scopes: "SalonBook.ServerAPI openid profile", GrantType: "authorization_code", Error: "login_required", ErrorDescription: null, Category: "Token", Name: "Token Issued Failure", EventType: Failure, Id: 2001, Message: null, ActivityId: "80000374-0001-ec00-b63f-84710c7967bb", TimeStamp: 12/06/2022 21:57:53, ProcessId: 10460, LocalIpAddress: "10.0.0.4:443", RemoteIpAddress: "138.186.29.40" }

It's saying the login callback is https://salonbook.azurewebsites.net/authentication/login-callback which is similar to what I have locally which is https://localhost:7007/authentication/login-callback. I added the redirect url in google, facebook, and microsoft but still the same thing where it can't find the page and auth doesn't complete.

Google Redirects:

Facebook Redirects:

Microsoft Redirects:

[codemonarchs]

I've also upgraded to .NET 7 and that doesn't seem to have any effect. I added app configuration for identity server to the app configuration as well:
Key: IdentityServer:Clients:SalonBook.Client:Profile
Value: IdentityServerSPA

...but that also doesn't seem to do anything.

App Service Configuration (secrets removed):

[ { "name": "APPINSIGHTS_INSTRUMENTATIONKEY", "value": "<removed>", "slotSetting": true }, { "name": "APPINSIGHTS_PROFILERFEATURE_VERSION", "value": "1.0.0", "slotSetting": true }, { "name": "APPINSIGHTS_SNAPSHOTFEATURE_VERSION", "value": "1.0.0", "slotSetting": true }, { "name": "APPLICATIONINSIGHTS_CONNECTION_STRING", "value": "<removed>", "slotSetting": false }, { "name": "ApplicationInsightsAgent_EXTENSION_VERSION", "value": "~2", "slotSetting": true }, { "name": "ASPNETCORE_ENVIRONMENT", "value": "Development", "slotSetting": false }, { "name": "ASPNETCORE_HOSTINGSTARTUPASSEMBLIES", "value": "Microsoft.Azure.SignalR", "slotSetting": false }, { "name": "Authentication:Facebook:AppId", "value": "<removed>", "slotSetting": false }, { "name": "Authentication:Facebook:AppSecret", "value": "<removed>", "slotSetting": false }, { "name": "Authentication:Google:ClientId", "value": "<removed>", "slotSetting": false }, { "name": "Authentication:Google:ClientSecret", "value": "<removed>", "slotSetting": false }, { "name": "Authentication:Microsoft:ClientId", "value": "<removed>", "slotSetting": false }, { "name": "Authentication:Microsoft:ClientSecret", "value": "<removed>", "slotSetting": false }, { "name": "Azure__SignalR__ConnectionString", "value": "<removed>", "slotSetting": false }, { "name": "Azure__SignalR__StickyServerMode", "value": "Required", "slotSetting": false }, { "name": "DiagnosticServices_EXTENSION_VERSION", "value": "~3", "slotSetting": true }, { "name": "IdentityServer:Clients:SalonBook.Client:Profile", "value": "IdentityServerSPA", "slotSetting": false }, { "name": "InstrumentationEngine_EXTENSION_VERSION", "value": "~1", "slotSetting": true }, { "name": "LicenseKeys:IdentityServer", "value": "<removed>", "slotSetting": false }, { "name": "LicenseKeys:Syncfusion", "value": "<removed>", "slotSetting": false }, { "name": "SendGrid:Key", "value": "<removed>", "slotSetting": false }, { "name": "SnapshotDebugger_EXTENSION_VERSION", "value": "~1", "slotSetting": true }, { "name": "Stripe:Secret", "value": "<removed>", "slotSetting": false }, { "name": "Stripe:WebhookSigningKey", "value": "<removed>", "slotSetting": false }, { "name": "WEBSITE_NODE_DEFAULT_VERSION", "value": "6.9.1", "slotSetting": false }, { "name": "XDT_MicrosoftApplicationInsights_BaseExtensions", "value": "~1", "slotSetting": true }, { "name": "XDT_MicrosoftApplicationInsights_Java", "value": "1", "slotSetting": false }, { "name": "XDT_MicrosoftApplicationInsights_Mode", "value": "recommended", "slotSetting": true }, { "name": "XDT_MicrosoftApplicationInsights_NodeJS", "value": "1", "slotSetting": true }, { "name": "XDT_MicrosoftApplicationInsights_PreemptSdk", "value": "disabled", "slotSetting": true } ]

[codemonarchs]

Perhaps this? https://learn.microsoft.com/en-us/aspnet/core/blazor/progressive-web-app?view=aspnetcore-7.0&tabs=visual-studio#support-server-rendered-pages

[codemonarchs]

Yep that was it. Had to add all the external auth routes to the service-worker.published.js file so it didn't serve up the index.html file.

Be cool if the docs for Web Assembly Hosted with PWA were updated to reflect this in regards to external authentication. I only found this by stumbilng upon another service worker error that was happening.

For anyone else that may come across this same error you only need the signin-{provider} redirect URL's in your app registrations and then to update the service-worker.published.js file screenshotted above to enable this if your Web Assembly app is setup as a PWA.

[surayya-MS]

Thanks for contacting us. Glad that you were able to find the docs which helped you solve the problem. Given that the guidance is already documented there is no further action pending for us here. So closing this