Standalone Blazor MAUI app with Oqtane as a backend

[mdmontesinos]

I already have an Oqtane site running in production, and now I want to implement a Blazor MAUI app, which won't be implemented with Oqtane but be a standalone app using my Oqtane site as a backend for data and existing users, with custom UI.

However, my main concerns are around login in the MAUI app. How can I implement a login system in my app which uses Oqtane users, receives roles, etc? I would also need to register authentication and authorization so I can use the [Authorize] attribute in my MAUI pages.

In general, how you do work with Oqtane as a headless API and handle auth?

[sbwalker]

@mdmontesinos if you want to utilize a distributed architecture with multiple independent applications then you are going to want to use an Identity Provider (IdP) for managing the security between the various applications. Oqtane is not an Identity Provider... however it can be integrated with an Identity Provider using OAuth2/OIDC. Duende Identity Server is a popular IdP for self-hosted scenarios and there are plenty of cloud options as well.

[mdmontesinos]

@sbwalker Isn't it possible to replicate the current auth setup for Oqtane MAUI version for an independent app? Additionally, Oqtane already contains several endpoints related to login and generating user tokens, can't this be leveraged for the authentication in MAUI rather than having to use an IDP? Otherwise, what's the point of the headless mode in Oqtane if it can't work without an additional external service for auth?

[sbwalker]

@mdmontesinos the "headless" render mode refers to a scenario where you have an Oqtane framework installation - with the web UI disabled (ie. you cannot access the site through a web browser)... and you are instead using the Oqtane.Maui client application to communicate with the Oqtane framework API. The Oqtane.Maui client application supports this model because it utilizes Blazor Hybrid and is actually running the Oqtane.Client razor class library inside a WebView.

[mdmontesinos]

@sbwalker Right, so the headless mode is only intended for a MAUI Oqtane app without web version, but not for external clients integration like I thought. I will have to come up with a custom auth integration for my app then.