I am attempting to make a blazor WASM application with user sign-in using MS authentication configured for multi-tenant which can call an API in the applications host that is also protected by MS authentication setup for multi-tenant.
This scenario is missing from those available when using the project templates to create a new project, all of which use Single tenant authentication.
If I use Visual Studio to create an new Blazor Web Assembly application with Microsoft Identity Platform authentication and ASP.NET core hosting to create the above scnario for Single tenant auth.
Add the required dotnet msidentity tool
and use "Create New" to create new app registrations for the client and the server
The code, configuration and App Registrations generated, will allow me to sign-in as a user from the specified tenant (and only that tenant) and call the API.
On inspection it can be seen that both the gerenated App Registrations are configured to use multi-tenant. I have not modified the app registrations.
However, if I change the tenantID in config from the specified tenant GUID to "organizational" in order to allow sign-in from any organisation the sign-in fails. The failure occurrs because of the call to options.ProviderOptions.DefaultAccessTokenScopes.Add as seen below in the program startup. It does not fail during startup but later during authentication.
builder.Services.AddMsalAuthentication(options =>
{
builder.Configuration.Bind("AzureAd", options.ProviderOptions.Authentication);
options.ProviderOptions.DefaultAccessTokenScopes.Add(builder.Configuration.GetSection("ServerApi")["Scopes"]);
});
The error message returned in the URL looks like this:
https://localhost:7236/authentication/login-failed?message=AADSTS500011: The resource principal named api://********-7da7-468b-a5e1-************ was not found in the tenant named ********-cd7b-4ad2-acc2-************. This can happen if the application has not been installed by the administrator of the tenant or consented to by any user in the tenant. You might have sent your authentication request to the wrong tenant.
Trace ID: ...
Correlation ID: ...
Timestamp: ...
During the sign-in process I am prompted twice but never asked for concent.
If I sign in using a user from the tenant that contains the App Registrations, everything continues to work. The failure only occurs when signing in as a user from a different tenant (one other than the tenant where the app registrations exist).
If I remove the options.ProviderOptions.DefaultAccessTokenScopes.Add call from startup, the sign-in works for both users, but any call to the protected API fails with a 401.
Does anyone know how to make this work?