Blazor WebAssembly Standalone access multiple AAD protected APIs

Viewed 463

I have managed to make default template work (my blazor standalone SPA should acquire tokens for several scopes from different ADApps - webAPIs; I've managed to get token only for one scope at the time even if I defined additionalScopes or defaultaccesstokenscopes).

builder.Services.AddMsalAuthentication(options =>
{
    var config = options.ProviderOptions;
    config.Authentication.Authority = "https://login.microsoftonline.com/tenantID";
    config.Authentication.ClientId = "clientID";
    options.ProviderOptions.DefaultAccessTokenScopes.Add("offline_access");
    options.ProviderOptions.DefaultAccessTokenScopes.Add("https://graph.microsoft.com/user.read");
    options.ProviderOptions.DefaultAccessTokenScopes.Add("https://tenant.crm.dynamics.com/user_impersonation");
    options.ProviderOptions.DefaultAccessTokenScopes.Add("clientID/scope1");
    // tried this too
    // config.AdditionalScopesToConsent.Add("https://tenant.crm.dynamics.com/user_impersonation");
});

Now there is a question on how to get the other tokens because it gets the token only for 'clientID' scope if multiple scopes are mentioned...? and use those tokens from wasm page in HttpClient request?

In angular (with MSAL) this is all done automatically, you define scopes you want and it gets all the tokens. Then it intercepts all requests and adds authorization header and corresponding token by domain of the request.

Is there similar mechanism here or should this be done manually by adding corresponding token for every request and using HttpRequestMessage with HttpClient.SendAsync()?

Obviously for business application there is not much of a use without contacting some kind of protected API, which is usually an app in the same AAD. For example let's say it can be a simple query to the Dynamics CRM's webapi.

0 Answers
Related