What type of ApplicationBuilder should I use in MSAL.NET? I'm using ASP.NET Core Web Api-CodePudding

What I'm trying to achieve is to popup a login browser from MSAL.NET, enter username and password, and used the access token to access Microsoft Graph.

Right now I used PublicClientApplicationBuilder to execute AcquireTokenInteractive to popup the login by MSAL.

I'm using ASP.NET Core Web Api.

The problem is, I'm having issue using PublicClientApplicationBuilder when deployed to IIS. It just stucks and always in Pending state.

Below is my sample code that always in Pending state when deployed to IIS:

        var app = PublicClientApplicationBuilder.Create(clientId)
            .WithDefaultRedirectUri()
            .WithTenantId(tenantId)
            .Build();

        var result = await app.AcquireTokenInteractive(scopes).ExecuteAsync();

And now I read an article from here: https://docs.microsoft.com/en-us/answers/questions/91715/msal-acquiretokeninteractive-code-hangs-infinte-lo.html To use the ConfidentialClientApplicationBuilder. Now the problem is there is no execute in ConfidentialClientApplicationBuilder to popup login browser from MSAL just like the AcquireTokenInteractive.

There are only AcquireTokenSilent, AcquireTokenByAuthorizationCode, AcquireTokenOnBehalfOf, and AcquireTokenForClient. But all of these don't seem to popup a login browser from MSAL.NET

Below is my sample code:

        var confidentialClientApplication = ConfidentialClientApplicationBuilder
         .Create(clientId)
         .WithTenantId(tenantId)
         .WithClientSecret(clientSecret)
         .Build();

        var result = await confidentialClientApplication.AcquireTokenForClient(scopes).ExecuteAsync();

How do I manage to popup a login browser from MSAL by using ConfidentialClientApplicationBuilder?

CodePudding user response：

You should first know about MSAL. You have an asp.net core web app, and you wanna your user to sign in in a popup window and generate access token to call Ms graph api, so you need to refer to this document to integrate azure ad into your web application.

What you mentioned in the question about having issue when deployed to IIS comes from using error method. When you test in your local side with those code, your local computer becomes the sever, it is supposed to work, but if you published the app to IIS, that means the users are hit your app in the client side but the pop up action will appear in the sever side. That's why it always pending.

To sum up here, if you need your users signed in and generate access token with delegate api permission, you should follow the document I post above to realize the feature. But if you can use application permission to generate access token as well, you can then go to use graph SDK with client credential flow to realize it.