I am looking to develop a Blazor hybrid application that would work on android and windows and also a Blazor Web application to serve as a server for the hybrid application. I was looking for the best way to authorize a user on the hybrid application against the web application so they can exchange data via SignalR.
The Microsoft ASP.NET Core Blazor Hybrid authentication and authorization documentation has a couple of samples that contain this comment
private Task<ClaimsPrincipal> LoginWithExternalProviderAsync(){ /* Provide OpenID/MSAL code to authenticate the user. See your identity provider's documentation for details. Return a new ClaimsPrincipal based on a new ClaimsIdentity. */ var authenticatedUser = new ClaimsPrincipal(new ClaimsIdentity()); return Task.FromResult(authenticatedUser);}It doesn't seem to be very helpful? But I'm pretty lost. Most other stuff I've read relates to 3rd party authorization and not authorizing against something like the Blazor Web server that just setup for individual account? Could someone point me in the right direction here?
Do I just create a minimal API on the server like:
app.MapGet("/GetClaimsPrincipal", async (string UserName, string Password) =>{try{ using IServiceScope scope = app.Services.CreateScope(); IServiceProvider services = scope.ServiceProvider; UserManager<IdentityUser> userManager = services.GetRequiredService<UserManager<IdentityUser>>(); SignInManager<IdentityUser> signInManager = services.GetRequiredService<SignInManager<IdentityUser>>(); IHostEnvironmentAuthenticationStateProvider HostAuthentication = services.GetRequiredService<IHostEnvironmentAuthenticationStateProvider>(); AuthenticationStateProvider AuthenticationStateProvider = services.GetRequiredService<AuthenticationStateProvider>(); IdentityUser? user = await userManager.FindByNameAsync(UserName); if (user is not null) { bool valid = await userManager.CheckPasswordAsync(user, Password); if (valid) { ClaimsPrincipal? cp = await signInManager.CreateUserPrincipalAsync(user); return Results.Ok(cp); // Probably needs to serialized. } else { return Results.NotFound(UserName); } } return Results.NotFound(UserName);}catch (Exception ex){ return Results.Problem(ex.Message);}});To pass a ClaimsPrincipal from the Web Application? Or is this off in the completely wrong direction?