Multiple OIDC provider support

[billyjim]

[EDIT by guardrex to update the metadata]

It would be very helpful to show how to provide OIDC authentication for several providers (e.g., Google, Facebook, Microsoft, etc.) for Blazor WASM: how to add a service for each provider and how to override the authentication login to allow users to choose from a selection of providers and send an authentication request to the selected provider.

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: 985b834f-534a-aba6-80a0-d8845adbfc25
• Version Independent ID: d2b5a556-82a4-e939-be68-2357a3d4408f
• Content: Secure an ASP.NET Core Blazor WebAssembly standalone app with the Authentication library
• Content Source: aspnetcore/blazor/security/webassembly/standalone-with-authentication-library.md
• Product: aspnet-core
• Technology: aspnetcore-blazor
• GitHub Login: @guardrex
• Microsoft Alias: riande

[guardrex]

UPDATE (11/21)

Hello @billyjim ... I was just responding to another reader with an update on this. Now that .NET 5 is out 🎉 and we have the new redirect approach for Identity Provider sign in 🎉, I think this will be triaged for work. The pop-up approach with external providers was apparently causing a lot of problems, so I believe we wouldn't have been able to base docs on it.

I'm not sure if management will prefer a reference topic with focused explanations on the minimum configuration or if they'll want a full-blown tutorial. My suggestion is to go with reference material because tutorials take a lot more time to create and maintain.

There's one negative aspect tho to providing coverage. We're getting close to the ⛄ holidays 🎁, and I have a lot of other work to do on existing topics and then I leave for an extended vacation 🏖️. Therefore, I think (guessing) that this issue will be addressed early next year. We'll see how it plays out.

[billyjim]

Thanks for getting in touch, Luke. I'll check it out and await developments. Bill

…

On Sat, 21 Nov 2020 at 10:32, Luke Latham ***@***.***> wrote: *UPDATE (11/21)* Hello @billyjim <https://github.com/billyjim> ... I was just responding to another reader with an update on this. Now that .NET 5 is out 🎉 and we have the *new* redirect approach for Identity Provider sign in 🎉, I think this will be triaged for work. The pop-up approach with external providers was apparently causing a lot of problems, so I believe we wouldn't have been able to base docs on it. I'm not sure if management will prefer a reference topic with focused explanations on the minimum configuration or if they'll want a full-blown tutorial. My suggestion is to go with reference material because tutorials take a lot more time to create and maintain. There's one negative aspect tho to providing coverage. We're getting close to the ⛄ *holidays* 🎁, and I have a lot of other work to do on existing topics and then I leave for an extended vacation 🏖️. Therefore, I think ( *guessing*) that this issue will be addressed early next year. We'll see how it plays out. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#20175 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AFPPLBREKMHPHRYLJIBBQLDSQ7MRHANCNFSM4SNFGOZQ> .

[guardrex]

Sorry for the delay @billyjim ... I'm back from vacation and digging out ⛰️⛏️😅. I can work on this after working one other issue that I should be able to knock out today. If nothing else lands on me, I hope to reach this tomorrow (Wednesday, 1/13). I'll probably go straight to PR with any coverage that I work out, and I'll ping u there when it goes up. If I only have a little content to add, the PR might go up tomorrow. If this turns out to be a lengthier set of updates, then the PR will appear (hopefully 🤞) by the end of the week.

[guardrex]

One thing that was noted is that Facebook isn't an Open ID Connect-based provider ...

dotnet/aspnetcore#21741 (comment)

[guardrex]

Javier has a Google sample here ...

https://github.com/javiercn/BlazorGoogleAuthSample/blob/master/GoogleAuth/Program.cs

(I'm going to log some Note to Self items here for reference, and then I'll see what we're missing and need to address.)

[guardrex]

I can tell u that your request for UI that chooses from among multiple providers for WASM-based apps is a no go/won't fix. As you indicated, the framework doesn't provide it. We (cough cough ... I ... cough 😄) don't have the time to provide that. It's going to be something that either the dev needs to create on their own or the dev needs to find from a 3rd party.

Well 🤔 ... maybe ... It would be nice to provide a bare bones example (snippets only ... not a sample) in a new section of the topic. I'm considering it.

I thought that something was on the roadmap, but not really. It looks like they're working on some auth use cases that pertain to external provider use, but they don't seem to be angling for anything like template-based built-in set up and configuration for external providers.

The main thrust of remarks and examples seems to be to use Identity Server and then configure IdS for the external providers. Of course, that's a hosted solution approach, so it doesn't apply to direct OAuth2 scenarios from the client.

[guardrex]

No additional guidance came in from Javier on the PR. For now, the following approaches can be taken ...

• Find a third-party lib that will do it (but I didn't see one at Awesome Blazor).
• Go with a hosted WASM solution and Identity Server, with IdS configured for the desired IPs.
• Go with Blazor Server and configure as an ASP.NET Core app for the desired IPs.

The product unit will let me know if they come up with an in-box solution for multiple OIDC IP support. You can check their issues (open and closed) to see if anyone has already opened an issue asking for it. If you don't find such an issue, you can open a new issue with them with the request.

https://github.com/dotnet/aspnetcore/issues