Blazor WebAssembly Authentication

This page publishes the canonical bearer-token and OIDC authentication guidance for standalone Blazor WebAssembly applications.

Use this authentication model when the browser is responsible for obtaining credentials and the client calls the RecroGrid Framework API directly.

Registration model

A standalone Blazor WebAssembly application typically combines two pieces:

the Blazor OIDC authentication setup that acquires browser-side credentials;
AddRgfBlazorWasmBearerServices(...) so RecroGrid Framework uses the direct bearer-token application model.

builder.Services.AddOidcAuthentication(options =>
{
    builder.Configuration.Bind("Local", options.ProviderOptions);
});

builder.Services.AddRgfBlazorWasmBearerServices(builder.Configuration, logger);

What this enables

The bearer-token registration configures the client in WasmBearer auth mode and prepares the RecroGrid Framework client services for browser-to-API requests.

Use this setup when:

the browser authenticates directly with the identity provider;
the API accepts bearer-token-based requests from the client;
the client should not depend on host-managed session endpoints.

This authentication model belongs together with direct API access. If the host should own sign-in and downstream API traffic, switch to SessionAuth and the host/proxy application model instead.

Provider configuration examples

The following provider-specific settings preserve the Microsoft Entra ID and Duende examples previously documented under RecroSec authentication.

Microsoft Entra ID

"Oidc": {
  "ProviderOptions": {
    "Authority": "https://login.microsoftonline.com/{TENANT ID}/v2.0",
    "ClientId": "{Application (client) ID}",
    "ResponseType": "code",
    "DefaultScopes": [ "openid", "profile" ]
  },
  "UserOptions": {
    "RoleClaim": "roles"
  }
}

RedirectUri and PostLogoutRedirectUri can be configured when the application requires explicit callback addresses, for example https://localhost:11920/authentication/login-callback.

Duende IdentityServer

"Oidc": {
  "ProviderOptions": {
    "Authority": "{DUENDE}",
    "ClientId": "{CLIENT-ID}",
    "RedirectUri": "{CLIENT-LOGIN-CALLBACK}",
    "ResponseType": "code",
    "DefaultScopes": [ "openid", "profile", "role" ]
  },
  "UserOptions": {
    "RoleClaim": "role"
  }
}

Existing examples use an authority such as https://localhost:11900, a client ID such as RgfDemo.Client, and a login callback such as https://localhost:11920/authentication/login-callback. PostLogoutRedirectUri can also be configured when required by the application.

RecroGrid Framework API scopes

For direct browser-to-API access, the previous configuration guidance also defined the API base address and scopes under Recrovit:RecroGridFramework:API:

"Recrovit": {
  "RecroGridFramework": {
    "API": {
      "BaseAddress": "https://{API-DOMAIN}",
      "DefaultScopes": [ "openid", "profile", "{API-SCOPE}" ]
    }
  }
}

Existing examples use API addresses such as https://localhost:11913 and an API scope such as api://RgfDemo.Api/API.Access.

See Direct API Access for the complete browser-to-API access configuration.

Table of Contents