Blazor WebAssembly Authentication

Configure bearer-token and OpenID Connect authentication for standalone Blazor WebAssembly applications.

Use this authentication model when the browser is responsible for obtaining credentials and the client calls the RecroGrid Framework API directly.

Registration model

A standalone Blazor WebAssembly application typically combines two pieces:

the Blazor OIDC authentication setup that acquires browser-side credentials;
AddRgfBlazorWasmBearerServices(...) so RecroGrid Framework uses the direct bearer-token application model.

builder.Services.AddOidcAuthentication(options =>
{
    builder.Configuration.Bind("Local", options.ProviderOptions);
});

builder.Services.AddRgfBlazorWasmBearerServices(builder.Configuration, logger);

What this enables

The bearer-token registration configures the client in WasmBearer auth mode and prepares the RecroGrid Framework client services for browser-to-API requests.

Use this setup when:

the browser authenticates directly with the identity provider;
the API accepts bearer-token-based requests from the client;
the client should not depend on host-managed session endpoints.

This authentication model belongs together with direct API access. If the host should own sign-in and downstream API traffic, switch to SessionAuth and the host/proxy application model instead.

Provider configuration examples

Configure Microsoft Entra ID or Duende through the corresponding provider-specific OpenID Connect settings.

Microsoft Entra ID

"Oidc": {
  "ProviderOptions": {
    "Authority": "https://login.microsoftonline.com/{TENANT ID}/v2.0",
    "ClientId": "{Application (client) ID}",
    "ResponseType": "code",
    "DefaultScopes": [ "openid", "profile" ]
  },
  "UserOptions": {
    "RoleClaim": "roles"
  }
}

RedirectUri and PostLogoutRedirectUri can be configured when the application requires explicit callback addresses, for example https://localhost:11920/authentication/login-callback.

Duende IdentityServer

"Oidc": {
  "ProviderOptions": {
    "Authority": "{DUENDE}",
    "ClientId": "{CLIENT-ID}",
    "RedirectUri": "{CLIENT-LOGIN-CALLBACK}",
    "ResponseType": "code",
    "DefaultScopes": [ "openid", "profile", "role" ]
  },
  "UserOptions": {
    "RoleClaim": "role"
  }
}

For local development, an authority such as https://localhost:11900, a client ID such as RgfDemo.Client, and a login callback such as https://localhost:11920/authentication/login-callback can be used. PostLogoutRedirectUri can also be configured when required by the application.

RecroGrid Framework API scopes

For direct browser-to-API access, configure the API base address and scopes under Recrovit:RecroGridFramework:API:

"Recrovit": {
  "RecroGridFramework": {
    "API": {
      "BaseAddress": "https://{API-DOMAIN}",
      "DefaultScopes": [ "openid", "profile", "{API-SCOPE}" ]
    }
  }
}

For local development, an API address such as https://localhost:11913 and an API scope such as api://RgfDemo.Api/API.Access can be used.

See Direct API Access for the complete browser-to-API access configuration.

Table of Contents