Aspnetcore.docs: Blazor auth topic enhancements

[guardrex]

Per @tdykstra https://github.com/aspnet/AspNetCore.Docs/pull/12853#pullrequestreview-254351552 ...

This is a great start for auth documentation. It leans pretty heavily on the reader knowing ASP.NET Core auth already, though. It would be nice to have tutorials on implementing authn/authz in a server-side and in a client-side side project (in the latter case showing how to "Always perform authorization checks on the server within any API endpoints accessed by your client-side app."). Also it would be nice to have documentation on how to add auth to an existing non-auth project, instead of just saying start with an auth template.

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: c9942b0a-a7fb-0d34-9201-af0963affa9e
• Version Independent ID: 19770710-5225-a1ea-e082-65da6ba4a49a
• Content: ASP.NET Core Blazor authentication and authorization
• Content Source: aspnetcore/security/blazor/index.md
• Product: aspnet-core
• Technology: aspnetcore-security
• GitHub Login: @guardrex
• Microsoft Alias: riande

[guardrex]

Cross-linking a few existing topics for authn/authz ...

• Social login provider tokens+claims for Blazor auth
• Google Social login provider for Blazor
• Token Based Authorization using IdentityServer with Blazor
• Signalr Context.User missing on hub
• Logout Flow
• Blazor and multiple auth providers
• How to Access Windows Auth User, when in C# Model?

... and sample app for tokens in Blazor Server: https://github.com/javiercn/blazor-server-aad-sample

[taylorchasewhite]

Thanks, I greatly appreciate this comment! I was thinking the same thing as @guardrex.

[mandalorianbob]

The Client Authentication section needs work. It literally explains only how to make a useless auth that doesn't do anything and does not explain how to make an actual functioning auth flow.

Also I agree 100% with

Also it would be nice to have documentation on how to add auth to an existing non-auth project, instead of just saying start with an auth template.

especially since the templates don't work very well and are constantly changing.

Moreover, I think what would work best here is a real world example using GitHub's (or _somebody's_) OAuth2 flow. I would like a direct example of exactly how to do an actual end to end auth flow. Right now, I am unable to use the documentation to implement a Auth in a Hosted WASM scenario.

[KeithBarrows]

I too am struggling with WASM auth. Using a 3rd party auth service (Eve Online & Okta) I am having difficulty dealing with the returned token - as in the code just errors out with no significant clues.

[guardrex]

@mandalorianbob @KeithBarrows _Everything is in preview_ ... framework bits and docs are brand new and under constant development. These docs are _1st draft_ quality and only went live a couple of weeks ago. They'll be worked forward and improved over the next few months and better by the time we get to the 3.2 release of Blazor WebAssembly.

If you get stuck, hit up the community ...

• Stack Overflow
• ASP.NET Core Slack
• ASP.NET Gitter

... and as a last resort (especially bug reports but also if you can't get something working even with community help) open an issue with engineering ...

https://github.com/dotnet/aspnetcore/issues

Open doc issues as separate issues using the This page feedback button+form at the bottom of the topic. If you want to see all of the docs issues scheduled and in-progress, take a look at the Blazor.Docs project ...

https://github.com/dotnet/AspNetCore.Docs/projects/35

[guardrex]

@mkArtakMSFT Some of the work for this is done. Also, this is going to be superseded by a few more-focused issues to bridge the gap to Identity v2 with the existing Blazor Server topic and then cover Identity platform v2 after the framework evolves. All of the WASM security topics cover the goal of this issue today, including covering the pieces that one would add to a project if not using the template. Both hosting models will get new issues when Identity v2 is adopted.

To get the ball rolling in the vein of this issue, scaffolding is on the menu at https://github.com/dotnet/AspNetCore.Docs/pull/17940, which includes steps to add auth to a Blazor Server project.

As for tutorials, we're using the hybrid approach right now. The topics both cover the reference material and walk the dev through a basic configuration. If we change the approach later and split coverage into pure reference and pure tutorial, let's open a new issue for each effort when they come up. It will be easier to manage the work that way.