Support for extraQueryParameters in Blazor WASM / MSAL

[umlaufa1]

Issue
I would like to pass a query parameter to a B2C user flow when authenticating my Blazor client app. The query parameter could be used, for example, to change the content on the login screen or lots of other useful things

B2C supports this through their IdentityExperienceFramework. Specifically, you can add the following to your user flow:

<InputClaims>
        <InputClaim ClaimTypeReferenceId="QueryParamName" />
</InputClaims>

MSAL also supports extra parameters using the "extraQueryParameters" type in AuthenticationParameters (https://docs.microsoft.com/en-us/azure/active-directory/develop/msal-js-pass-custom-state-authentication-request)

It appears WASM.Authentication.Msal does not provide access to extraQueryParameters.

Solution I'd like to see
Ideally, I would like the following behavior:

1. A user goes to http://www.myblazorapp.com/customID
2. CustomID is extracted from URL.
3. CustomID passed to my B2C user flow as a query parameter. (This doesn't appear to be supported)
4. My B2C user flow uses the CustomID.

Other Info
I think I could achieve a similar result with a"loginHint" but WASM.Authentication.Msal doesn't appear to support this either. The use of extraQueryParameters would provide the most flexibility. I have not been able to find any interim solution that lets me pass custom state info from my blazer app to a b2c userflow (I hope I am not missing something obvious :- ) )

[ghost]

We've moved this issue to the Backlog milestone. This means that it is not going to be worked on for the coming release. We will reassess the backlog following the current release and consider this item at that time. To learn more about our issue management process and to have better expectation regarding different types of issues you can read our Triage Process.

[johnnybegood]

The extra query parameters are also needed when calling an API that requires interaction: https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-conditional-access-dev-guide#scenario-app-performing-the-on-behalf-of-flow.

[miguelhasse]

This is also essential to allow the use of "id-token-hint"
Azure Active Directory B2C | Pass an ID token hint

[matt-goldman]

Any chance of an update on this? I've worked on three Blazor projects now where we've had to come up with ugly workarounds. I know this might seem minor, but adding this would bring so much joy to so many people's lives! (Well, mine. But I'm sure others too.)

[RMcD]

Does #42580 cover this with it's Dynamic/Extensible approach?

[danroth27]

@javiercn Should this be closed as done as part of #42580?

[iXyles]

Hey @danroth27,

From my testing today, the #42580 does not resolve the issue of adding "custom" parameters.
My understanding by looking at the examples from that feature this should work:

var request = new InteractiveRequestOptions { Interaction = InteractionType.SignIn, ReturnUrl = Navigation.Uri };
request.TryAddAdditionalParameter("random", "value");

But the "random" parameter does not get added to the authentication.
However, the samples @javiercn did was with prompt which works just fine, as it is a regular OAuth parameter. Please feel free to correct me if I am wrong here, but seems like something is still missing to support extraQueryParameters dynamically.

Edit: On a side note, if I would instead do

request.TryAddAdditionalParameter("extraQueryParams", "value");

It would end up write the string value into the request but split up by array indexes, see image for reference;

[danroth27]

@iXyles There were some known issues with dynamic authentication requests and MSAL in .NET 7 RC1. Can you try again with .NET 7 RC2, which was recently released?

[iXyles]

@danroth27 Did a quick test, and the issue is still persistent sadly. Extra query parameters are split up similarly to what I showed above, and custom parameters are not included in the request sent to the IDP.

[javiercn]

@iXyles the code needs to be something like this:

var extraQueryParametersDictionary = new Dictionary<string, string>
{
    ["brand_color"] = "red"
};
request.TryAddAdditionalParameter("extraQueryParameters", JsonSerializer.Deserialize<JsonElement>(JsonSerializer.Serialize(extraQueryParametersDictionary)));

[iXyles]

@javiercn sadly this did not work, the parameter does not get passed when I am testing it locally with RC2.

Image for reference of what I tested with:

[javiercn]

@iXyles this issue is for Azure AD B2C, which uses MSAL.JS.

In your case you seem to be using a different provider, which uses oidc-client.js. The parameter name there is extraQueryParams

[iXyles]

@javiercn Ah right... Forgot that little detail. Thanks for noticing that and cheers for showing a solution to the issue! :)