PnP Core SDK Azure Authentication

[indieza]

• Question

Hello,
I have simple Blazor application with Login and Register Logic. Each registered user has information for his Azure credentials for accessing SharePoint (TenantID, ClientID). Is there some way to make something like a authentications service which will receive those credentials and will guarantees an access to Azure for a target user. To simplify the question.

I have 3 Blazor Components, for each component I have different logic (Create List, Create Content Type, Create List Item etc.) and I want each logged in user with his own credentials which are stored in the database(TenantID, ClientID) to authenticate in front of Azure and execute some of the operations.

Regards,
Simeon Valev

[jansenbe]

@indieza : not sure if I fully get the scenario @indieza , but to me this is about building a multi-tenant application. Did you consider the following:

• Create a multi-tenant Azure AD application ~ all of your "customers" can consent to this application, essentially making it available in their own Azure AD
• A user of tenant A logs in (e.g. via our interactive auth provider and allows you to make calls to SharePoint from within your Blazor application

Now when you want to call into an Azure hosted service you'd want to that as the user that signed in to your Blazor application and that's something that can be done using the on-behalf-of flow (see https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-on-behalf-of-flow for the documentation). A nice .NET sample is this one: https://github.com/Azure-Samples/ms-identity-aspnet-webapi-onbehalfof.

While above .NET sample shows how to code things using MSAL I think it's just easier to use the OnBehalfOfAuthenticationProvider from PnP Core SDK. @s-KaiNet has written a great example that shows how to this: https://spblog.net/post/2020/12/10/how-to-access-sharepoint-data-from-azure-function-with-spfx-and-pnp-core#mcetoc_1ep3p36h462i

[indieza]

Well, I have page for creating some list in SharePoint website and I want to give chance to the user to put his Azure credentials and website url dynamicly in text input fields, without putting them into the appsetting.json file, hard-code them etc.

[indieza]

@jansenbe
Here I upload some images which will describe what I am looking for. I want every user to setup his credential in his Account and after that when open the page, Create Website, automatically after loading the page to setup pnpContext which will be able to create a new SharePoint website.

Image 1
https://drive.google.com/file/d/1M0MvKnStvh7kCWd1V5siPNMKmm3kQ4h4/view?usp=sharing
Image 2
https://drive.google.com/file/d/1eeNniPnDFtUjYil9kpLtUteMjeLTrPA3/view?usp=sharing

Regards,
Simeon Valev

[jansenbe]

@indieza : did above work? If so, please flag as answer so that others can more confidently reuse the answer

[indieza]

@jansenbe: I apologize but it isn't work for me. My scenario is much simple. I don't want to receive user email and password. I only want to setup PnPContext based on Azure TenantID and ClientID. I want user to enter them into his profile page(Image which I upload previously). After when he setup the both credentials into his profile I want to give him a chance to create PnPContext based on that ClientID and TenantID. I have same logic but for WinForms application, I need it for a Server-Side Blazor application

` var host = Host.CreateDefaultBuilder()

        .ConfigureServices((hostingContext, services) =>
        {
            services.AddPnPCore(options =>
            {
                options.DefaultAuthenticationProvider = new InteractiveAuthenticationProvider(
                        mySettingsConfig.ClientId,
                        mySettingsConfig.TenantId,
                        mySettingsConfig.RedirectUrl);
            });
        })

        .UseConsoleLifetime()
        .Build();

        await host.StartAsync();

        using (var scope = host.Services.CreateScope())
        {
            var pnpContextFactory = scope.ServiceProvider.GetRequiredService<IPnPContextFactory>();
            using (var context = await pnpContextFactory.CreateAsync(new Uri(this.WebsiteUrlTextBox.Text)))
            {
                this.web = await context.Web.GetAsync();
                var lists = this.web.Lists.ToList();
                this.AllListsComboBox.Items.AddRange(lists.Select(x => x.Title).ToArray());
            }
        }

        host.Dispose(); `

Regards,
Simeon Valev

[jansenbe]

Maybe our ASP.NET Core sample can help : https://pnp.github.io/pnpcore/demos/Demo.ASPNetCore/README.html

This sample uses the ExternalAuthenticationProvider which takes an access token, so in the case of the sample to code relies on he ASP.NET Core auth setup but then reuses that to get the access token for working with Microsoft 365. See https://github.com/pnp/pnpcore/blob/dev/samples/Demo.ASPNetCore/Controllers/HomeController.cs#L134-L144

[indieza]

@jansenbe: Yes, but again the Azure Credentials are passed via appsettings.json file, I want to pass them dynamically for each user.

Regards,
Simeon Valev

[jansenbe]

Seems like you want to build a service that can be used by multiple tenants/users, the common scenario then is to create a multi tenant application that defines the needed permissions and then have the user/admin of each tenant consent to your multi-tenant application. When you ask the user to enter an application id you never know what permissions there where granted to that app, so your code might work or fail...

The code sample I shared above can be re-used in ASP.NET (the interactive provider is in comments above the username/password one), but you can also directly use MSAL or Microsoft.Identity.Web (see https://docs.microsoft.com/en-us/azure/active-directory/develop/sample-v2-code#web-applications for samples) in combination with the ExternalAuthenticationProvider.