Azure portal does not match securing Blazor Webassembly

0
votes

I have only recently been tasked with writing some Business-type web applications, in the past many years I had mostly been working on SQL, services, and other non-client project -- so much of this is all new to me. I have had good success picking up and being productive with hosted Blazor WebAssembly. I need work through how to secure a Webassembly, so google lead me to:

https://docs.microsoft.com/en-us/aspnet/core/blazor/security/webassembly/hosted-with-azure-active-directory?view=aspnetcore-5.0

While I was not very familiar with the Azure portal, the reference seemed quite detailed and I thought this would be straightforward. I tried walking through the steps to Register a server API app in an existing tenant:

  1. Azure Active Directory > App Registrations, New Registrations -- check
  2. Provide Name for the App -- check
  3. Choose supported account types (accounts in this organizational directory) -- check
  4. Leave Redirect URI options to web and don't specify a redirect URI -- check
  5. Clear Permissions > Grant admin consent to openid and offline_access - NOPE, no option on this screen for this, I wonder if that setting has moved or if somehow I don't the permissions to see it.
  6. Having no other choice to proceed, I select Register.

During a quick look, I could not find anything about openid and offline_access. Is it right under my nose, or no longer needed, is the documentation out of date, or is there an easier approach? I didn't proceed further, other than to tinker, to the client app registration as I felt the server registration was not valid. Are there any other bumps in the road on the client application registration as well?

Just for perspective, right now, I am content to just force a login verified against AAD.

Thanks for any help!

1
azureazure-active-directoryblazor-webassembly
I have been diverted off to other things, but will revisit this later this week. Thank you for your detailed reply, I shall accept as answer upon confirming. – Bob N
Hi did you have a chance to confirm my answer? Is there any update? – Allen Wu

1 Answers

1
votes

You are correct. There is no Permissions > Grant admin consent to openid and offline_access under normal AAD | App registrations.

But it indeed has this part under Azure AD B2C.

enter image description here

So I guess the document is not updated to synchronize with the Azure portal.

Don't worry about that. You can skip the step 5. After the Azure AD app is created successfully, you can assign and consent the openid and offline_access under Microsoft Graph permissions. Please note that don't forget to click on Grant admin consent for {your tenant}.

enter image description here