Goal

Integrate BlazorAuthenticationChallengeHandler and LoginLogoutEndpointRouteBuilderExtensions from .github/skills/entra-id-aspire-authentication/ into the main Microsoft.Identity.Web NuGet package.

Tasks

1. Create new Blazor subfolder and move files

Create src/Microsoft.Identity.Web/Blazor/ folder with these files (copy from .github/skills/entra-id-aspire-authentication/):

• BlazorAuthenticationChallengeHandler.cs - Handles authentication challenges for Blazor Server components (incremental consent, Conditional Access)
• LoginLogoutEndpointRouteBuilderExtensions.cs - Extension method MapLoginAndLogout() for OIDC endpoints

Keep the namespace as Microsoft.Identity.Web (already correct in source files).

Add XML doc <remarks> noting these are for Blazor Server scenarios.

2. Unit Tests

Create tests/Microsoft.Identity.Web.Test/Blazor/ folder with:

• BlazorAuthenticationChallengeHandlerTests.cs - Test:

  • GetUserAsync returns ClaimsPrincipal from AuthenticationStateProvider
  • IsAuthenticatedAsync returns correct bool based on identity state
  • HandleExceptionAsync detects MicrosoftIdentityWebChallengeUserException (and as InnerException)
  • ChallengeUser builds correct URL with scopes, loginHint, domainHint, claims parameters
  • GetLoginHint extracts from "preferred_username" or "login_hint" claims
  • GetDomainHint returns "consumers" for MSA tenant, "organizations" otherwise

• LoginLogoutEndpointRouteBuilderExtensionsTests.cs - Test:

  • /login endpoint sets correct AuthProperties with scope, loginHint, domainHint, claims
  • /logout endpoint signs out from both Cookie and OIDC schemes
  • GetAuthProperties validates returnUrl (prevents open redirects, handles relative/absolute URLs)

3. Create minimal Aspire DevApp

Create tests/DevApps/AspireBlazorCallsWebApi/ with this structure:

AspireBlazorCallsWebApi/
├── AspireBlazorCallsWebApi.sln
├── AspireBlazorCallsWebApi.AppHost/
│   ├── AspireBlazorCallsWebApi.AppHost.csproj
│   └── Program.cs
├── AspireBlazorCallsWebApi.ServiceDefaults/
│   ├── AspireBlazorCallsWebApi.ServiceDefaults.csproj
│   └── Extensions.cs
├── AspireBlazorCallsWebApi.ApiService/
│   ├── AspireBlazorCallsWebApi.ApiService.csproj
│   ├── Program.cs
│   └── appsettings.json
└── AspireBlazorCallsWebApi.Web/
    ├── AspireBlazorCallsWebApi.Web.csproj
    ├── Program.cs
    ├── appsettings.json
    ├── WeatherApiClient.cs
    └── Components/
        ├── _Imports.razor
        ├── App.razor
        ├── Routes.razor
        ├── UserInfo.razor
        ├── Layout/
        │   ├── MainLayout.razor
        │   └── NavMenu.razor
        └── Pages/
            ├── Home.razor
            └── Weather.razor

Credentials to use (reuse from WebAppCallsWebApiCallsGraph DevApp):

For API (AspireBlazorCallsWebApi.ApiService/appsettings.json):

{
  "AzureAd": {
    "Instance": "https://login.microsoftonline.com/",
    "Domain": "id4slab1.onmicrosoft.com",
    "TenantId": "10c419d4-4a50-45b2-aa4e-919fb84df24f",
    "ClientId": "a021aff4-57ad-453a-bae8-e4192e5860f3",
    "Scopes": "access_as_user"
  }
}

For Web App (AspireBlazorCallsWebApi.Web/appsettings.json):

{
  "AzureAd": {
    "Instance": "https://login.microsoftonline.com/",
    "Domain": "id4slab1.onmicrosoft.com",
    "TenantId": "10c419d4-4a50-45b2-aa4e-919fb84df24f",
    "ClientId": "a599ce88-0a5f-4a6e-beca-e67d3fc427f4",
    "CallbackPath": "/signin-oidc",
    "ClientCertificates": [
      {
        "SourceType": "StoreWithDistinguishedName",
        "CertificateStorePath": "LocalMachine/My",
        "CertificateDistinguishedName": "CN=LabAuth.MSIDLab.com"
      }
    ]
  },
  "WeatherApi": {
    "Scopes": ["api://a021aff4-57ad-453a-bae8-e4192e5860f3/access_as_user"]
  }
}

Key implementation points for DevApp:

1. API Program.cs: Use AddMicrosoftIdentityWebApi + RequireAuthorization() on /weatherforecast endpoint
2. Web Program.cs:
   • Use AddMicrosoftIdentityWebApp + EnableTokenAcquisitionToCallDownstreamApi + AddInMemoryTokenCaches
   • Register BlazorAuthenticationChallengeHandler as scoped service
   • Configure WeatherApiClient HttpClient with AddMicrosoftIdentityMessageHandler
   • Map /authentication group with MapLoginAndLogout()
3. Weather.razor: Include try/catch with ChallengeHandler.HandleExceptionAsync() pattern
4. UserInfo.razor: Show login/logout UI based on auth state
5. Routes.razor: Use AuthorizeRouteView

4. Important Notes

• Do NOT update .github/skills/entra-id-aspire-authentication/SKILL.md - that will be done post-release
• Do NOT update docs/frameworks/aspire.md references to "copy from skill folder" - that will be done post-release
• The DevApp should reference the local Microsoft.Identity.Web project, not the NuGet package

References

• Source files: `.github/skills/entra-id-aspire-authentication/BlazorAuthenticationChallengeHandler....