Update MsalProvider to use native account broker

CommunityToolkit.Authentication.Msal/CommunityToolkit.Authentication.Msal.csproj

@@ -1,7 +1,8 @@
-<Project Sdk="Microsoft.NET.Sdk">
+<Project Sdk="MSBuild.Sdk.Extras">
 
   <PropertyGroup>
-    <TargetFramework>netstandard2.0</TargetFramework>
+    <TargetFrameworks>netstandard2.0;uap10.0</TargetFrameworks>
+    <TargetPlatformMinVersion>10.0.16299.0</TargetPlatformMinVersion>
 
     <Title>Windows Community Toolkit .NET Standard Auth Services</Title>
     <Description>

CommunityToolkit.Authentication.Msal/MsalProvider.cs

@@ -2,6 +2,7 @@
 // The .NET Foundation licenses this file to you under the MIT license.
 // See the LICENSE file in the project root for more information.
 
+using System;
 using System.Linq;
 using System.Net.Http;
 using System.Net.Http.Headers;
@@ -11,59 +12,86 @@
 using Microsoft.Graph;
 using Microsoft.Identity.Client;
 
+#if WINDOWS_UWP
+using Windows.Security.Authentication.Web;
+#else
+using System.Diagnostics;
+#endif
+
 namespace CommunityToolkit.Authentication
 {
     /// <summary>
     /// <a href="https://github.com/AzureAD/microsoft-authentication-library-for-dotnet">MSAL.NET</a> provider helper for tracking authentication state.
     /// </summary>
     public class MsalProvider : BaseProvider
     {
+        /// <summary>
+        /// A prefix value used to create the redirect URI value for use in AAD.
+        /// </summary>
+        public static readonly string MSAccountBrokerRedirectUriPrefix = "ms-appx-web://microsoft.aad.brokerplugin/";
+
         private static readonly SemaphoreSlim SemaphoreSlim = new (1);
 
+        /// <summary>
+        /// Gets or sets the currently authenticated user account.
+        /// </summary>
+        public IAccount Account { get; protected set; }
+
         /// <inheritdoc />
-        public override string CurrentAccountId => _account?.HomeAccountId?.Identifier;
+        public override string CurrentAccountId => Account?.HomeAccountId?.Identifier;
 
         /// <summary>
-        /// Gets the MSAL.NET Client used to authenticate the user.
+        /// Gets or sets the MSAL.NET Client used to authenticate the user.
         /// </summary>
-        protected IPublicClientApplication Client { get; private set; }
+        public IPublicClientApplication Client { get; protected set; }
 
         /// <summary>
         /// Gets an array of scopes to use for accessing Graph resources.
         /// </summary>
-        protected string[] Scopes { get; private set; }
+        protected string[] Scopes { get; }
 
-        private IAccount _account;
+        /// <summary>
+        /// Initializes a new instance of the <see cref="MsalProvider"/> class using a configuration object.
+        /// </summary>
+        /// <param name="client">Registered ClientId in Azure Acitve Directory.</param>
+        /// <param name="scopes">List of Scopes to initially request.</param>
+        /// <param name="autoSignIn">Determines whether the provider attempts to silently log in upon creation.</param>
+        public MsalProvider(IPublicClientApplication client, string[] scopes = null, bool autoSignIn = true)
+        {
+            Client = client;
+            Scopes = scopes.Select(s => s.ToLower()).ToArray() ?? new string[] { string.Empty };
+
+            if (autoSignIn)
+            {
+                TrySilentSignInAsync();
+            }
+        }
 
         /// <summary>
-        /// Initializes a new instance of the <see cref="MsalProvider"/> class.
+        /// Initializes a new instance of the <see cref="MsalProvider"/> class with default configuration values.
         /// </summary>
-        /// <param name="clientId">Registered ClientId.</param>
+        /// <param name="clientId">Registered client id in Azure Acitve Directory.</param>
         /// <param name="redirectUri">RedirectUri for auth response.</param>
         /// <param name="scopes">List of Scopes to initially request.</param>
-        /// <param name="autoSignIn">Determines whether the provider attempts to silently log in upon instantionation.</param>
-        public MsalProvider(string clientId, string[] scopes = null, string redirectUri = "https://login.microsoftonline.com/common/oauth2/nativeclient", bool autoSignIn = true)
+        /// <param name="autoSignIn">Determines whether the provider attempts to silently log in upon creation.</param>
+        /// <param name="listWindowsWorkAndSchoolAccounts">Determines if organizational accounts should be enabled/disabled.</param>
+        /// <param name="tenantId">Registered tenant id in Azure Active Directory.</param>
+        public MsalProvider(string clientId, string[] scopes = null, string redirectUri = null, bool autoSignIn = true, bool listWindowsWorkAndSchoolAccounts = true, string tenantId = null)
         {
-            var client = PublicClientApplicationBuilder.Create(clientId)
-                .WithAuthority(AzureCloudInstance.AzurePublic, AadAuthorityAudience.AzureAdAndPersonalMicrosoftAccount)
-                .WithRedirectUri(redirectUri)
-                .WithClientName(ProviderManager.ClientName)
-                .WithClientVersion(Assembly.GetExecutingAssembly().GetName().Version.ToString())
-                .Build();
-
+            Client = CreatePublicClientApplication(clientId, tenantId, redirectUri, listWindowsWorkAndSchoolAccounts);
             Scopes = scopes.Select(s => s.ToLower()).ToArray() ?? new string[] { string.Empty };
 
-            Client = client;
-
             if (autoSignIn)
             {
-                _ = TrySilentSignInAsync();
+                TrySilentSignInAsync();
             }
         }
 
         /// <inheritdoc/>
         public override async Task AuthenticateRequestAsync(HttpRequestMessage request)
         {
+            AddSdkVersion(request);
+
             string token;
 
             // Check if any specific scopes are being requested.
@@ -87,7 +115,7 @@ optionsMiddleware is AuthenticationHandlerOption options &&
         /// <inheritdoc/>
         public override async Task<bool> TrySilentSignInAsync()
         {
-            if (_account != null && State == ProviderState.SignedIn)
+            if (Account != null && State == ProviderState.SignedIn)
             {
                 return true;
             }
@@ -108,7 +136,7 @@ public override async Task<bool> TrySilentSignInAsync()
         /// <inheritdoc/>
         public override async Task SignInAsync()
         {
-            if (_account != null || State != ProviderState.SignedOut)
+            if (Account != null || State != ProviderState.SignedOut)
             {
                 return;
             }
@@ -129,10 +157,10 @@ public override async Task SignInAsync()
         /// <inheritdoc />
         public override async Task SignOutAsync()
         {
-            if (_account != null)
+            if (Account != null)
             {
-                await Client.RemoveAsync(_account);
-                _account = null;
+                await Client.RemoveAsync(Account);
+                Account = null;
             }
 
             State = ProviderState.SignedOut;
@@ -144,7 +172,46 @@ public override Task<string> GetTokenAsync(bool silentOnly = false)
             return this.GetTokenWithScopesAsync(Scopes, silentOnly);
         }
 
-        private async Task<string> GetTokenWithScopesAsync(string[] scopes, bool silentOnly = false)
+        /// <summary>
+        /// Create an instance of <see cref="PublicClientApplication"/> using the provided config and some default values.
+        /// </summary>
+        /// <param name="clientId">Registered ClientId.</param>
+        /// <param name="tenantId">An optional tenant id.</param>
+        /// <param name="redirectUri">Redirect uri for auth response.</param>
+        /// <param name="listWindowsWorkAndSchoolAccounts">Determines if organizational accounts should be supported.</param>
+        /// <returns>A new instance of <see cref="PublicClientApplication"/>.</returns>
+        protected IPublicClientApplication CreatePublicClientApplication(string clientId, string tenantId, string redirectUri, bool listWindowsWorkAndSchoolAccounts)
+        {
+            var authority = listWindowsWorkAndSchoolAccounts ? AadAuthorityAudience.AzureAdAndPersonalMicrosoftAccount : AadAuthorityAudience.PersonalMicrosoftAccount;
+
+            var clientBuilder = PublicClientApplicationBuilder.Create(clientId)
+                .WithAuthority(AzureCloudInstance.AzurePublic, authority)
+                .WithClientName(ProviderManager.ClientName)
+                .WithClientVersion(Assembly.GetExecutingAssembly().GetName().Version.ToString());
+
+            if (tenantId != null)
+            {
+                clientBuilder = clientBuilder.WithTenantId(tenantId);
+            }
+
+#if WINDOWS_UWP
+            clientBuilder = clientBuilder.WithBroker();
+#endif
+
+            clientBuilder = (redirectUri != null)
+                ? clientBuilder.WithRedirectUri(redirectUri)
+                : clientBuilder.WithDefaultRedirectUri();
+
+            return clientBuilder.Build();
+        }
+
+        /// <summary>
+        /// Retrieve an authorization token using the provided scopes.
+        /// </summary>
+        /// <param name="scopes">An array of scopes to pass along with the Graph request.</param>
+        /// <param name="silentOnly">A value to determine whether account broker UI should be shown, if required by MSAL.</param>
+        /// <returns>A <see cref="Task"/> representing the result of the asynchronous operation.</returns>
+        protected async Task<string> GetTokenWithScopesAsync(string[] scopes, bool silentOnly = false)
         {
             await SemaphoreSlim.WaitAsync();
 
@@ -153,7 +220,7 @@ private async Task<string> GetTokenWithScopesAsync(string[] scopes, bool silentO
                 AuthenticationResult authResult = null;
                 try
                 {
-                    var account = _account ?? (await Client.GetAccountsAsync()).FirstOrDefault();
+                    var account = Account ?? (await Client.GetAccountsAsync()).FirstOrDefault();
                     if (account != null)
                     {
                         authResult = await Client.AcquireTokenSilent(scopes, account).ExecuteAsync();
@@ -172,14 +239,26 @@ private async Task<string> GetTokenWithScopesAsync(string[] scopes, bool silentO
                 {
                     try
                     {
-                        if (_account != null)
-                        {
-                            authResult = await Client.AcquireTokenInteractive(scopes).WithPrompt(Prompt.NoPrompt).WithAccount(_account).ExecuteAsync();
-                        }
-                        else
+                        var paramBuilder = Client.AcquireTokenInteractive(scopes);
+
+                        if (Account != null)
                         {
-                            authResult = await Client.AcquireTokenInteractive(scopes).WithPrompt(Prompt.NoPrompt).ExecuteAsync();
+                            paramBuilder = paramBuilder.WithAccount(Account);
                         }
+
+#if WINDOWS_UWP
+                        // For UWP, specify NoPrompt for the least intrusive user experience.
+                        paramBuilder = paramBuilder.WithPrompt(Prompt.NoPrompt);
+#else
+                        // Otherwise, get the process by FriendlyName from Application Domain
+                        var friendlyName = AppDomain.CurrentDomain.FriendlyName;
+                        var proc = Process.GetProcessesByName(friendlyName).First();
+
+                        var windowHandle = proc.MainWindowHandle;
+                        paramBuilder = paramBuilder.WithParentActivityOrWindow(windowHandle);
+#endif
+
+                        authResult = await paramBuilder.ExecuteAsync();
                     }
                     catch
                     {
@@ -188,7 +267,7 @@ private async Task<string> GetTokenWithScopesAsync(string[] scopes, bool silentO
                     }
                 }
 
-                _account = authResult?.Account;
+                Account = authResult?.Account;
 
                 return authResult?.AccessToken;
             }

CommunityToolkit.Authentication.Msal/MsalProviderExtensions.cs

@@ -0,0 +1,35 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+// See the LICENSE file in the project root for more information.
+
+using System.Diagnostics;
+using System.Threading.Tasks;
+using Microsoft.Identity.Client.Extensions.Msal;
+
+namespace CommunityToolkit.Authentication.Msal
+{
+    /// <summary>
+    /// Helpers for working with the MsalProvider.
+    /// </summary>
+    public static class MsalProviderExtensions
+    {
+        /// <summary>
+        /// Helper function to initialize the token cache for non-UWP apps. MSAL handles this automatically on UWP.
+        /// </summary>
+        /// <param name="provider">The instance of <see cref="MsalProvider"/> to init the cache for.</param>
+        /// <param name="storageProperties">Properties for configuring the storage cache.</param>
+        /// <param name="logger">Passing null uses the default TraceSource logger.</param>
+        /// <returns>A <see cref="Task"/> representing the result of the asynchronous operation.</returns>
+        public static async Task InitTokenCacheAsync(
+            this MsalProvider provider,
+            StorageCreationProperties storageProperties,
+            TraceSource logger = null)
+        {
+#if !WINDOWS_UWP
+                // Token cache persistence (not required on UWP as MSAL does it for you)
+                var cacheHelper = await MsalCacheHelper.CreateAsync(storageProperties, logger);
+                cacheHelper.RegisterCache(provider.Client.UserTokenCache);
+#endif
+        }
+    }
+}

CommunityToolkit.Authentication.Uwp/WindowsProvider.cs

@@ -110,6 +110,8 @@ public WindowsProvider(string[] scopes = null, WebAccountProviderConfig? webAcco
         /// <inheritdoc />
         public override async Task AuthenticateRequestAsync(HttpRequestMessage request)
         {
+            AddSdkVersion(request);
+
             string token = await GetTokenAsync();
             request.Headers.Authorization = new AuthenticationHeaderValue(AuthenticationHeaderScheme, token);
         }

CommunityToolkit.Graph/Extensions/GraphExtensions.Users.cs

@@ -71,7 +71,7 @@ public static async Task<Stream> GetUserPhoto(this GraphServiceClient graph, str
                 .Photo
                 .Content
                 .Request()
-                .WithScopes(new string[] { "user.readbasic.all" })
+                .WithScopes(new string[] { "user.read" })
                 .GetAsync();
         }
 

Samples/WpfMsalProviderSample/App.xaml.cs

@@ -2,9 +2,9 @@
 // The .NET Foundation licenses this file to you under the MIT license.
 // See the LICENSE file in the project root for more information.
 
-using CommunityToolkit.Authentication;
 using System;
 using System.Windows;
+using CommunityToolkit.Authentication;
 
 namespace WpfMsalProviderSample
 {
@@ -16,8 +16,7 @@ protected override void OnActivated(EventArgs e)
             {
                 string clientId = "YOUR-CLIENT-ID-HERE";
                 string[] scopes = new string[] { "User.Read" };
-                string redirectUri = "http://localhost";
-                ProviderManager.Instance.GlobalProvider = new MsalProvider(clientId, scopes, redirectUri);
+                ProviderManager.Instance.GlobalProvider = new MsalProvider(clientId, scopes);
             }
 
             base.OnActivated(e);

Samples/WpfMsalProviderSample/WpfMsalProviderSample.csproj

@@ -1,8 +1,8 @@
-<Project Sdk="Microsoft.NET.Sdk.WindowsDesktop">
+<Project Sdk="Microsoft.NET.Sdk">
 
   <PropertyGroup>
     <OutputType>WinExe</OutputType>
-    <TargetFramework>netcoreapp3.1</TargetFramework>
+    <TargetFramework>net5.0-windows</TargetFramework>
     <UseWPF>true</UseWPF>
   </PropertyGroup>