Blazor Web App CSLA 9.0.0 AccountClaimsPrincipalFactory Get error Children could not be evaluated

[jhuerta3]

Hello All,

Im currently working on a Blazor Web App that I upgraded from 6.0 to 9.0 and in our Client.CustomAccountFactory I am trying to fetch user information via the serviceProvider which I am able to create the portal object but both objects "portal" and "objEmployee" read (Children could not be evaluated). Does anyone have an idea on how I can get this to work.

                    var portal = serviceProvider.GetService<Csla.IDataPortalFactory>();
                    var objEmployee = portal.GetPortal<AssetMgmtSystem.Shared.EmployeeEdit>();
                    EmployeeEdit employee = await objEmployee.FetchAsync(userEmail);

[jhuerta3]

Im Looking at this
https://github.com/MarimerLLC/csla/discussions/4486
to see if I can get it working.

[StefanOssendorf]

The link does not work.
Any more information on your use case?
I quite don't understand the actual problem here. 😅

[jhuerta3]

@StefanOssendorf thanks for looking into my question. I think I got it base the discussion 4486. I will post the solution once I get it going.

[jhuerta3]

Hello all,

In the process of converting my CSLA 6.0 app to CSLA 9.0.0 I decided to convert the Blazor Web App with Web API to use Entra and BFF. So, my original question was basically me wanting to get the employee information to store claims.

Below is where I set them on Server program.cs file. Incase someone can use the code!

builder.Services.AddAuthentication(OpenIdConnectDefaults.AuthenticationScheme)
    .AddMicrosoftIdentityWebApp(msIdentityOptions =>
    {
        msIdentityOptions.CallbackPath = "/signin-oidc";
        msIdentityOptions.ClientId = "XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX";
        msIdentityOptions.Domain = "org.onmicrosoft.com";
        msIdentityOptions.Instance = "https://login.microsoftonline.com/";
        msIdentityOptions.ResponseType = "code";
        msIdentityOptions.TenantId = "XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX";
        msIdentityOptions.ClientSecret = "SOME SECRETE";
        //msIdentityOptions.ClientSecret = AzureHelper.GetKeyVaultSecret(tenantId, vaultUri, secretName);

        // Replace OnTokenValidated
        msIdentityOptions.Events.OnTokenValidated = async context =>
        {
            var identity = (ClaimsIdentity)context.Principal.Identity;
            ClaimsPrincipal claimsPrincipal = context.Principal;

            if (identity != null && identity.IsAuthenticated)
            {
                string userEmail = identity.Claims.FirstOrDefault(c => c.Type == "preferred_username")?.Value;

                // Resolve ITokenAcquisition
                var tokenAcquisition = context.HttpContext.RequestServices
                    .GetRequiredService<ITokenAcquisition>();

                //// Define your scopes (match Azure AD app registration)
                ////var scopes = new[] { "https://<Tenant>/<ApiId>/access_as_user" };
                var scopes = new[] { "api://XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX/Read" };

                // Pass the context.Principal because HttpContext.User isn't set yet
                var accessToken = await tokenAcquisition
                    .GetAccessTokenForUserAsync(scopes, null, null, context.Principal)
                    .ConfigureAwait(false);

                // Call the downstream API
                var clientFactory = context.HttpContext.RequestServices
                    .GetRequiredService<IHttpClientFactory>();
                var client = clientFactory.CreateClient();
                client.BaseAddress = new Uri("https://localhost:xxxx/");
                client.DefaultRequestHeaders.Authorization =
                    new AuthenticationHeaderValue("Bearer", accessToken);


                var employee = await client.GetFromJsonAsync<Employee>($"/api/claims?email={userEmail}") ??
                                throw new IOException("No Employee!");


                if (employee != null)
                {
                    if (employee != null)
                    {
                        identity.AddClaim(new Claim("EmployeeID", employee.EmployeeID.ToString()));
                        identity.AddClaim(new Claim("EmployeeNumber", employee.EmployeeNumber.ToString()));
                        identity.AddClaim(new Claim("EmployeeDeptID", employee.DepartmentID.ToString()));
                        identity.AddClaim(new Claim("EmployeeName", employee.DisplayName.ToString()));
                    }
                }
            }
        };

    })
    .EnableTokenAcquisitionToCallDownstreamApi()
    .AddDownstreamApi("DownstreamApi", configOptions =>
    {
        configOptions.BaseUrl = "https://localhost:XXXX/";
        configOptions.Scopes = [
            "api://XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX/Read"
        ];
    })
    .AddInMemoryTokenCaches();