Migrate to Blazor WebApp instead of Wasm, authentication failure during development #10260

12 Answer(s)

• 

  0

  AI-Bot created 13 days ago

  Support Team ABP Agent

  1. Solution

  The flow on your AuthServer is actually succeeding (authorization code + token). The failure happens after that, when the Blazor WebApp’s OpenIdConnectHandler tries to call /connect/userinfo:

  • AuthServer log:
    The userinfo request was rejected because the mandatory 'access_token' parameter was missing.
  • Blazor WebApp log:
    OpenIdConnectHandler.GetUserInformationAsync(...) -> HttpRequestException 401 Unauthorized

  So:

  • The Blazor WebApp is configured with GetClaimsFromUserInfoEndpoint = true.
  • But the handler is not sending an access token to /connect/userinfo (most commonly because tokens are not saved).

  There are two practical ways to fix this for a Blazor WebApp with ABP/OpenIddict.

  ---

  Option A (recommended): Stop calling the UserInfo endpoint

  In ABP with OpenIddict, the standard user claims (subject, name, email, roles, etc.) are already available in the ID token, as long as you request the right scopes. In most cases you don’t need /connect/userinfo at all.

  Configure your Blazor WebApp authentication like this (Program.cs / Startup):

  builder.Services
      .AddAuthentication(options =>
      {
          options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
          options.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme;
      })
      .AddCookie()
      .AddOpenIdConnect(OpenIdConnectDefaults.AuthenticationScheme, options =>
      {
          options.Authority = configuration["AuthServer:Authority"]; // e.g. https://auth.staging.myproject.io
          options.RequireHttpsMetadata = true;
  
          options.ClientId = "BlazorWebApp";
          options.ClientSecret = configuration["AuthServer:ClientSecret"]; // your client secret
          options.ResponseType = OpenIdConnectResponseType.Code;
          options.UsePkce = true;
  
          // Tokens can still be saved if you want to call APIs later
          options.SaveTokens = true;
  
          // IMPORTANT: disable UserInfo call to avoid your 401 error
          options.GetClaimsFromUserInfoEndpoint = false;
  
          // Request the scopes that ABP/OpenIddict uses to put claims into id_token
          options.Scope.Clear();
          options.Scope.Add("openid");
          options.Scope.Add("profile");
          options.Scope.Add("email");
          options.Scope.Add("phone");
          options.Scope.Add("roles");
          options.Scope.Add("offline_access");
  
          // Plus any API scopes you need, e.g.:
          options.Scope.Add("AuthServer");
          options.Scope.Add("IdentityService");
          options.Scope.Add("AdministrationService");
          options.Scope.Add("SaasService");
          options.Scope.Add("AuditLoggingService");
          options.Scope.Add("GdprService");
          options.Scope.Add("ChatService");
      });
  

  Also ensure that in your AuthServer/OpenIddict client definition for "BlazorWebApp" the same scopes are allowed.

  With GetClaimsFromUserInfoEndpoint = false, the handler will not call /connect/userinfo, so the missing_token / 401 error disappears, and the Blazor WebApp uses the claims in id_token.

  ---

  Option B: Keep UserInfo and send a valid access token

  If you explicitly want to use /connect/userinfo:

  1. Make sure the WebApp saves tokens:

  options.SaveTokens = true;
     options.GetClaimsFromUserInfoEndpoint = true;
  

  2. Keep the same scopes as in option A (so an access token is actually issued).
  3. Ensure your "BlazorWebApp" client in AuthServer:
     • Has those scopes assigned.
     • Issues an access token with an audience accepted by AuthServer’s OpenIddict validation (in your current log the first issue is simply missing token; if you later see “token had no valid audience”, that’s an audience/scope configuration problem).

  But since ABP/OpenIddict already includes the usual claims in id_token, Option A is usually simpler and more robust, especially when migrating from Blazor WASM to Blazor WebApp.

  ---

  2. Sources

  • ABP OpenIddict deployment & validation/audience notes (relevant when using access tokens and UserInfo):
    • https://abp.io/docs/latest/solution-templates/layered-web-application/deployment/openiddict-deployment

  ---

  This response was generated by AI. If it didn’t solve your problem, feel free to post a new answer — our support team will jump in to help you soon.

  Save Cancel
• 

  0

  maliming created 12 days ago

  Support Team Fullstack Developer

  hi

  It seems your Blazor app doesn't get the access token.

  Trying to replace our Blazor Wasm application to WebApp

  Can you check your Blazor app Program.cs and Module.cs code with a new template project?

  The new solution will have two projects.

  Blazor and Blazor.Client, and it uses App.razor and Routes.razor

  Thanks.

  Save Cancel
• 

  0

  carl.hallqvist created 12 days ago

  Thanks,

  The thing is that we started from the Blazor WebApp template without any code from our Blazor Wasm solution.

  Then we started the required Redis instance on the local development machine. We also did the changes in appsettings.json to use our staging environment on Kubernetes cloud.

  Hence, the code is unmodified from the code generator, and we use (same version as all our services and apps, Microservice template 9.2.3).

  The only changes, is the blazor/MyProject.Blazor/Properties/launchSettings.json and */appsettings.json (to get the same port numbers as our old Wasm app).

  However, when we use ABP Studio, it seems it generats for dotnet 10 / ABP 10. Despite "Change version to 9.2.3" in the studio. I guess that can generate problems. How can we generate with Dotnet 9 and 9.2.3?

  Save Cancel
• 

  0

  AI-Bot created 12 days ago

  Support Team ABP Agent

  1. Solution

  ABP Studio always generates the latest stable ABP version it supports (and the corresponding .NET version). That’s why, if your Studio is up‑to‑date and the latest platform version is 10.x, new solutions will target ABP 10 / .NET 10, even if your existing services are on 9.2.3.

  To generate a microservice template on ABP 9.2.3 with .NET 9, use the ABP CLI instead of Studio:

  1. Make sure you have the .NET 9 SDK installed.
  2. Install or update ABP CLI:

  dotnet tool install -g Volo.Abp.Studio.Cli
     # or, if already installed:
     dotnet tool update -g Volo.Abp.Studio.Cli
  

  3. Create a new microservice solution targeting 9.2.3 explicitly:

  abp new MyProject \
       -t microservice-pro \
       -v 9.2.3
  

  Or (non‑Pro template):

  abp new MyProject \
       -t microservice \
       -v 9.2.3
  

  The -v / --version flag is the key part – it forces the solution to be created with that exact ABP version (thus using .NET 9 for ABP 9.x).

  4. Open the generated solution in your IDE and then:
     • Copy over the appsettings.json and launchSettings.json changes you already made.
     • Reapply any small modifications you did in the previous WebApp attempt (if any).
     • Run the solution; it will now be on ABP 9.2.3 / .NET 9, consistent with your existing microservices.

  You can still afterwards open this CLI-generated solution in ABP Studio (for Solution Runner, health checks, etc.); Studio will work fine with a solution created via CLI at 9.2.3 – you just shouldn’t ask Studio to “upgrade/switch to stable 10.x” if you want to stay on 9.2.3.

  If you later decide to move everything to ABP 10 / .NET 10, you can then use abp update or Studio’s upgrade features across the whole solution at once.

  2. Sources

  • ABP CLI usage and --version switch:
    https://abp.io/docs/latest/cli
  • Getting started and solution creation options (Studio vs CLI):
    https://abp.io/get-started

  ---

  This response was generated by AI. If it didn’t solve your problem, feel free to post a new answer — our support team will jump in to help you soon.

  Save Cancel
• 

  0

  maliming created 12 days ago

  Support Team Fullstack Developer

  hi

  How can we generate with Dotnet 9 and 9.2.3?

  You can install the old Studio.

  https://abp.io/api/abp-studio/download/r/windows/abp-studio-1.1.2-stable-full.nupkg

  https://abp.io/docs/latest/studio/version-mapping

  

  Thanks.

  Save Cancel
• 

  0

  carl.hallqvist created 12 days ago

  Thanks,

  I will try to generate a new solution with ABP Studio 1.1.2 instead. However, I need an URL for MacOS (Intel chip).. can you give me that url instead?

  Save Cancel
• 

  0

  AI-Bot created 12 days ago

  Support Team ABP Agent

  1. Solution

  For ABP Studio 1.1.2 on macOS (Intel), you can use this download URL:

  • macOS (Intel) installer:
    https://abp.io/api/abp-studio/download/r/osx/abp-studio-1.1.2-stable-full.nupkg

  Download that package and install ABP Studio from it; this version maps to ABP 9.2.3, so new solutions you generate will target ABP 9.2.3 / .NET 9, matching your existing microservice stack.

  2. Sources

  • ABP Studio–ABP version mapping table:
    • https://abp.io/docs/latest/studio/version-mapping

  ---

  This response was generated by AI. If it didn’t solve your problem, feel free to post a new answer — our support team will jump in to help you soon.

  Save Cancel
• 

  0

  maliming created 11 days ago

  Support Team Fullstack Developer

  hi

  https://abp.io/api/abp-studio/download/r/osx/abp-studio-1.1.2-stable-full.nupkg

  Save Cancel
• 

  0

  carl.hallqvist created 11 days ago

  Thanks,

  Sorry, I don't understand how to install a nupkg file. I thought it was ABP Studio, desktop application I need to download and install?

  Save Cancel
• 

  0

  maliming created 9 days ago

  Support Team Fullstack Developer

  hi

  Can you try with AbpDevTools:

  Make sure you have installed the Studio. Don't uninstall it.

  > dotnet tool update -g AbpDevTools
  
  > abpdev abp-studio switch 1.1.2
  

  Thanks.

  Save Cancel
• 

  0

  carl.hallqvist created 7 days ago

  Thanks!

  That worked, I now can generate new 9.2.3 solutions :-)

  Save Cancel
• 

  0

  maliming created 6 days ago

  Support Team Fullstack Developer

  Great!

  Save Cancel