Access token

As explained in .NET MAUI in Action

An access token is a credential that authorizes a client to access protected resources on behalf of a principal.

An access token lets an authenticated app call protected API routes. In an OAuth2 browser login, the app sends the user to an identity provider rather than handling the password itself. After login, the provider redirects back with a code; OidcClient processes the response and returns the tokens needed by the app. section 8.1.2

Figure 8.3 Step 1: Call the LoginAsync method of the OidcClient package. Step 2: The OidcClient package will call WebAuthenticator and display the login page on IdentityServer. Step 3: The user will log in to IdentityServer. Step 4: IdentityServer returns the result via WebAuthenticator. Step 5: The parsed result is returned to OidcClient. Step 6: OidcClient extracts the JWT from the result and returns it to the caller of the LoginAsync method.

The login path moves from OidcClient to WebAuthenticator and the identity provider, then returns a parsed response whose JWT is extracted for the caller. section 8.1.2

To make authenticated API calls without repeating header code:

• Configure OidcClient with the authority, client ID, scope, redirect URI, and a browser implementation backed by WebAuthenticator. section 8.1.2
• Complete LoginAsync and keep the successful result’s access token for the API client. section 8.3.2
• Associate a DelegatingHandler with HttpClient so every request receives the token header automatically. section 8.3.2

Attach the token through an HTTP pipeline

After a successful login, assign loginResult.AccessToken to the handler’s token value. Its SendAsync override adds that value to each request before passing the request to the base handler. Requests that omit the required header are not authorized. section 8.3.2

A mobile or desktop redirect uses a custom URL scheme registered with the operating system, allowing the identity provider’s browser response to return to the app. Android, iOS, macOS, and Windows each require platform-specific registration. section 8.1.2

How .NET MAUI in Action covers it

How deep it goes

Walks through browser login, redirect handling, token extraction, and automatic header attachment; leaves login-error handling as TODO.

Examples

Uses MauiStockTake login, a custom callback URL scheme, AuthService, and an AuthHandler that modifies outgoing requests.

What you can do after

Apply it via OidcClient, WebAuthenticator, and DelegatingHandler to authenticate and send authorized HttpClient requests.

How it connects

Connects OAuth2, OpenID Connect, IdentityServer, WebAuthenticator, redirect URIs, DelegatingHandler, HttpClient, and dependency injection.

liveBookmanning.com

Read .NET MAUI in Action on liveBook Get the book at manning.com

Related concepts

• authenticationused by · Authentication is the process of establishing or verifying the identity of a user, service, device, or other communicating entity.
• HTTP Authorization headerused by · The HTTP Authorization header is a request header that carries credentials or other authentication or authorization information for accessing a resource.
• single sign-onused by · Single sign-on is an authentication arrangement in which one authentication event enables a user to access multiple applications or services without signing in separately to each.
• ASP.NET Core Identityproduced by · ASP.NET Core Identity is an extensible ASP.NET Core membership system for managing user accounts, credentials, claims, roles, authentication, and related identity data.

This explainer was generated by Manning's knowledge graph from the text of .NET MAUI in Action. The section links point to the parts of the book it draws on.