An authentication service signs a user in and obtains a token for protected API calls. In a .NET MAUI app, it can send users to an OpenID Connect identity provider in a browser rather than handling their passwords directly. After sign-in, the provider redirects back with a code, and the OIDC client obtains a JSON web token (JWT). section 8.1.2
Figure 8.3 Step 1: Call the LoginAsync method of the OidcClient package. Step 2: The OidcClient package will call WebAuthenticator and display the login page on IdentityServer. Step 3: The user will log in to IdentityServer. Step 4: IdentityServer returns the result via WebAuthenticator. Step 5: The parsed result is returned to OidcClient. Step 6: OidcClient extracts the JWT from the result and returns it to the caller of the LoginAsync method.
The login flow moves browser interaction and response parsing behind OidcClient: call LoginAsync, let WebAuthenticator show the provider login page, then receive the JWT result. section 8.1.2
Implement the service by configuring OidcClientOptions with the authority, client ID, scopes, redirect URI, and a browser implementation. The browser implementation calls WebAuthenticator with the provider start URL and app redirect URI, then converts the callback result into the response expected by OidcClient. AuthService can expose LoginAsync as the application-facing sign-in operation. section 8.1.2
Register a custom redirect URI so the operating system can return authentication results to the app:
- On Android, add an activity intent filter for the custom scheme and callback host. section 8.1.2
- On iOS and macOS, declare the custom URL scheme in Info.plist. section 8.1.2
- On Windows, register the scheme as a protocol extension in Package.appxmanifest. section 8.1.2
IdentityServer is one option because it is available with ASP.NET Core templates. A cloud identity provider such as Azure Active Directory B2C or Auth0 can instead provide a documented client package or SDK, often including functionality such as secure refresh-token storage. The same overall approach works with OIDC-compliant providers. section 8.1.2
Within MVVM, AuthService belongs to the Model alongside product and inventory services. It represents the staff problem area and contains business logic for dealing with users, while related services and DTOs represent other application problem areas. section 9.5.1
