OAuth

As explained in .NET MAUI in Action

OAuth is an authorization framework that allows an application to obtain delegated access to protected resources without receiving the user's password.

OAuth is used to let an app obtain access to protected resources without handling the user’s password. In a .NET MAUI app, the user signs in directly with an identity provider (IDP) in a browser. The IDP then redirects back with a code, which is used to obtain an access token such as a JSON web token (JWT) for API calls. section 8.1.2

OpenID Connect (OIDC) extends OAuth2 for this sign-in flow. An ASP.NET Core IdentityServer instance can act as the OIDC-compliant provider, but a cloud IDP such as Azure Active Directory B2C or Auth0 is also an option. Hosted providers commonly offer supported client packages and can handle work such as secure refresh-token storage. section 8.1.2

A practical OAuth sign-in integration follows these steps:

• Configure the authority, client ID, requested scope, and redirect URI for the OIDC client. section 8.1.2
• Register a custom URL scheme with each target operating system so the browser can route the authentication response back to the app. section 8.1.2
• Use WebAuthenticator through an OidcClient browser implementation to open the provider’s login page and receive the callback result. section 8.1.2
• Call LoginAsync, handle an error result when needed, and retain the returned token response for authenticated requests. section 8.1.2
• Configure a delegating handler to attach the access token as a header on requests made by a named HttpClient. section 8.5

Browser callback in a mobile or desktop app

The app starts authentication by opening the IDP login page. After successful sign-in, the IDP redirects to a URL such as auth.com.mildredsurf.stocktake://callback. On web apps, the redirect normally returns to the originating web address; on mobile and desktop apps, the custom scheme is associated with the installed app. The callback receives the authorization response, allowing the OIDC client to extract and return the JWT. section 8.1.2

Figure 8.3 Step 1: Call the LoginAsync method of the OidcClient package. Step 2: The OidcClient package will call WebAuthenticator and display the login page on IdentityServer. Step 3: The user will log in to IdentityServer. Step 4: IdentityServer returns the result via WebAuthenticator. Step 5: The parsed result is returned to OidcClient. Step 6: OidcClient extracts the JWT from the result and returns it to the caller of the LoginAsync method.

Follow the handoff from LoginAsync to WebAuthenticator, the IDP login page, the callback result, and JWT extraction. section 8.1.2

Keep authentication logic behind an interface and service rather than in the UI. This makes the sign-in behavior reusable and lets the service be registered and injected through the .NET generic host’s services collection. For API access, obtain a configured HttpClient through IHttpClientFactory so token attachment is applied consistently. section 8.5

How .NET MAUI in Action covers it

How deep it goes

Walks through OIDC client configuration, browser callbacks, platform URL registration, and token attachment; defers broader identity topics.

Examples

Uses an IdentityServer-backed MAUIStockTake app with LoginAsync, a custom callback URL, AuthBrowser, and AuthService.

What it assumes

Assumes some familiarity with identity and authentication while introducing the application-side OAuth sign-in flow.

What you can do after

Apply it via WebAuthenticator and OidcClient to sign in users and attach access tokens to HTTP requests.

How it connects

Connects OAuth to OpenID Connect, IdentityServer, WebAuthenticator, JSON web tokens, HttpClient, and dependency injection.

liveBookmanning.com

Read .NET MAUI in Action on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  Software Security for DevelopersOAuth is an authorization framework that enables delegated access to protected resources without sharing the resource owner's credentials with the resource server.
• 

  liveBookmanning.com
  Authorization in ActionOAuth 2.0 is an open authorization framework that lets applications obtain limited delegated access to protected resources without exposing a user's credentials.
• 

  liveBookmanning.com
  ASP.NET Core in Action, 3eOAuth 2.0 is an authorization protocol that lets a resource owner delegate controlled access to protected resources without revealing credentials to the accessing service.
• 

  liveBookmanning.com
  Acing the CCNA Exam: Volume 2 Advanced Networking and SecurityOAuth 2.0 is an industry-standard authorization framework that delegates controlled access to protected resources without sharing the resource owner's credentials with a third-party application.
• 

  liveBookmanning.com
  Secure APIsOAuth 2.0 is the earlier major version of the OAuth authorization framework that defined multiple authorization flows for delegated access.
• 

  liveBookmanning.com
  Spring Security in Action, Second EditionOAuth 2 is an authorization framework specification for delegated access to protected resources using access tokens.
• 

  liveBookmanning.com
  Spring in Action, Sixth EditionOAuth 2 is an authorization framework that enables a client to obtain limited access to protected resources on behalf of a resource owner.
• 

  liveBookmanning.com
  Building Distributed Applications that WorkOAuth is an authorization framework that enables clients to obtain limited access to protected resources without handling the resource owner's credentials.

Compare how 9 books explain OAuth →

Related concepts

• openid connectused by · OpenID Connect is an identity layer built on OAuth 2.0 that enables clients to authenticate end users and obtain standardized identity claims.
• API keyproduces · An API key is a credential used to identify or authorize a client accessing an application programming interface.
• scopeuses · Scope is a defined boundary specifying which entities, activities, resources, or conditions are included or governed in a particular context.
• authenticationuses · Authentication is the process of establishing or verifying the identity of a user, service, device, or other communicating entity.
• authorization code flowhas part · The authorization code flow is an OAuth protocol in which a client obtains a short-lived authorization code after user authorization and exchanges it for access or other tokens.
• resource serverhas part · A resource server is a service that hosts protected resources, validates access credentials such as tokens, and enforces authorization for client requests.

This explainer was generated by Manning's knowledge graph from the text of .NET MAUI in Action. The section links point to the parts of the book it draws on.