Page History

...

Step-by-Step Authentication Process

...

Step 1: User Visits Protected Page

What happens:

• User navigates to https://partners-dev.test-egzynergy.com/ (or /overview)
• Page has [Authorize] attribute, requires authentication

Who's involved:

• End User (Browser)
• Blazor WebAssembly App

Result:

• Blazor app checks if user has a valid token in sessionStorage
• No token found → Proceed to Step 2

Step 2: Redirect to Login

What happens:

• MSAL.js detects no authentication
• Saves the original URL (e.g., /overview) to return later
• Redirects browser to Microsoft login page

Who's involved:

• MSAL.js Library
• Microsoft Entra ID

Redirect URL:

https://6073ce8b-73f3-4df4-9b80-5e40cdc6965f.ciamlogin.com/.../authorize
  ?client_id=84c38b43-12e4-4c26-8292-8910d79aa532
  &redirect_uri=https://partners.egzynergy.com/authentication/login-callback
  &response_type=code

Result:

• User sees Microsoft login page

Step 3: User Enters Credentials

What happens:

...

...

Who's involved:

• End User
• Microsoft Entra ID

Result:

• Microsoft Entra ID validates credentials
• If valid → Proceed to Step 4
• If invalid → Show error, retry

Step 4: Authorization Code Issued

What happens:

• Microsoft Entra ID generates a one-time authorization code
• Redirects browser back to the app with the code

Who's involved:

• Microsoft Entra ID
• Blazor WebAssembly App

Redirect back:

https://partners.egzynergy.com/authentication/login-callback
  ?code=0.AXAA-very-long-code-here
  &state=random-state-value

Result:

• App receives authorization code (valid for 10 minutes)

Step 5: Exchange Code for Tokens

What happens:

• MSAL.js automatically exchanges the code for tokens
• Sends code + PKCE verifier to Microsoft token endpoint
• Microsoft validates the code and issues tokens

Who's involved:

• MSAL.js Library
• Microsoft Entra ID

Request to Microsoft:

POST https://.../oauth2/v2.0/token
Content-Type: application/x-www-form-urlencoded

grant_type=authorization_code
code=0.AXAA-very-long-code-here
client_id=84c38b43-12e4-4c26-8292-8910d79aa532
redirect_uri=https://partners.egzynergy.com/authentication/login-callback
code_verifier=PKCE-verifier

Response from Microsoft:

{
  "access_token": "eyJ0eXAiOiJKV1QiLCJhbGc...",
  "refresh_token": "0.AXAA...",
  "id_token": "eyJ0eXAiOiJKV1QiLCJhbGc...",
  "expires_in": 3600
}

Result:

• App now has three tokens (access, refresh, ID)

Step 6: Store Tokens

What happens:

• MSAL.js stores all tokens in browser's sessionStorage
• Tokens are encrypted/encoded but not visible to user
• sessionStorage means tokens deleted when browser tab closes

Who's involved:

• MSAL.js Library
• Browser sessionStorage

What's stored:

• Access Token: Used to call ApiService endpoints (1 hour lifetime)
• Refresh Token: Used to get new access tokens (90 days lifetime)
• ID Token: Contains user info (name, email, groups)

Result:

• User is now authenticated
• Tokens ready for API calls

Step 7: Redirect to Original Page

What happens:

• MSAL.js redirects user back to original page they requested
• User sees the page they originally wanted (e.g., /overview or root /)

Who's involved:

• MSAL.js Library
• Blazor WebAssembly App

Result:

• User successfully logged in and viewing protected content

Step 8: Making API Calls

What happens (every time app calls API):

1. User interacts with the app (e.g., viewing the overview page)
2. Blazor app makes HTTP request to ApiService
3. ApiAuthenticationHandler intercepts the request
4. Handler asks MSAL.js for access token
5. MSAL.js returns token from sessionStorage
6. Handler adds token to request header: Authorization: Bearer eyJ0eXAi...
7. Request sent to ApiService

Who's involved:

• Blazor WebAssembly App
• ApiAuthenticationHandler
• MSAL.js Library
• ApiService

Result:

• API request includes authentication proof

Step 9: API Validates Token

What happens (on ApiService):

1. ApiService receives request with Bearer token
2. JWT middleware extracts token from header
3. Checks token signature (validates it's from Microsoft)
4. Checks token issuer (must be CIAM tenant)
5. Checks token audience (must be for this API)
6. Checks token expiration (must not be expired)
7. Checks user's groups claim (for authorization)
8. If all valid → Allow request
9. If any invalid → Return 401 Unauthorized

Who's involved:

• ApiService
• Microsoft Entra ID (signing keys downloaded periodically)

What's validated:

• Signature: Proves token issued by Microsoft, not forged
• Issuer: https://6073ce8b-73f3-4df4-9b80-5e40cdc6965f.ciamlogin.com/.../v2.0
• Audience: api://4dad5d62-dc8c-4378-8bd0-ae736a4d73fe
• Expiration: Token must not be expired
• Groups: User must be in authorized groups

Result:

• API processes request and returns data
• Or returns 401/403 if unauthorized

Step 10: Token Renewal (Automatic)

What happens (when access token expires):

1. Access token expires after 1 hour
2. Next API call triggers token renewal
3. MSAL.js uses refresh token to get new access token
4. New access token stored in sessionStorage
5. API call proceeds with new token
6. User doesn't notice anything (seamless)

Who's involved:

• MSAL.js Library
• Microsoft Entra ID

When user must log in again:

...