WebAuthenticator is spawning a new window in MAUI after authentication

[bwinklesky]

Hi-

I'm not sure if this is a bug or if my configuration is wrong, but I've gone through the setup described in the Using with MAUI page, but my applications are spawning a new window and I'm not able to intercept the access token.

I'm using .NET 10.

[dotMorten]

This would happen if you miss the startup code or if your oauth service doesn’t preserve the State parameter per the oauth spec.
See https://dotmorten.github.io/WinUIEx/concepts/Maui.html#use-winuiexs-webauthenticator-instead-of-net-mauis

[bwinklesky]

I followed those steps and still the same result.

using Microsoft.Extensions.Logging;
using CommunityToolkit.Maui;
using Esri.ArcGISRuntime.Maui;
using Esri.ArcGISRuntime.Toolkit.Maui;
using Klyk.Mobile;
using Microsoft.Maui.LifecycleEvents;
#if WINDOWS
using WinUIEx;
#endif

namespace PrecisionFarms
{
    public static class MauiProgram
    {
        public static MauiApp CreateMauiApp()
        {
            var builder = MauiApp.CreateBuilder();
            builder.UseMauiApp<App>().ConfigureFonts(fonts =>
            {
                fonts.AddFont("OpenSans-Regular.ttf", "OpenSansRegular");
                fonts.AddFont("OpenSans-Semibold.ttf", "OpenSansSemibold");
            })
                .UseMauiCommunityToolkit()
                .UseArcGISRuntime()
                .UseArcGISToolkit().ConfigureApp();

#if WINDOWS
            builder.ConfigureLifecycleEvents(events =>
            {
                events.AddWindows(wndLifeCycleBuilder =>
                {
                    wndLifeCycleBuilder.OnWindowCreated(window =>
                    {
                        window.CenterOnScreen(1024,768); 

                        var manager = WinUIEx.WindowManager.Get(window);
                        manager.PersistenceId = "MainWindowPersistanceId"; // Remember window position and size across runs
                        manager.MinWidth = 640;
                        manager.MinHeight = 480;
                    });
                });
            });
#endif

#if DEBUG
            builder.Logging.AddDebug();
#endif
            return builder.Build();
        }
    }
}

[dotMorten]

Then it’s most likely your oauth service not preserving or mangling the state parameter.

[bwinklesky]

I'm using asp.net core authentication provider and don't see any options about preserving state. Do you have any ideas on how to check to see if it's mangling the state parameter?

var google = authenticationSection.GetSection("Google");

if (google.Exists())
{
    authentication.AddGoogle(options =>
    {
        options.ClientId = google["ClientId"];
        options.ClientSecret = google["ClientSecret"];
        options.SaveTokens = true;
        
        //options.Events.OnTicketReceived += TokenUtils.OnTicketRecieved;
    });
}

[dotMorten]

I wouldn't know anything about that, but you could hook it up with the source code here and inspect what is happening here:

WinUIEx/src/WinUIEx/WebAuthenticator.cs

Line 178 in 123947d

{

[dotMorten]

I deleted your comment on the oauth state url - I believe you don't want to post the raw value of that here, since it contains your credential tokens.

[bwinklesky]

i'll try adding the source and see if i can inspect it.

[bwinklesky]

I just tried using the source, and it's not hitting line 178 when it opens the new window.

[dotMorten]

Try debugging from the CheckOAuthRedirectionActivation() call

[bwinklesky]

On first load it hits line 183 on the WebAuthenticator class to return false. Once you try logging in, the CheckOAuthRedirectionActivation() in the "App" never gets called.

[dotMorten]

It wouldn’t call that until the redirect from the browser happens

[bwinklesky]

Not sure what you mean. It seems like adding this should intercept the redirect from the browser, but maybe I'm using this in the wrong place? The browser does open the appropriate app, but not the active one.

        public App()
        {
            if (WinUIEx.WebAuthenticator.CheckOAuthRedirectionActivation())
            {                
                return;
            }

            this.InitializeComponent();
        }

[dotMorten]

Yes it’ll open a new instance and hit this code and should then forward the info to the existing instance and shut this instance down.
If you see a new instance launching it would have to be hitting this app code