ASP.NET MVC 5 - ADAL to MSAL 2.0 migration - asp.net-mvc-5

Question

I've tried to follow this sample on link to implement MSAL authentication (authorization code flow) to our app running in .NET 4.8 platform:
https://github.com/Azure-Samples/ms-identity-aspnet-webapp-openidconnect/blob/master/WebApp
I implement the MSAL code in the following file of our app
Startup.cs
using System;
using System.Collections.Generic;
using System.Configuration;
using System.Web.Mvc;
using System.Web.Optimization;
using System.Web.Routing;
using CompanyApp.Infrastructure;
using CompanyApp.App_Start;
using Owin;
using Microsoft.Owin;
using System.Web.Http;
using System.Net.Http.Formatting;
using Microsoft.IdentityModel.Protocols.OpenIdConnect;
using Microsoft.IdentityModel.Tokens;
using Microsoft.Owin.Security;
using Microsoft.Owin.Security.Cookies;
using Microsoft.Owin.Security.OpenIdConnect;
using Microsoft.Owin.Security.Notifications;
using System.Threading.Tasks;
using Microsoft.Identity.Client;
using System.Web;
using Microsoft.Identity.Web;
using Microsoft.Extensions.DependencyInjection;
using Microsoft.Owin.Host.SystemWeb;
using CompanyApp.Utils;
namespace CompanyApp
{
public partial class Startup
{
public void Configuration(IAppBuilder app)
{
app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);
app.UseCookieAuthentication(new CookieAuthenticationOptions());
app.UseOpenIdConnectAuthentication(
new OpenIdConnectAuthenticationOptions
{
ClientId = AuthenticationConfig.ClientId,
Authority = AuthenticationConfig.Authority,
RedirectUri = AuthenticationConfig.RedirectUri,
PostLogoutRedirectUri = AuthenticationConfig.RedirectUri,
Scope = AuthenticationConfig.BasicSignInScopes + $" User.Read",
TokenValidationParameters = new TokenValidationParameters()
{
ValidateIssuer = false
},
Notifications = new OpenIdConnectAuthenticationNotifications
{
AuthorizationCodeReceived = OnAuthorizationCodeReceived,
AuthenticationFailed = OnAuthenticationFailed
}
}
);
RegisterConstants(app);
RegisterAppFilters(AppFilters.Filters);
HttpConfiguration config = new HttpConfiguration() {
};
config.Formatters.Clear();
config.Formatters.Add(new JsonMediaTypeFormatter());
// config.EnsureInitialized();
app.UseWebApi(config);
AreaRegistration.RegisterAllAreas();
RouteConfig.RegisterRoutes(RouteTable.Routes);
}
private async Task OnAuthorizationCodeReceived(AuthorizationCodeReceivedNotification context)
{
// Upon successful sign in, get the access token & cache it using MSAL
IConfidentialClientApplication clientApp = MsalAppBuilder.BuildConfidentialClientApplication();
AuthenticationResult result = await clientApp.AcquireTokenByAuthorizationCode(new[] { "api://<Application ID in azure>/.default" }, context.Code).ExecuteAsync();
}
private Task OnAuthenticationFailed(AuthenticationFailedNotification<OpenIdConnectMessage, OpenIdConnectAuthenticationOptions> notification)
{
notification.HandleResponse();
notification.Response.Redirect("/Error?message=" + notification.Exception.Message);
return Task.FromResult(0);
}
}
}
HomeController.cs
using Microsoft.Identity.Client;
using Microsoft.Identity.Web;
using Microsoft.Owin.Security;
using Microsoft.Owin.Security.OpenIdConnect;
using System;
using System.Diagnostics;
using System.Net.Http;
using System.Net.Http.Headers;
using System.Security.Claims;
using System.Text;
using System.Threading.Tasks;
using System.Web;
using System.Web.Mvc;
using CompanyApp.Utils;
namespace CompanyApp.Controllers
{
public class HomeController : Controller
{
[Authorize]
public ActionResult Index()
{
IConfidentialClientApplication app = MsalAppBuilder.BuildConfidentialClientApplication();
var msalAccountId = ClaimsPrincipal.Current.GetMsalAccountId(); // getting null from this line
var account = await app.GetAccountAsync(msalAccountId);
string[] scopes = { "api://<Application ID in azure>/.default" };
try
{
// try to get an already cached token
await app.AcquireTokenSilent(scopes, account).ExecuteAsync().ConfigureAwait(false);
}
catch (MsalUiRequiredException ex)
{
throw ex;
}
return View();
}
}
}
I tried to run this in my local
after it successfully authenticated and goes to the controller
I am getting null result from the line where ClaimsPrincipal.Current.GetMsalAccountId() is invoked
Is there something that is missing for ClaimsPrincipal.Current.GetMsalAccountId() to give out null?

Answer 1

In ASP.NET 4.x projects, it was common to use ClaimsPrincipal.Current to retrieve the current authenticated user's identity and claims. In ASP.NET Core, this property is no longer set. Code that was depending on it needs to be updated to get the current authenticated user's identity through a different means.
There are several options for retrieving the current authenticated user's ClaimsPrincipal in ASP.NET Core in place of ClaimsPrincipal.Current:
1)ControllerBase.User. MVC controllers can access the current authenticated user with their User property.
2)HttpContext.User. Components with access to the current HttpContext (middleware, for example) can get the current user's ClaimsPrincipal from HttpContext.User.
3)Passed in from caller. Libraries without access to the current HttpContext are often called from controllers or middleware components and can have the current user's identity passed as an argument.
4)HttpContextAccessor. The project being migrated to ASP.NET Core may be too large to easily pass the current user's identity to all necessary locations. In such cases, IHttpContextAccessor can be used as a workaround. IHttpContextAccessor is able to access the current HttpContext (if one exists). If DI is being used, see Access HttpContext in ASP.NET Core. A short-term solution to getting the current user's identity in code that hasn't yet been updated to work with ASP.NET Core's DI-driven architecture would be:
For more details refer this document