Blazor Server .NET 8 authorization Dependency Injection User Settings

So like this? But RevalidatingServerAuthenticationStateProvider is part of Microsoft.AspNetCore.Components.Server which gives me no package found in Manage NuGet Packages.

using System.Security.Claims;

using Microsoft.AspNetCore.Components.Authorization;

using Microsoft.Extensions.Logging;

using SharedKernel.Interfaces;

public class CustomAuthenticationStateProvider : RevalidatingServerAuthenticationStateProvider

{

private readonly IServiceProvider _serviceProvider;

public CustomAuthenticationStateProvider(ILoggerFactory loggerFactory, IServiceProvider serviceProvider)

    : base(loggerFactory)

{

    _serviceProvider = serviceProvider;

}

protected override TimeSpan RevalidationInterval => TimeSpan.FromMinutes(30);

protected override async Task<bool> ValidateAuthenticationStateAsync(AuthenticationState state, CancellationToken ct)

{

    if (state.User.Identity?.IsAuthenticated == true)

    {

        using var scope = _serviceProvider.CreateScope();

        var userSettings = scope.ServiceProvider.GetRequiredService<IUserSettings>();

        await userSettings.GetUserSettingsAsync(this);

    }

    return true;

}

private Task<bool> CheckUserSessionAsync(ClaimsPrincipal user)

{

    // Implement your session validation logic here

    return Task.FromResult(true);

}

Hi Dennis Vossen,

You're on the right track with implementing a custom AuthenticationStateProvider. The reason you're not seeing the Employee ID from Microsoft Entra is that, by default, Entra only provides standard claims such as the user's email or UPN. 

The recommended approach in this scenario is to use the email address (user.Identity.Name) as a unique identifier to query your internal database. From there, you can retrieve the user's internal ID, roles, and other relevant settings. This is a common and effective pattern for integrating external identity providers with internal systems. 

Your current implementation using GetUserIdQuery to resolve the internal user ID is correct and aligns with best practices. While it is technically possible to configure Entra to return custom claims like Employee ID, doing so requires additional setup in Azure AD and is generally unnecessary if your database already holds this mapping. 

In summary, continue using the email to fetch internal user details from your database  this is the preferred and reliable method in such integrations. 

I made this update. Still have the same issue.

// Copyright (c) Land O'Lakes. All rights reserved.

using System.Security.Claims;

using Microsoft.AspNetCore.Components.Authorization;

using NBi.AppShared.Features.Authentication;

using NBi.AppShared.Queries;

using SharedKernel;

using SharedKernel.Interfaces;

namespace NBi.App.Utilities

{

public class UserSettingService : IUserSettings

{

    private readonly IMediator _mediator;

    private readonly AuthenticationStateProvider _authenticationStateProvider;

    public UserSettingService(IMediator mediator, AuthenticationStateProvider authenticationStateProvider)

    {

        _mediator = mediator;

        _authenticationStateProvider = authenticationStateProvider;

    }

    public int DefaultFacilityId { get; set; }

    public int[] FacilityIds { get; set; }

    public string FullName { get; set; }

    public bool IsAdministrator { get; set; }

    public string[] LockCodes { get; set; }

    public bool RequiresPasswordChange { get; set; }

    public int UserId { get; set; }

    public string UserName { get; set; }

    public AccessLevel GetAccessLevel(string lockCodePrefix)

    {

        throw new NotImplementedException();

    }

    public bool HasPermission(string lockCode)

    {

        throw new NotImplementedException();

    }

    public async Task GetUserSettingsAsync()

    {

        CancellationTokenSource cancellationTokenSource = new();

        var authState = await _authenticationStateProvider.GetAuthenticationStateAsync();

        var user = authState?.User;

        if (user?.Identity?.IsAuthenticated == true)

        {

            var userId = await _mediator.Send(new GetUserIdQuery(user.Identity.Name), cancellationTokenSource.Token);

            await SetUserSettingsAsync(userId);

            return;

        }

        throw new UnauthorizedAccessException("User is not authenticated");

    }

    private async Task SetUserSettingsAsync(string userId)

    {

        var claims = await _mediator.Send(new GetUserClaimsQuery(userId)).ConfigureAwait(false);

        var identity = new ClaimsIdentity("Custom");

        identity.AddClaims(claims);

        var userIdClaim = (identity.FindFirst("UserId")?.Value) ?? throw new InvalidOperationException("UserId claim is missing");

        UserId = int.Parse(userIdClaim);

        UserName = userId;

        DefaultFacilityId = int.Parse(identity.FindFirst("DefaultFacility")!.Value);

        FacilityIds = identity.FindAll("Facility")

            .Select(x => x.Value)

            .Select(x => int.TryParse(x, out var value) ? value : 0)

            .ToArray();

        FullName = identity.FindFirst(ClaimTypes.GivenName)?.Value ?? string.Empty;

        IsAdministrator = identity.FindFirst("IsAdministrator")?.Value == bool.TrueString;

        LockCodes = identity.FindAll(ClaimTypes.Sid)

            .Select(x => x.Value)

            .ToArray();

        RequiresPasswordChange = identity.FindFirst("RequiresPasswordChange")?.Value == bool.TrueString;

    }

    public async Task InitializeAsync()

    {

        //await GetUserSettingsAsync();

    }

}

}