[Http, Authorization, Environment/Configuration?] Searching for the recommended way to chain kiota with auth oidc provider

[DevTKSS]

Hey there,
I did read the http and authorization docs, but there were one/two things left open:

1. When targeting windows or desktop or wasm for example, where and how should the secrets like for a Rest API required secret application key or the token be stored?

On mobile like ios (which i am not targeting) there is this chain thing, but i did not found the equaling for a desktop/windows application.
The appsettings file in my opinion is not the right place for this, because as far as I understand, this is not hided from public.

In vs code i would maybe have used dotnet env vault, but dont know if that is available or recommended for uno app?

2. Is there any Auth-Intercepor available in Uno?

Coming from first question, I got to another one:
The secret/token and some other things needs to be added in the http request and authorization header which has been hard coded in samples like TheCatApi and I would prefer to use dependency Injection for it or something similar to this interceptor useable for exactly this behavior i would like, available in angular: https://angular.dev/guide/http/interceptors#dependency-injection-in-interceptors

3. Can "connected services -> OpenAPI -> Rest" be used to generate e.g. classes & interfaces from .json files in a uno app?

I did watch some videos that are using this, but in uno docs you did never "just" use this build-in tool. Is there a reason for that not using?

4. Where to store things like Username + pw, without using some web services like Azure or aws?

Since my app will be first place for myself, but wanting to do things best from start, I am searching for the best way to store this data so the app can read them and also write other data... Thought went to storage, but seems like there is absolutely no explanation to the usage there beside the add proper entitlements for the ios for example. Could someone explain/add that?

[kazo0]

Hi @DevTKSS, great question! And I apologize for the delay in providing information.

The Auth Extensions handle the storage of the auth tokens as well as automatically injecting HTTP handlers for service calls with the currently stored tokens. This is mentioned in this section of the Auth documentation: https://platform.uno/docs/articles/external/uno.extensions/doc/Learn/Authentication/AuthenticationOverview.html#http-handlers

You can see how this is done using IStorage extensions to securely store the retrieved tokens here

As for the API Key question, the information for how to actually use your API Key as part of the HttpClient can be found here: https://platform.uno/docs/articles/external/uno.extensions/doc/Learn/Http/HowTo-EndpointOptions.html. For demo purposes, the API keys here are loading as app settings. Otherwise, you would need to utilize some sort of key vault service for securely fetching your keys.

[DevTKSS]

@kazo0 looked at the EndpointOptions you linked and wanted to give the new kiota feature a try, but I am not finding any sample about how we could use this for an oAuth2 api with pkce.

I did set up kiota and oidc auth in my hostbuilder using the docs, but I am missing any information about how I can now provide or chain them together 🤔

The kiotaHttp extension source seems to not even consider us to maybe wanting to provide any other auth provider than the anonymous one Microsoft docs are telling to use if we dont need to authenticate to the api...

[kazo0]

So once you successfully authenticate in the app, the HTTP calls that are being made to the API are not properly Authorized? Are you able to see the Headers for these requests using something like Fiddler and see if the Authorization headers are included?

[DevTKSS]

@kazo0 noI am stuck at your very first point mentioned indeed, kind of like end of last year starting with uno primary targeting to establish a kind of ERP accounting app 😔

Authentication and authorization implementation in my Uno apps solution

Initially I was following the instructions of theCatApi sample, which was advising me to type the gotten api-x-key into code last time I looked it up and mentioned that this should not get done like that than to load through configuration / options. I would assume it were maybe referring to user secrets.

Then I looked at the How to Authentication guide of uno docs, which is introducing us to the Dummy endpoint, but while this indeed is explicitly about auth, it is completely missing the important detail of storing or getting the credentials to send the request. The user will not have the api key by sign in😅 the guide does also nit include where it gets this from like e.g. appsettings which does in this md file definitely not include any credentials not even if assuming this is done through user secrets.

Still no idea how the json setup in this would then look like. Even better of course would be, that the client app would nit have to care about the storing of this but even after looking at the cgefs app, I don't know how this should work. Sending an authorized request while not having the authorization information?🤔😅 How should my server even know about that my client app is allowed to connect?

---

And this is what's making me a really headache because I need to send requests to an oAuth2 api with my app, best case which I would prefer, is to do those requests server side and let my multi platform possible client apps just request the data from my server which cares about the rest.

So as its an openAPI spec api, it does make sense in my opinion, to use the kiota cli tool. But looking at the produced cli code from kiota, I did not see any auth or token endpoint while the api I want to send requests to, does require me to do a oAuth2 request flow.

For example, this here is the api I am speaking of:
https://developers.etsy.com/documentation/reference/

The authorization endpoint:
https://www.etsy.com/oauth/connect

The token endpoint:
https://api.etsy.com/v3/public/oauth/token

And I was assuming to need oidc because it requires me to provide a callback uri to send the user back to.

Seems like oidc is slightly different then oAuth2 and again I am stuck.

I tryed to set kiota up in the hostbuilder as documented in the uno docs, and set an oidc up to load the credentials from the env file because I don't know how to do it otherwise correctly 😕 but while the app started and shown me the login screen, there were nothing there beside the login button not reacting to anything, but I was able to navigate back😅🤷 no process from this

But still this has the problem, that rhe kiota client will not know, about the credentials it should use, meaning the keystring and shared secret. The normal Endpoint options are not including those items so it would require every user of an auth api to define this again? Dont know if thats true or if there is any recommended way to do this properly, since kiotaHttp does only use anonymous authentication Provider if it gets Endpoint specific information. Which makes no sense to me🤔

---

Maybe beside the how to connect those counterparts someone could clear up the recommended storing if credentials in uno apps?
I did research about this in the ms docs and collected some links and information that could be that way, but not sure.
Maybe someone could take a look on this collection and improve thise missing details by adding?

As I will be at vacation for a week from Wednesday on so not calculating to be often online or even on my laptop laptop to help with a PR in that time.

https://github.com/unoplatform/uno/issues/20949

[DevTKSS]

https://github.com/DevTKSS/DevTKSS.MyManufacturerERP/blob/master/DevTKSS.MyManufacturerERP.Server%2FProgram.cs

I think I didn't pushed up latest changes, as I was adding stuff using Copilot as the only resource of information about oAuth2 in asp net🙄 because only docs Microsoft docs are giving me about this, are that its usable the "Remote authentication handler" but no link to future docs.

Did use some spare time between the events I am attending in my vacation to research ms docs future as uno docs are missing those things so far.

Tryed to implement efcore and added after the authorization here at the top on the above linked program.cs:

addAuthentication().addOAuth ("Etsy",options => 
options.CallbackPath = host.Configuration["Authentication:Etsy:CallbackPath"],
options.AuthenticationEndpoint = host.Configuration["Authentication:Etsy:AuthenticationEndpoint"],
options.TokenEndpoint = host.Configuration["Authentication:Etsy:TokenEndpoint"],
options.UserInformationEndpoint = host.Configuration["Authentication:Etsy:UserInformationEndpoint"],
options.ClientId = host.Configuration["Authentication:Etsy:ClientId"], // loaded using user secrets currently assuming this to be 'keystring' reading etsy docs
options.ClientSecret = host.Configuration["Authentication:Etsy:ClientSecret"], // loaded using user secrets currently assuming this is 'shared secret'

The thing is why I am missing the ms docs to this are details about setting up challenging maybe required mapping setup and maybe required callback path actions? Etsy api guides does tell we need to use antiforgery to make the request "not able to guess" to secure and verify it...
But everytime I researched the auth topic they seem to want to enforce using their Microsoft identity, but I would rather not force my users to have a Microsoft account 😅