ArgumentNullException in Blazor

[jefffhaynes]

I'm sure I'm missing something obvious but I'm getting an ArgumentNullException in Blazor (.NET 8) when I try to use the GraphServiceClient in OnParametersSetAsync:

var group = await GraphServiceClient.Groups["<id>"].GetAsync(configuration =>
            configuration.Options.WithScopes("GroupMember.Read.All"))

The exception takes place the second time OnParametersSetAsync is called during the render cycle. The first time the call completes successfully.

System.ArgumentNullException: Value cannot be null. (Parameter 'headers')
   at Microsoft.Identity.Web.Throws.ArgumentNullException(String paramName)
   at Microsoft.Identity.Web.AppServicesAuthenticationInformation.GetIdToken(IDictionary`2 headers)
   at Microsoft.Identity.Web.AppServicesAuthenticationTokenAcquisition.GetAuthenticationResultForUserAsync(IEnumerable`1 scopes, String authenticationScheme, String tenantId, String userFlow, ClaimsPrincipal user, TokenAcquisitionOptions tokenAcquisitionOptions)
   at Microsoft.Identity.Web.DefaultAuthorizationHeaderProvider.CreateAuthorizationHeaderForUserAsync(IEnumerable`1 scopes, AuthorizationHeaderProviderOptions downstreamApiOptions, ClaimsPrincipal claimsPrincipal, CancellationToken cancellationToken)
   at Microsoft.Identity.Web.GraphAuthenticationProvider.AuthenticateRequestAsync(RequestInformation request, Dictionary`2 additionalAuthenticationContext, CancellationToken cancellationToken)
   at Microsoft.Kiota.Http.HttpClientLibrary.HttpClientRequestAdapter.GetHttpResponseMessage(RequestInformation requestInfo, CancellationToken cancellationToken, Activity activityForAttributes, String claims, Boolean isStreamResponse)
   at Microsoft.Kiota.Http.HttpClientLibrary.HttpClientRequestAdapter.SendAsync[ModelType](RequestInformation requestInfo, ParsableFactory`1 factory, Dictionary`2 errorMapping, CancellationToken cancellationToken)
   at Microsoft.Graph.Groups.Item.GroupItemRequestBuilder.GetAsync(Action`1 requestConfiguration, CancellationToken cancellationToken)
   at Parts.Components.Pages.PartDetail.OnParametersSetAsync() in C:\Users\feedy\source\repos\Parts\Parts\Components\Pages\PartDetail.razor:line 242
   at Parts.Components.Pages.PartDetail.OnParametersSetAsync() in C:\Users\feedy\source\repos\Parts\Parts\Components\Pages\PartDetail.razor:line 246
   at Microsoft.AspNetCore.Components.ComponentBase.CallStateHasChangedOnAsyncCompletion(Task task)
   at Microsoft.AspNetCore.Components.ComponentBase.RunInitAndSetParametersAsync()
   at Microsoft.AspNetCore.Components.RenderTree.Renderer.GetErrorHandledTask(Task taskToHandle, ComponentState owningComponentState)

I'm initializing like this:

builder.Services.AddAuthentication(OpenIdConnectDefaults.AuthenticationScheme)
    .AddMicrosoftIdentityWebApp(builder.Configuration.GetSection("AzureAd"))
    .EnableTokenAcquisitionToCallDownstreamApi()
    .AddMicrosoftGraph(options => options.RequestAppToken = true)
    .AddInMemoryTokenCaches();

[jmprieur]

@jefffhaynes, assuming this is the new Blazor app in .NET 8:
How is the user signed-in? did you add some UI for the login?
Are you testing locally (how?) or is it deployed behind App Services authentication?

[jefffhaynes]

Thanks for the questions @jmprieur. My goal is to use all RBAC/SSO so no client secrets. Here is my entire program.cs. This is all being done as an App Service. I have not tried it locally (at least not this part).

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddRazorComponents()
    .AddInteractiveServerComponents();

builder.Services.AddAuthentication(OpenIdConnectDefaults.AuthenticationScheme)
    .AddMicrosoftIdentityWebApp(builder.Configuration.GetSection("AzureAd"))
    .EnableTokenAcquisitionToCallDownstreamApi()
    .AddMicrosoftGraph(options => options.RequestAppToken = true)
    .AddInMemoryTokenCaches();

builder.Services.AddControllersWithViews(options =>
    {
        var policy = new AuthorizationPolicyBuilder()
            .RequireAuthenticatedUser()
            .Build();
        options.Filters.Add(new AuthorizeFilter(policy));
    }).AddMicrosoftIdentityUI();


builder.Services.AddMicrosoftIdentityConsentHandler();

builder.Services.AddDbContextFactory<MyContext>(options =>
{
    options.UseCosmos("<url>",
        new DefaultAzureCredential(), MyContext.DatabaseName);
});


var app = builder.Build();

// Configure the HTTP request pipeline.
if (!app.Environment.IsDevelopment())
{
    app.UseExceptionHandler("/Error", createScopeForErrors: true);
    // The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.
    app.UseHsts();
}

app.UseHttpsRedirection();

app.UseStaticFiles();
app.UseAntiforgery();

app.UseAuthentication();
app.UseAuthorization();

app.MapRazorComponents<App>()
    .AddInteractiveServerRenderMode();

app.Run();

[jefffhaynes]

@jmprieur do you see any obvious problems with what I'm doing?

[jmprieur]

It seems that the app service does not provide you with headers.
Did you enable App services authentication?

[jefffhaynes]

It does provide them on the first render pass. It's only a problem on the second. The first pass succeeds and returns the correct values.

[jefffhaynes]

Admittedly, I don't really understand the render cycle and why this happens twice.

[jmprieur]

I'm not too familiar with the new Blazor model in .NET 8.
We'll meet with the Blazor team next week. I'll update you.

For the moment, I think that if you only enable the server side rendering, this should work (as this was the blazor server model in .NET 7). Is it an option for you?

[jefffhaynes]

I don't think so because some of the mud blazer controls seem to require client side. Very interested to hear what you learn though!