WAB Authentication failed

Question

I tried to make a really simple application, using the active-directory-dotnet-native-uwp-v2 sample.

With my MSA Account, it works correctly, but with my corporate account, it doesn't work as expected (I used a @microsoft.com account)

This account is a Office 365 account, and actually it works pretty fine in the Graph Explorer for instance.

The problem is that sometimes, it works ...

My manifest file declared in https://apps.dev.microsoft.com is correctly configured, with a Native Platform option, and "just" a "User.Read" scope autorisation

The code is pretty straightforward, here is the extract from the sample :

AuthenticationResult authResult = null;

    try
    {
        authResult = await App.PublicClientApp.AcquireTokenSilentAsync(scopes, App.PublicClientApp.Users.FirstOrDefault());
}
    catch (MsalUiRequiredException ex)
    {
        // A MsalUiRequiredException happened on AcquireTokenSilentAsync. This indicates you need to call AcquireTokenAsync to acquire a token
        System.Diagnostics.Debug.WriteLine($"MsalUiRequiredException: {ex.Message}");

        try
        {
            authResult = await App.PublicClientApp.AcquireTokenAsync(scopes);
}
        catch (MsalException msalex)
        {
            ResultText.Text = $"Error Acquiring Token:{System.Environment.NewLine}{msalex}";
        }
    }
    catch (Exception ex)
    {
        ResultText.Text = $"Error Acquiring Token Silently:{System.Environment.NewLine}{ex}";
        return;
    }

Once launched, I can set my account, but the redirection is broken.

From what i can see, i have an Msal Exception :

authentication_ui_failed

If i check deeper the call stack, the only thing i found is :

active_directory_dotnet_native_uwp_v2.MainPage.<CallGraphButton_Click>d__3.MoveNext()

Any idea ?

Answer 1

You mentioned you figured out how to solve this problem, so I will add some additional context: In general you do not need to add privateNetworkClientServer to UWP apps only to authenticate against AD IF you only need to access your application outside of your company's premises (or in some cases VPN environment).

However, in some cases - if your device is actually connected to your corporate network, then Windows will try to use things like integrated auth to help sign-in users with less effort. In this case, it is recommended to declare this as a capability so your app can run anywhere.