[Question] How to pass AAD auth parameters in MSIX Authentication about msix-packaging HOT 4 OPEN

There is no way to specify a client ID or scope. App Installer uses its own client ID and sets the scope depending on whether the resource is on SharePoint or Azure Storage.

It may also be worth updating App Installer or testing installing the .msix directly (without using a .appinstaller file). There used to be a bug that caused cryptic errors when using auth for .appinstaller files.

from msix-packaging.

Hey, just bumping this thread. I tried adding ?msixauth=aad at the end of my Uri for AppInstaller and MainPackage to test the authentication flow. I do get prompted to log in, but the app installer fails to open app package due to

"An error occurred while attempting to authenticate. The user account does not have access to the target resource. Contact your administrator for assistance."

I believe the reason is because no tenant ID, scope and client ID is passed to AAD when retrieving a bearer token.

from msix-packaging.

Bumping this thread again.

I assume app installer is expecting users to perform server side authentication if client side authentication is not supported. It would be great if anyone can point to a sample or documentation of that auth flow.

from msix-packaging.

Thanks for the reply. Unfortunately giving access to users to Azure Storage is not encouraged by Microsoft security policies. A web API that can authenticate via a managed service identity is encouraged. Hence why I require the app installer to authenticate with a custom web API.

I have not considered using SharePoint and not familiar with the experience there. Having said that, it would be nice if a user is able to customize the client ID and scope for app installer auth.

from msix-packaging.