I get IDW10503: Cannot determine the cloud Instance when I use GraphServiceClient with multiple authentication schemes

Stefano Delpero 0 Reputation points
2023-11-01T20:42:13.5866667+00:00

I've an ASP.NET Core web application with multiple authentication schemes.

The default scheme is Cookie:

services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)
    .AddMicrosoftIdentityWebApp(options => 
    {
        configuration.Bind("Authentication:AzureAd", options);
        options.Events.OnAuthorizationCodeReceived = authorizationCodeReceivedContext =>
        {
            AuthHelper.IsAzureAdAuthenticated = true;
            return Task.CompletedTask;
        };
    })
    .EnableTokenAcquisitionToCallDownstreamApi()
    .AddMicrosoftGraph(configuration.GetSection("Authentication:Graph"))
    .AddSessionTokenCaches();

services.AddRazorPages().AddMicrosoftIdentityUI();

My "Test" page can be accessed by any users, with form or Azure AD account.

If the user has an Azure AD account I use GraphServiceClient to get the unread email count.

The "Test" page:

[Authorize]
public class GraphCMSModel : PageModel
{
    private readonly GraphLogic _graphLogic;
    public string AreaContent { get; set; } = string.Empty;

    public GraphCMSModel(GraphLogic graphLogic)
    {
        _graphLogic = graphLogic;
    }
    public async Task OnGetAsync()     
    {
        if (AuthHelper.IsAzureAdAuthenticated)
        {
            AreaContent = await _graphLogic.GetContentAsync();         
        }
        else
        {
            AreaContent = "No Graph for you";         
        }
    }
}

GraphLogic has GraphServiceClient:

public class GraphLogic 
{
    private readonly GraphServiceClient _graph;
    public GraphLogic(GraphServiceClient graph)
    {
        _graph = graph;
    }
    public async Task<string> GetContentAsync() 
    {   
        var messages = await _graph.Me.MailFolders["Inbox"].Messages
                                      .Request()
                                      .Filter("isRead ne true")
                                      .GetAsync();
        return $"You have {messages.Count} unread messages";     
    }
}

I get this error:

InvalidOperationException: IDW10503: Cannot determine the cloud Instance. The provided authentication scheme was ''. Microsoft.Identity.Web inferred 'Cookies' as the authentication scheme. Available authentication schemes are 'Cookies,OpenIdConnect'.

I tried several things:

  • with multiple Authorize attributes or multiple schemas in authorize attribute: same error
  • if OpenConnectId is the default Schema Graph works, but I've problem with users logged-in with form: thet get redirected to Azure login page
  • I don't know how to configure GraphServiceClient in other ways
Developer technologies | ASP.NET | ASP.NET Core
Microsoft Security | Microsoft Graph
{count} votes

1 answer

Sort by: Most helpful
  1. Stefano Delpero 0 Reputation points
    2023-11-04T08:50:45.7+00:00

    My auth configuration seems correct, I've configured both authentication schema. They works. It's only Graph that didn't use the correct one.

    I found that I can tell GraphServiceClient which auth schema to use with "WithAuthenticationScheme" method:

    var messages = await graph.Me.MailFolders["Inbox"].Messages
        .Request()
        .WithAuthenticationScheme(OpenIdConnectDefaults.AuthenticationScheme)
        .Filter("isRead ne true")
        .GetAsync();
    
    0 comments No comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.