Is there any way to create PnpContext from previous authentication?

[gopaldahal]

Currently PnPContext provide mechanism for getting token
var accessToken = pnpContext.Result.AuthenticationProvider.GetAccessTokenAsync(new Uri(siteUrl))
The same token can be used to create CSOM client context.

        public static async void GetAuthenticatedClientContextFromToken(string targetUrl, string accessToken)
        {
            ClientContext clientContext = null;
            try
            {
                clientContext = new ClientContext(targetUrl)
                {
                    AuthenticationMode = ClientAuthenticationMode.Anonymous
                };
                clientContext.ExecutingWebRequest +=
                    delegate (object oSender, WebRequestEventArgs webRequestEventArgs)
                    {
                        webRequestEventArgs.WebRequestExecutor.RequestHeaders["Authorization"] =
                            "Bearer " + accessToken;
                        webRequestEventArgs.WebRequestExecutor.WebRequest.UserAgent = "ABC";
                    };
                clientContext.ExecuteQuery();

            }
            catch (Exception ex)
            {
            }
        }

Means the token can be used to create CSOM context by saving it somewhere (until the token is expired) without reauthenticating the user.

Searching a similar way to use the same token or sth like that so that I don't need to regularly authenticate the user to create PnPContext
I might have missed the documentation.
Please help.

Sharing is Caring!!

[jansenbe]

@gopaldahal : under the covers we use the MSAL library for authenticating and that library will handle token caching and refreshing, meaning the fact that you request an access token for a new site does not mean a server request...if MSAL still has a valid token cached you'll get that one back automatically. You can see this in the GetAccessTokenAsync methods of our public and confidential authentication providers (see https://github.com/pnp/pnpcore/tree/dev/src/sdk/PnP.Core.Auth)

[jansenbe]

So instead of having MSAL store it securely in memory you want to store it in a database?

[gopaldahal]

Hi @jansenbe, I don't know how you are taking this. I was just wondering If I can store tokens somewhere so that If I restart my machine/app or something like that, I do not need to reauthenticate with credentials again.
If MSAL itself provides for the same type of mechanism, it would be much better.

[jansenbe]

This can be done, but will be more complicated. First step will be building your own authentication provider (like shown in here: https://pnp.github.io/pnpcore/using-the-sdk/custom-authentication-provider.html). In there you fully own getting access tokens and providing them to PnP Core SDK, so you could reuse some of the existing authentication provider code and combine that with caching the resulted access token yourselves.

But still not convinced this will add value: an access token is valid for 1h...so your cache would anyhow only work for one hour. When a new access token is needed MSAL will use the refresh token it stored to handle that...your could would have to do this as well then...I think in the end you'll end up with something similar.

If you want to store the user's refresh token so it can be used from other backend services later on then I see value in your scenario, https://github.com/pnp/contoso/tree/main/onedrivefiles is an example that configures MSAL to use an Azure SQL database as store for it's data...so taking some pieces from this sample + a custom auth provider + reusing some auth code from existing providers can get you there.

[Retcorp]

Hi, I came across this thread as I was trying to do a similar thing, but it could potentially be my lack of understanding of the auth process.

I currently use the InteractiveAuthenticationProvider from a proof of concept windows form (in debug), and that results in an auth box popping up every time I restart my app. I had wanted it to remember the fact that from that auth box the user had given delegated permission to the app so that it could effectively "automatically" tell the app "You've got delegated authorisation from before, just produce the PnPContext and get on with things (SPO add, delete, etc)". As per the author, my initial thoughts were to use something like the: context.AuthenticationProvider.GetAccessTokenAsync, which seems to give me a nice scoped token, I was then going to stash it away somewhere and then when the user next wanted to perform an action on a context, it would check if the token were still valid then it would get a new PnPcontext from that token (skipping the auth box) so that it could continue, or if not, and the token had expired or whatever, then it would do another interactive auth box to allow the user to get a fresh context.

It feels like I'm fundamentally not understanding the best use of tokens in this scenario perhaps. Is there a decent resource, doc or example codeset that I can read to understand PnP Core usage of them? I've scoured the web for several weeks now and my eyes are square. I basically want a PnPContext every time it's needed with as few auth boxes as possible. ultimately I'm moving this Proof of concept to an Outlook plugin, so don't want to plague the users with constant auth boxes if they have closed and reopened their Outlook! Any help or pointers would be gratefully received!

[jansenbe]

@Retcorp : You can handle your own MSAL context saving like shown in https://github.com/pnp/contoso/blob/main/onedrivefiles/FilesApplication/MainWindow.xaml.cs. In this sample application the user only logs in once, the MSAL auth cache is persisted on the user's machine and on a next application start used to silently acquire an access token. In the PnP Core auth providers the created MSAL clients are not exposed publicly, so you can't simply do the TokenCacheHelper.EnableSerialization(_app.UserTokenCache); approach shown in the linked sample. You can however fully own the MSAL implementation like the sample does, and then use our ExternalAuthenticationProvider (see https://github.com/pnp/pnpcore/blob/dev/samples/Demo.ASPNetCore/Controllers/HomeController.cs#L134 for a sample use) to provide the access token you've obtained yourselves using MSAL