Incomplete documentation

[Sigma3Wolf]

Description

Unfortunately, what should be a simple documentation with basic example fail in a productive view point. If you take current core 8 LTS in vs 2022 and create a simple blazor web app using microsoft identity login template and try to add google oauth, it simply fail. Adding google oauth break microsoft identity, break the antiforgery and break the whole authentification. If you try log off, app crash and each solution to fix one of theses problem break something else. What should be simple, the current documentation fail to achieve by showing a working example. Its eitheir a bug in the current version, a lack in the documentation or an unsuported feature that is silently undocumented

Page URL

https://learn.microsoft.com/en-us/aspnet/core/security/authentication/social/?view=aspnetcore-9.0&tabs=visual-studio

Content source URL

https://github.com/dotnet/AspNetCore.Docs/blob/main/aspnetcore/security/authentication/social/index.md

Document ID

d312db0f-6cf1-87ca-09b0-604a66e18a07

Platform Id

3cd833d7-5dae-9614-dcf8-3d2f85c91989

Article author

@wadepickett

Metadata

• ID: d1612f19-f267-493a-c230-2ca18e4eb50b
• PlatformId: 3cd833d7-5dae-9614-dcf8-3d2f85c91989
• Service: aspnet-core
• Sub-service: security

Related Issues

[guardrex]

Hello @Sigma3Wolf ... Stand-by while we triage this.

@halter73 ... This is for a BWA+Individual Accounts+social auth (Google in this case). Would you like to transfer this to the product unit's repo for investigation or have @Sigma3Wolf open it there (with a repro app in GH)?

@wadepickett ... I'll keep an 👁️ on this one given that it's focused on Blazor.

[Sigma3Wolf]

Update. I seem to have found a way to make it work. This week end ill sort it out to understand why it doesnt work with Microsoft base template. It seem to be related to blazor sensitivity to middleware ordering and some incompatibility between microsoft identity and oAuth (google) connection. I have made a working project including the 3 culprit in login: Microsoft Identity + Google oAuth + jwt (web api) all in the same web blazor app. I should have time this week end to put that in a public repository with explanation why the modification required is complex. Hope that help. Best regards

…

________________________ *Patrice CHARBONNEAU* Avis de confidentialité : Ce message est confidentiel, peut être protégé par le secret professionnel et est à l'usage exclusif de son destinataire. Il est strictement interdit de le diffuser, le distribuer ou le reproduire. Si le destinataire ne peut être joint ou vous est inconnu, veuillez informer l'expéditeur par courrier électronique immédiatement et effacer ce message et en détruire toute copie. Notice of confidentiality: This message is confidential, may be privileged and is intended for the exclusive use of the addressee. It is strictly prohibited from disclosing, distributing or reproducing it. If the addressee cannot be reached or is unknown to you, please inform the sender by return e-mail immediately and delete this message and destroy all copies.

On Fri, Sep 26, 2025, 09:27 Luke Latham ***@***.***> wrote: *guardrex* left a comment (dotnet/AspNetCore.Docs#36159) <#36159 (comment)> Hello @Sigma3Wolf <https://github.com/Sigma3Wolf> ... Stand-by while we triage this. @halter73 <https://github.com/halter73> ... This is for a BWA+Individual Accounts+social auth (Google in this case). Would you like to transfer this to the product unit's repo for investigation or have @Sigma3Wolf <https://github.com/Sigma3Wolf> open it there (with a repro app in GH)? — Reply to this email directly, view it on GitHub <#36159 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/BBUXW77MB56USRQGGTKP6OL3UU5LVAVCNFSM6AAAAACHRHYDZ6VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTGMZYG4ZDSOBZGM> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[guardrex]

Thanks. I'll leave this issue open until the end of next week.

Nevermind, @halter73, for now. I'll get back to you later depending on what @Sigma3Wolf provides.

[Sigma3Wolf]

Hi, On September 25, I installed vs 2022 17.14.16 (I was on the next previous version) and today I was trying to reproduce the bug which was plugging me for the last 8 month and while doing the video for your team, I realized apparently, 17.14.16 fixed it. There is nothing in the update documentation about this issue but it does work on 17.14.16 in previous version, when adding Google auth, it broke the internal id/pw auth, and when trying to logout, it crash the app. the fix was to remove the .AddIdentityCookies() and not to add the google concurrently but as a separate call. what work now: builder.Services.AddAuthentication(options => { options.DefaultScheme = IdentityConstants.ApplicationScheme; options.DefaultSignInScheme = IdentityConstants.ExternalScheme; }) .AddIdentityCookies(); builder.Services.AddAuthentication().AddGoogle(googleOptions => { googleOptions.ClientId = builder.Configuration["Authentication:Google:ClientId"] ?? ""; googleOptions.ClientSecret = builder.Configuration["Authentication:Google:ClientSecret"] ?? ""; }); thoses 2 separate calls DIDN'T work last week. we had to do it in 1 call and disable AddIdentityCookies: builder.Services.AddAuthentication(googleOptions => { googleOptions.DefaultScheme = IdentityConstants.ApplicationScheme; googleOptions.DefaultSignInScheme = IdentityConstants.ExternalScheme; }) //.AddIdentityCookies(); .AddGoogle(options => { options.ClientId = builder.Configuration["Authentication:Google:ClientId"] ?? ""; options.ClientSecret = builder.Configuration["Authentication:Google:ClientSecret"] ?? ""; }); I'll mangle a little more with it to ensure it's completely fixed now

…

________________________ *Patrice CHARBONNEAU* Avis de confidentialité : Ce message est confidentiel, peut être protégé par le secret professionnel et est à l'usage exclusif de son destinataire. Il est strictement interdit de le diffuser, le distribuer ou le reproduire. Si le destinataire ne peut être joint ou vous est inconnu, veuillez informer l'expéditeur par courrier électronique immédiatement et effacer ce message et en détruire toute copie. Notice of confidentiality: This message is confidential, may be privileged and is intended for the exclusive use of the addressee. It is strictly prohibited from disclosing, distributing or reproducing it. If the addressee cannot be reached or is unknown to you, please inform the sender by return e-mail immediately and delete this message and destroy all copies.

On Fri, Sep 26, 2025 at 9:56 AM Luke Latham ***@***.***> wrote: *guardrex* left a comment (dotnet/AspNetCore.Docs#36159) <#36159 (comment)> Thanks. I'll leave this issue open until the end of next week. Nevermind, @halter73 <https://github.com/halter73>, for now. I'll get back to you later depending on what @Sigma3Wolf <https://github.com/Sigma3Wolf> provides. — Reply to this email directly, view it on GitHub <#36159 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/BBUXW7Z7SKEUMJEA3PFW3QD3UVAZPAVCNFSM6AAAAACHRHYDZ6VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTGMZYHA2TANRTGM> . You are receiving this because you were mentioned.Message ID: ***@***.***>