Align scope used by client and server in blazor wasm template

[JunTaoLuo]

Fixes https://github.com/aspnet/AspNetCore-ManualTests/issues/149.

Description

The scope used during validation in the WeatherForecast controller is hard coded to access_as_user. This is an issue for the blazor-wasm template since if IndividualB2C auth is configured, the scope specified by the default-scope option will could lead to a mismatch between the client's configuration and the validation logic in the controller of the server. This change removes the hardcoding and aligns the scopes so that the same scope is used in the client and the server.

Customer Impact

If the customer creates a hosted blazor wasm template (aka ComponentsWebAssembly) and selectes to use IndividualB2C auth and sets the default-scope option to anything other than access_as_user. The validation check in the WeatherForecast controller will fail.

Regression?

Yes, this is a regression that was introduced in 5.0 preview8

Risk

Very low, this template change affects a very narrow scenario (hosted blazor wasm with IndividualB2C enabled) and has been verified locally.

[JunTaoLuo]

@Pilchie should we try to make this fix in preview8? Or should we just note it as a known issue and have the users work around it by removing the check after generating the template?

[JunTaoLuo]

Based on offline discussion, it was determined that we should match the scope used for validation to what was set here: https://github.com/dotnet/aspnetcore/blob/master/src/ProjectTemplates/Web.ProjectTemplates/content/ComponentsWebAssembly-CSharp/Client/Program.cs#L67 which is controlled by the default-scopes option. We also decided to change the default from user_impersonation to access_as_user.

Note that we should update the instructions at https://github.com/aspnet/Tooling-ManualTests/blob/rel/16.7/E2EWalkthroughs/VS/AspNetCore30/30_ClientBlazorWithAADB2C.md

[javiercn]

Based on offline discussion, it was determined that we should match the scope used for validation to what was set here: https://github.com/dotnet/aspnetcore/blob/master/src/ProjectTemplates/Web.ProjectTemplates/content/ComponentsWebAssembly-CSharp/Client/Program.cs#L67 which is controlled by the default-scopes option. We also decided to change the default from user_impersonation to access_as_user.

Note that we should update the instructions at https://github.com/aspnet/Tooling-ManualTests/blob/rel/16.7/E2EWalkthroughs/VS/AspNetCore30/30_ClientBlazorWithAADB2C.md

Thanks @JunTaoLuo.

@guardrex can you take care of the doc update?

[javiercn]

LGTM,

I'll assume you've done due diligence and tested the change manually.

[jmprieur]

LGTM.

[guardrex]

Nothing has been documented for the new APIs yet. I opened Microsoft.Identity.Web APIs for Blazor (dotnet/AspNetCore.Docs #19503), and I plan to work it when RC1 lands.

[Pilchie]

I think we should at least talk to Tactics about taking this for Preview 8. Can you retarget and send mail for it?

[JunTaoLuo]

I'll send the email after I test a few more scenarios with @captainsafia

[ghost]

Hello human! Please make sure you've included the Shiproom Template in a comment or (preferably) the PR description. Also, make sure this PR is not marked as a draft and is ready-to-merge.