MacCatalyst平台MAUI应用使用MSAL遇平台不支持问题求助

针对Mac Catalyst平台不支持InteractiveBrowserCredential的问题，你可以通过少量代码调整解决，无需自行实现完整OAuth流程：

1. 替换认证方式为MSAL嵌入式WebView认证 #

InteractiveBrowserCredential依赖系统浏览器跳转，但Mac Catalyst对此支持有限，改用嵌入式WebView认证（基于Microsoft.Identity.Client库）是更适配的方案。

修改认证工具类核心逻辑 #

将原有的InteractiveBrowserCredential替换为PublicClientApplication，并配置Mac Catalyst适配选项：

using Microsoft.Identity.Client;

public static async Task<IPublicClientApplication> BuildMsalClientAsync(CredentialInformation credentialInformation)
{
    ArgumentNullException.ThrowIfNull(credentialInformation);

    var pca = PublicClientApplicationBuilder
        .Create(credentialInformation.ClientId)
        .WithTenantId(credentialInformation.TenantId)
        .WithRedirectUri($"msal{credentialInformation.ClientId}://auth") // Mac Catalyst推荐的重定向格式
        .WithTokenCachePersistenceOptions(new TokenCachePersistenceOptions
        {
            Name = nameof(InteractiveBrowserCredentialUtility)
        })
        .Build();

    // 加载已保存的认证记录
    if (!string.IsNullOrWhiteSpace(credentialInformation.Token))
    {
        using var ms = new MemoryStream(Encoding.UTF8.GetBytes(credentialInformation.Token));
        var authRecord = await AuthenticationRecord.DeserializeAsync(ms).ConfigureAwait(true);
        await pca.AcquireTokenSilent(credentialInformation.Scopes, authRecord.Account)
            .ExecuteAsync().ConfigureAwait(false);
    }

    return pca;
}

2. 调整GraphServiceClient初始化逻辑 #

通过MSAL客户端获取令牌，再初始化GraphServiceClient，同时处理交互式认证场景：

public static async Task<string?> GetCurrentStatusAsync(CredentialInformation credentialInformation, string teamsUserId)
{
    var pca = await BuildMsalClientAsync(credentialInformation).ConfigureAwait(true);
    AuthenticationResult result;

    try
    {
        // 尝试静默获取令牌
        var accounts = await pca.GetAccountsAsync().ConfigureAwait(true);
        result = await pca.AcquireTokenSilent(credentialInformation.Scopes, accounts.FirstOrDefault())
            .ExecuteAsync().ConfigureAwait(false);
    }
    catch (MsalUiRequiredException)
    {
        // 触发嵌入式WebView交互式认证
        result = await pca.AcquireTokenInteractive(credentialInformation.Scopes)
            .WithParentActivityOrWindow(GetCurrentWindow()) // 绑定MAUI窗口，确保WebView弹窗正常显示
            .ExecuteAsync().ConfigureAwait(true);

        // 保存认证记录
        using var ms = new MemoryStream();
        await result.AuthenticationRecord.SerializeAsync(ms).ConfigureAwait(true);
        ms.Position = 0;
        using var reader = new StreamReader(ms, Encoding.UTF8);
        credentialInformation.TokenCallback?.Invoke(await reader.ReadToEndAsync().ConfigureAwait(true));
    }

    // 用令牌初始化GraphServiceClient
    using var graphClient = new GraphServiceClient(new DelegateAuthenticationProvider(async (requestMessage) =>
    {
        requestMessage.Headers.Authorization = new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", result.AccessToken);
    }));

    var currentPresence = await graphClient.Users[teamsUserId].Presence.GetAsync().ConfigureAwait(false);
    return currentPresence?.StatusMessage?.Message?.Content;
}

3. 添加Mac Catalyst窗口句柄获取逻辑 #

在MAUI中获取当前窗口句柄，确保嵌入式WebView能正确附着：

#if MACCATALYST
using UIKit;
#endif

private static object? GetCurrentWindow()
{
#if MACCATALYST
    return UIApplication.SharedApplication.KeyWindow?.RootViewController;
#else
    return null;
#endif
}

关键注意事项 #

• 重定向URI配置：需在Azure AD应用注册中添加msal{你的ClientId}://auth格式的重定向URI。
• 权限配置：确保Azure AD应用已授予Presence.Read等所需的MS Graph权限。
• 令牌缓存：沿用原有令牌缓存逻辑，保证认证状态持久化。

内容的提问来源于stack exchange，提问作者DominikAmon