From 8b9eb0785209dea99ea7ff309f56cff3c28d4553 Mon Sep 17 00:00:00 2001
From: Zachary Halzel <zahalzel@microsoft.com>
Date: Tue, 30 May 2023 15:05:28 -0400
Subject: [PATCH] CIAM updates (#2422) (#2432)

* CIAM updates (#2422)

* Updates for CIAM

* Updates for code modifier configs

* Update version to 2.0.4
---
 eng/Versions.MSIdentity.props                 |   2 +-
 .../ApplicationParameters.cs                  |   5 +
 .../AzureAdProperties.cs                      |  25 ++-
 .../cm_dotnet_blazorserver.json               |   4 +-
 .../cm_dotnet_blazorwasm.json                 |   2 +-
 .../CodeModifierConfigs/cm_dotnet_webapp.json |  73 ++++---
 .../CodeReaderWriter/ProjectModifier.cs       |  27 +--
 ...osoftIdentityPlatformApplicationManager.cs |  33 ++-
 .../Properties/Resources.Designer.cs          | 198 +++++++++---------
 .../Properties/Resources.resx                 |  32 +--
 10 files changed, 230 insertions(+), 171 deletions(-)

diff --git a/eng/Versions.MSIdentity.props b/eng/Versions.MSIdentity.props
index f2899e63e..e899be35e 100644
--- a/eng/Versions.MSIdentity.props
+++ b/eng/Versions.MSIdentity.props
@@ -6,7 +6,7 @@
     <UsingToolNetFrameworkReferenceAssemblies>true</UsingToolNetFrameworkReferenceAssemblies>
   </PropertyGroup>
   <PropertyGroup>
-    <VersionPrefix>2.0.3</VersionPrefix>
+    <VersionPrefix>2.0.4</VersionPrefix>
     <PreReleaseVersionLabel>rtm</PreReleaseVersionLabel>
     <IsServicingBuild Condition="'$(PreReleaseVersionLabel)' == 'servicing'">true</IsServicingBuild>
     <!--
diff --git a/src/MSIdentityScaffolding/Microsoft.DotNet.MSIdentity/AuthenticationParameters/ApplicationParameters.cs b/src/MSIdentityScaffolding/Microsoft.DotNet.MSIdentity/AuthenticationParameters/ApplicationParameters.cs
index 27da62897..7e4f1d32b 100644
--- a/src/MSIdentityScaffolding/Microsoft.DotNet.MSIdentity/AuthenticationParameters/ApplicationParameters.cs
+++ b/src/MSIdentityScaffolding/Microsoft.DotNet.MSIdentity/AuthenticationParameters/ApplicationParameters.cs
@@ -87,6 +87,11 @@ public string? Domain1
         /// </summary>
         public bool IsB2C { get; set; }
 
+        /// <summary>
+        /// Is authenticated with CIAM.
+        /// </summary>
+        public bool IsCiam { get; set; }
+
         /// <summary>
         /// Sign-up/sign-in policy in the case of B2C.
         /// </summary>
diff --git a/src/MSIdentityScaffolding/Microsoft.DotNet.MSIdentity/AuthenticationParameters/AzureAdProperties.cs b/src/MSIdentityScaffolding/Microsoft.DotNet.MSIdentity/AuthenticationParameters/AzureAdProperties.cs
index a67e9c436..30b7e49ff 100644
--- a/src/MSIdentityScaffolding/Microsoft.DotNet.MSIdentity/AuthenticationParameters/AzureAdProperties.cs
+++ b/src/MSIdentityScaffolding/Microsoft.DotNet.MSIdentity/AuthenticationParameters/AzureAdProperties.cs
@@ -29,6 +29,7 @@ public static class PropertyNames
     // https://github.com/dotnet/aspnetcore/blob/6bc4b79f4ee7af00edcbb435e5ee4c1de349a110/src/ProjectTemplates/Web.ProjectTemplates/content/StarterWeb-CSharp/appsettings.json
     public static class DefaultProperties
     {
+        public const string Authority = "https://qualified.domain.name/";
         public const string Domain = "qualified.domain.name";
         public const string TenantId = "22222222-2222-2222-2222-222222222222";
         public const string ClientId = "11111111-1111-1111-11111111111111111";
@@ -53,6 +54,7 @@ public class AzureAdBlock
         public bool IsBlazorWasm;
         public bool IsWebApi;
         public bool IsB2C;
+        public bool IsCIAM;
         public bool HasClientSecret;
 
         public string? ClientId;
@@ -76,9 +78,15 @@ public AzureAdBlock(ApplicationParameters applicationParameters, JObject? existi
             IsBlazorWasm = applicationParameters.IsBlazorWasm;
             IsWebApi = applicationParameters.IsWebApi.GetValueOrDefault();
             IsB2C = applicationParameters.IsB2C;
+            IsCIAM = applicationParameters.IsCiam;
             HasClientSecret = applicationParameters.CallsDownstreamApi || applicationParameters.CallsMicrosoftGraph;
 
             Domain = !string.IsNullOrEmpty(applicationParameters.Domain) ? applicationParameters.Domain : existingBlock?.GetValue(PropertyNames.Domain)?.ToString() ?? DefaultProperties.Domain;
+            if (IsCIAM)
+            {
+                Domain = Domain.Replace("onmicrosoft.com", "ciamlogin.com");
+            }
+
             TenantId = !string.IsNullOrEmpty(applicationParameters.TenantId) ? applicationParameters.TenantId : existingBlock?.GetValue(PropertyNames.TenantId)?.ToString() ?? DefaultProperties.TenantId;
             ClientId = !string.IsNullOrEmpty(applicationParameters.ClientId) ? applicationParameters.ClientId : existingBlock?.GetValue(PropertyNames.ClientId)?.ToString() ?? DefaultProperties.ClientId;
             Instance = !string.IsNullOrEmpty(applicationParameters.Instance) ? applicationParameters.Instance : existingBlock?.GetValue(PropertyNames.Instance)?.ToString() ?? DefaultProperties.Instance;
@@ -86,8 +94,7 @@ public AzureAdBlock(ApplicationParameters applicationParameters, JObject? existi
             Scopes = !string.IsNullOrEmpty(applicationParameters.CalledApiScopes) ? applicationParameters.CalledApiScopes : existingBlock?.GetValue(PropertyNames.Scopes)?.ToString()
                 ?? (applicationParameters.CallsDownstreamApi ? DefaultProperties.ApiScopes : applicationParameters.CallsMicrosoftGraph ? DefaultProperties.MicrosoftGraphScopes : null);
             SignUpSignInPolicyId = !string.IsNullOrEmpty(applicationParameters.SusiPolicy) ? applicationParameters.SusiPolicy : existingBlock?.GetValue(PropertyNames.SignUpSignInPolicyId)?.ToString() ?? DefaultProperties.SignUpSignInPolicyId;
-            // TODO determine the SusiPolicy from the graph beta
-            Authority = IsB2C ? $"{Instance}{Domain}/{SignUpSignInPolicyId}" : $"{Instance}{Domain}";
+            Authority = IsCIAM ? $"https://{Domain}/" : IsB2C ? $"{Instance}{Domain}/{SignUpSignInPolicyId}" : $"{Instance}{Domain}"; 
             ClientSecret = existingBlock?.GetValue(PropertyNames.ClientSecret)?.ToString() ?? DefaultProperties.ClientSecret;
             ClientCertificates = existingBlock?.GetValue(PropertyNames.ClientCertificates)?.ToObject<string[]>();
         }
@@ -99,6 +106,15 @@ public AzureAdBlock(ApplicationParameters applicationParameters, JObject? existi
             ValidateAuthority = !IsB2C
         };
 
+        public dynamic CIAMSettings => new
+        {
+            Authority = Authority ?? DefaultProperties.Authority,
+            ClientId = ClientId ?? DefaultProperties.ClientId,
+            ClientSecret = ClientSecret ?? DefaultProperties.ClientSecret,
+            ClientCertificates = ClientCertificates ?? Array.Empty<string>(),
+            CallbackPath = CallbackPath ?? DefaultProperties.CallbackPath
+        };
+
         public dynamic WebAppSettings => new
         {
             Instance = Instance ?? DefaultProperties.Instance,
@@ -140,6 +156,11 @@ public JObject ToJObject()
                 return JObject.FromObject(BlazorSettings);
             }
 
+            if (IsCIAM)
+            {
+                return JObject.FromObject(CIAMSettings);
+            }
+
             var jObject = IsWebApi ? JObject.FromObject(WebApiSettings) : JObject.FromObject(WebAppSettings);
 
             if (IsB2C)
diff --git a/src/MSIdentityScaffolding/Microsoft.DotNet.MSIdentity/CodeReaderWriter/CodeModifierConfigs/cm_dotnet_blazorserver.json b/src/MSIdentityScaffolding/Microsoft.DotNet.MSIdentity/CodeReaderWriter/CodeModifierConfigs/cm_dotnet_blazorserver.json
index 4bd89eac3..49bc0ac99 100644
--- a/src/MSIdentityScaffolding/Microsoft.DotNet.MSIdentity/CodeReaderWriter/CodeModifierConfigs/cm_dotnet_blazorserver.json
+++ b/src/MSIdentityScaffolding/Microsoft.DotNet.MSIdentity/CodeReaderWriter/CodeModifierConfigs/cm_dotnet_blazorserver.json
@@ -250,7 +250,7 @@
       ]
     },
     {
-      "FileName": "LoginDisplay.razor",
+      "FileName": "blazorserver_LoginDisplay.razor",
       "AddFilePath": "Shared/LoginDisplay.razor"
     },
     {
@@ -268,4 +268,4 @@
       ]
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/src/MSIdentityScaffolding/Microsoft.DotNet.MSIdentity/CodeReaderWriter/CodeModifierConfigs/cm_dotnet_blazorwasm.json b/src/MSIdentityScaffolding/Microsoft.DotNet.MSIdentity/CodeReaderWriter/CodeModifierConfigs/cm_dotnet_blazorwasm.json
index 15aa63e9b..23fff1ebb 100644
--- a/src/MSIdentityScaffolding/Microsoft.DotNet.MSIdentity/CodeReaderWriter/CodeModifierConfigs/cm_dotnet_blazorwasm.json
+++ b/src/MSIdentityScaffolding/Microsoft.DotNet.MSIdentity/CodeReaderWriter/CodeModifierConfigs/cm_dotnet_blazorwasm.json
@@ -193,7 +193,7 @@
       "AddFilePath": "Pages/Authentication.razor"
     },
     {
-      "FileName": "LoginDisplay.razor",
+      "FileName": "blazorwasm_LoginDisplay.razor",
       "AddFilePath": "Shared/LoginDisplay.razor"
     },
     {
diff --git a/src/MSIdentityScaffolding/Microsoft.DotNet.MSIdentity/CodeReaderWriter/CodeModifierConfigs/cm_dotnet_webapp.json b/src/MSIdentityScaffolding/Microsoft.DotNet.MSIdentity/CodeReaderWriter/CodeModifierConfigs/cm_dotnet_webapp.json
index 27f1e935b..d1a343383 100644
--- a/src/MSIdentityScaffolding/Microsoft.DotNet.MSIdentity/CodeReaderWriter/CodeModifierConfigs/cm_dotnet_webapp.json
+++ b/src/MSIdentityScaffolding/Microsoft.DotNet.MSIdentity/CodeReaderWriter/CodeModifierConfigs/cm_dotnet_webapp.json
@@ -140,15 +140,14 @@
               "LeadingTrivia": {
                 "Newline": true
               }
-            },     
+            },
             {
               "CodeChangeType": "Lambda",
               "Parent": "WebApplication.CreateBuilder.Services.AddAuthorization",
               "Block": "options.FallbackPolicy = options.DefaultPolicy",
               "Parameter": "options",
-              "LeadingTrivia":
-              {
-                "Newline":true,
+              "LeadingTrivia": {
+                "Newline": true,
                 "NumberOfSpaces": 4
               }
             },
@@ -156,9 +155,8 @@
               "Parent": "WebApplication.CreateBuilder.Services.AddRazorPages",
               "CodeChangeType": "MemberAccess",
               "Block": "AddMicrosoftIdentityUI()",
-              "LeadingTrivia":
-              {
-                "Newline":true, 
+              "LeadingTrivia": {
+                "Newline": true,
                 "NumberOfSpaces": 4
               }
             },
@@ -187,10 +185,10 @@
     },
     {
       "FileName": "Index.cshtml.cs",
-      "Options" :  [ "MicrosoftGraph", "DownstreamApi" ],
+      "Options": [ "MicrosoftGraph", "DownstreamApi" ],
       "ClassProperties": [
         {
-          "Block" : "private readonly GraphServiceClient _graphServiceClient",
+          "Block": "private readonly GraphServiceClient _graphServiceClient",
           "Options": [ "MicrosoftGraph" ]
         },
         {
@@ -209,11 +207,10 @@
         }
       ],
       "Methods": {
-        "OnGet":
-        {
-          "EditType" : {
-           "Block": "async Task",
-           "Options": ["MicrosoftGraph", "DownstreamApi"]
+        "OnGet": {
+          "EditType": {
+            "Block": "async Task",
+            "Options": [ "MicrosoftGraph", "DownstreamApi" ]
           },
           "CodeChanges": [
             {
@@ -221,21 +218,21 @@
               "LeadingTrivia": {
                 "NumberOfSpaces": 12
               },
-              "Options" : [ "MicrosoftGraph"]
+              "Options": [ "MicrosoftGraph" ]
             },
             {
               "Block": "ViewData[\"GraphApiResult\"] = user.DisplayName;",
               "LeadingTrivia": {
                 "NumberOfSpaces": 12
               },
-              "Options" : [ "MicrosoftGraph"]
+              "Options": [ "MicrosoftGraph" ]
             },
             {
-              "Block" : "using var response = await _downstreamWebApi.CallWebApiForUserAsync(\"DownstreamApi\").ConfigureAwait(false);",
+              "Block": "using var response = await _downstreamWebApi.CallWebApiForUserAsync(\"DownstreamApi\").ConfigureAwait(false);",
               "LeadingTrivia": {
                 "NumberOfSpaces": 12
               },
-              "Options" : [ "DownstreamApi"]
+              "Options": [ "DownstreamApi" ]
             },
             {
               "Block": "\n\n            if (response.StatusCode == System.Net.HttpStatusCode.OK)\n            {\n                var apiResult = await response.Content.ReadAsStringAsync().ConfigureAwait(false);\n                ViewData[\"ApiResult\"] = apiResult;\n            }\n            else\n            {\n                var error = await response.Content.ReadAsStringAsync().ConfigureAwait(false);\n                throw new HttpRequestException($\"Invalid status code in the HttpResponseMessage: {response.StatusCode}: {error}\");\n            }",
@@ -243,16 +240,16 @@
             }
           ]
         },
-        "IndexModel" : {
-          "Parameters" : [ "ILogger<IndexModel>" ],
-          "AddParameters" : [ 
+        "IndexModel": {
+          "Parameters": [ "ILogger<IndexModel>" ],
+          "AddParameters": [
             {
-              "Block":"GraphServiceClient graphServiceClient",
-              "Options": [ "MicrosoftGraph"]
+              "Block": "GraphServiceClient graphServiceClient",
+              "Options": [ "MicrosoftGraph" ]
             },
             {
-              "Block":"IDownstreamWebApi downstreamWebApi",
-              "Options": [ "DownstreamApi"]
+              "Block": "IDownstreamWebApi downstreamWebApi",
+              "Options": [ "DownstreamApi" ]
             }
           ],
           "CodeChanges": [
@@ -273,7 +270,7 @@
           ]
         }
       },
-      "Usings" : [
+      "Usings": [
         "Microsoft.Identity.Web",
         "System.Net"
       ],
@@ -301,6 +298,30 @@
           ]
         }
       }
+    },
+    {
+      "FileName": "_Layout.cshtml",
+      "Methods": {
+        "Global": {
+          "CodeChanges": [
+            {
+              "MultiLineBlock": [
+                "</ul>",
+                "                <partial name=\"_LoginPartial\" />",
+                "                </div>"
+              ],
+              "ReplaceSnippet": [
+                "</ul>",
+                "                </div>"
+              ]
+            }
+          ]
+        }
+      }
+    },
+    {
+      "FileName": "LoginPartial.cshtml",
+      "AddFilePath": "Pages/Shared/_LoginPartial.cshtml"
     }
   ]
 }
diff --git a/src/MSIdentityScaffolding/Microsoft.DotNet.MSIdentity/CodeReaderWriter/ProjectModifier.cs b/src/MSIdentityScaffolding/Microsoft.DotNet.MSIdentity/CodeReaderWriter/ProjectModifier.cs
index 2fb589160..8a09b4d21 100644
--- a/src/MSIdentityScaffolding/Microsoft.DotNet.MSIdentity/CodeReaderWriter/ProjectModifier.cs
+++ b/src/MSIdentityScaffolding/Microsoft.DotNet.MSIdentity/CodeReaderWriter/ProjectModifier.cs
@@ -88,26 +88,21 @@ public async Task AddAuthCodeAsync()
             var filteredFiles = codeModifierConfig.Files.Where(f => ProjectModifierHelper.FilterOptions(f.Options, options));
             foreach (var file in filteredFiles)
             {
-                await HandleCodeFileAsync(file, project, options, codeModifierConfig.Identifier);
+                await HandleCodeFileAsync(file, project, options);
             }
 
             _consoleLogger.LogJsonMessage(State.Success, output: _output.ToString().TrimEnd());
         }
 
-        internal static string GetCodeFileString(CodeFile file, string identifier) // todo make all code files strings
+        internal static string GetCodeFileString(CodeFile file)
         {
             // Resource files cannot contain '-' (dash) or '.' (period)
-            var codeFilePropertyName = $"add_{identifier.Replace('-', '_')}_{file.FileName.Replace('.', '_')}";
+            var codeFilePropertyName = $"add_{file.FileName.Replace('.', '_')}";
             var property = AppProvisioningTool.Properties.FirstOrDefault(
-                p => p.Name.Equals(codeFilePropertyName));
-
-            if (property is null)
-            {
-                throw new FormatException($"Resource property for {file.FileName} could not be found. ");
-            }
+                p => p.Name.Equals(codeFilePropertyName))
+                ?? throw new FormatException($"Resource property for {file.FileName} could not be found. ");
 
             var codeFileString = property.GetValue(typeof(Resources))?.ToString();
-
             if (string.IsNullOrEmpty(codeFileString))
             {
                 throw new FormatException($"CodeFile string for {file.FileName} was empty.");
@@ -116,7 +111,7 @@ internal static string GetCodeFileString(CodeFile file, string identifier) // to
             return codeFileString;
         }
 
-        internal static ClassDeclarationSyntax ModifyMethods(string fileName, ClassDeclarationSyntax classNode, DocumentBuilder documentBuilder, Dictionary<string, Method> methods, CodeChangeOptions options, StringBuilder output)
+        internal static ClassDeclarationSyntax ModifyMethods(string fileName, ClassDeclarationSyntax classNode, Dictionary<string, Method> methods, CodeChangeOptions options, StringBuilder output)
         {
             foreach ((string methodName, Method methodChanges) in methods)
             {
@@ -283,13 +278,13 @@ private PropertyInfo? CodeModifierConfigPropertyInfo
             }
         }
 
-        private async Task HandleCodeFileAsync(CodeFile file, CodeAnalysis.Project project, CodeChangeOptions options, string identifier)
+        private async Task HandleCodeFileAsync(CodeFile file, CodeAnalysis.Project project, CodeChangeOptions options)
         {
             try
             {
                 if (!string.IsNullOrEmpty(file.AddFilePath))
                 {
-                    AddFile(file, identifier);
+                    AddFile(file);
                     _output.AppendLine(string.Format(Resources.AddedCodeFile, file.AddFilePath));
                 }
                 else
@@ -325,7 +320,7 @@ private async Task HandleCodeFileAsync(CodeFile file, CodeAnalysis.Project proje
         /// <param name="file"></param>
         /// <param name="identifier"></param>
         /// <exception cref="FormatException"></exception>
-        private void AddFile(CodeFile file, string identifier)
+        private void AddFile(CodeFile file)
         {
             var filePath = Path.Combine(_toolOptions.ProjectPath, file.AddFilePath);
             if (File.Exists(filePath))
@@ -333,7 +328,7 @@ private void AddFile(CodeFile file, string identifier)
                 return; // File exists, don't need to create
             }
 
-            var codeFileString = GetCodeFileString(file, identifier);
+            var codeFileString = GetCodeFileString(file);
 
             var fileDir = Path.GetDirectoryName(filePath);
             if (!string.IsNullOrEmpty(fileDir))
@@ -396,7 +391,7 @@ node is ClassDeclarationSyntax cds &&
                     //add class attributes
                     modifiedClassDeclarationSyntax = documentBuilder.AddClassAttributes(modifiedClassDeclarationSyntax, options);
                     //add code snippets/changes.
-                    modifiedClassDeclarationSyntax = ModifyMethods(file.FileName, modifiedClassDeclarationSyntax, documentBuilder, file.Methods, options, _output);
+                    modifiedClassDeclarationSyntax = ModifyMethods(file.FileName, modifiedClassDeclarationSyntax, file.Methods, options, _output);
 
                     //replace class node with all the updates.
 #pragma warning disable CS8631 // The type cannot be used as type parameter in the generic type or method. Nullability of type argument doesn't match constraint type.
diff --git a/src/MSIdentityScaffolding/Microsoft.DotNet.MSIdentity/MicrosoftIdentityPlatform/MicrosoftIdentityPlatformApplicationManager.cs b/src/MSIdentityScaffolding/Microsoft.DotNet.MSIdentity/MicrosoftIdentityPlatform/MicrosoftIdentityPlatformApplicationManager.cs
index 92070234a..4e0f5c8c9 100644
--- a/src/MSIdentityScaffolding/Microsoft.DotNet.MSIdentity/MicrosoftIdentityPlatform/MicrosoftIdentityPlatformApplicationManager.cs
+++ b/src/MSIdentityScaffolding/Microsoft.DotNet.MSIdentity/MicrosoftIdentityPlatform/MicrosoftIdentityPlatformApplicationManager.cs
@@ -36,10 +36,12 @@ public class MicrosoftIdentityPlatformApplicationManager
 
                 // Get the tenant
                 Organization? tenant = await GetTenant(graphServiceClient, consoleLogger);
-                if (tenant != null && tenant.TenantType.Equals("AAD B2C", StringComparison.OrdinalIgnoreCase))
+                if (tenant != null)
                 {
-                    applicationParameters.IsB2C = true;
+                    applicationParameters.IsB2C = tenant.TenantType.Equals("AAD B2C", StringComparison.OrdinalIgnoreCase);
+                    applicationParameters.IsCiam = tenant.TenantType.Equals("CIAM", StringComparison.OrdinalIgnoreCase);
                 }
+
                 // Create the app.
                 Application application = new Application()
                 {
@@ -73,8 +75,8 @@ public class MicrosoftIdentityPlatformApplicationManager
                 // and useful for Blazorwasm hosted applications. We create it always.
                 var createdSp = await GetOrCreateSP(graphServiceClient, createdApplication.AppId, consoleLogger);
 
-                // B2C does not allow user consent, and therefore we need to explicity grant permissions
-                if (applicationParameters.IsB2C)
+                // B2C & CIAM do not allow user consent, and therefore we need to explicitly grant permissions
+                if (applicationParameters.IsB2C || applicationParameters.IsCiam)
                 {
                     string scopes = GetMsGraphScopes(applicationParameters); // Explicit usage of MicrosoftGraph openid and offline_access in the case of Azure AD B2C.
                     await AddDownstreamApiPermissions(scopes, graphServiceClient, application, createdSp);
@@ -210,8 +212,16 @@ internal async Task UpdateApplication(
 
             (bool needsUpdates, Application appUpdates) = GetApplicationUpdates(remoteApp, toolOptions, parameters);
             output ??= new StringBuilder();
-            // B2C does not allow user consent, and therefore we need to explicity grant permissions
-            if (parameters.IsB2C && parameters.CallsDownstreamApi && !string.IsNullOrEmpty(toolOptions.ApiScopes))
+
+            if (parameters.IsCiam)
+            {
+                // TODO need to add app registration to the user flow or create one
+                // https://learn.microsoft.com/en-us/graph/api/identitycontainer-list-authenticationeventsflows?view=graph-rest-beta
+                // https://graph.microsoft.com/beta/identity/authenticationEventsFlows
+            }
+
+            // B2C does not allow user consent, and therefore we need to explicitly grant permissions
+            if ((parameters.IsCiam || parameters.IsB2C) && parameters.CallsDownstreamApi && !string.IsNullOrEmpty(toolOptions.ApiScopes))
             {
                 // TODO: Add if it's B2C, acquire or create the SUSI Policy
                 var servicePrincipal = await GetOrCreateSP(graphServiceClient, parameters.ClientId, consoleLogger);
@@ -569,7 +579,6 @@ private static async Task AddAdminConsentToApiPermissions(
                     };
 
                     // Check if permissions already exist, otherwise will throw exception
-
                     try
                     {
                         // TODO: See https://github.com/jmprieur/app-provisonning-tool/issues/9. 
@@ -709,9 +718,14 @@ private static void AddWebAppPlatform(Application application, ApplicationParame
             }
 
             IEnumerable<string> scopes = g.Select(r => r.Scope.ToLower(CultureInfo.InvariantCulture));
-            var permissionScopes = spWithScopes.Oauth2PermissionScopes
+            var permissionScopes = spWithScopes.Oauth2PermissionScopes?
                 .Where(s => scopes.Contains(s.Value.ToLower(CultureInfo.InvariantCulture)));
 
+            if (permissionScopes is null)
+            {
+                return null;
+            }
+
             RequiredResourceAccess requiredResourceAccess = new RequiredResourceAccess
             {
                 ResourceAppId = spWithScopes.AppId,
@@ -811,6 +825,7 @@ internal GraphServiceClient GetGraphServiceClient(TokenCredential tokenCredentia
 
             var graphServiceClient = GetGraphServiceClient(tokenCredential);
             Organization? tenant = await GetTenant(graphServiceClient, consoleLogger);
+
             var application = await GetApplication(tokenCredential, applicationParameters);
             if (application is null)
             {
@@ -848,6 +863,7 @@ private ApplicationParameters GetEffectiveApplicationParameters(
             Application application,
             ApplicationParameters originalApplicationParameters)
         {
+            bool isCiam = (tenant.TenantType == "CIAM");
             bool isB2C = (tenant.TenantType == "AAD B2C");
             var effectiveApplicationParameters = new ApplicationParameters
             {
@@ -856,6 +872,7 @@ private ApplicationParameters GetEffectiveApplicationParameters(
                 EffectiveClientId = application.AppId,
                 IsAAD = !isB2C,
                 IsB2C = isB2C,
+                IsCiam = isCiam,
                 HasAuthentication = true,
                 IsWebApi = originalApplicationParameters.IsWebApi.GetValueOrDefault()
                 || application.Api?.Oauth2PermissionScopes?.Any() is true
diff --git a/src/MSIdentityScaffolding/Microsoft.DotNet.MSIdentity/Properties/Resources.Designer.cs b/src/MSIdentityScaffolding/Microsoft.DotNet.MSIdentity/Properties/Resources.Designer.cs
index cb1fd10ae..cfa16438f 100644
--- a/src/MSIdentityScaffolding/Microsoft.DotNet.MSIdentity/Properties/Resources.Designer.cs
+++ b/src/MSIdentityScaffolding/Microsoft.DotNet.MSIdentity/Properties/Resources.Designer.cs
@@ -61,36 +61,18 @@ internal Resources() {
         }
         
         /// <summary>
-        ///   Looks up a localized string similar to @page &quot;/callwebapi&quot;
-        ///
-        ///@using Microsoft.Identity.Web
-        ///
-        ///@inject IDownstreamWebApi downstreamAPI
-        ///@inject MicrosoftIdentityConsentAndConditionalAccessHandler ConsentHandler
-        ///
-        ///&lt;h1&gt;Call an API&lt;/h1&gt;
-        ///
-        ///&lt;p&gt;This component demonstrates fetching data from a Web API.&lt;/p&gt;
+        ///   Looks up a localized string similar to @page &quot;/authentication/{action}&quot;
+        ///@using Microsoft.AspNetCore.Components.WebAssembly.Authentication
+        ///&lt;RemoteAuthenticatorView Action=&quot;@Action&quot; /&gt;
         ///
-        ///@if (apiResult == null)
-        ///{
-        ///    &lt;p&gt;&lt;em&gt;Loading...&lt;/em&gt;&lt;/p&gt;
-        ///}
-        ///else
-        ///{
-        ///    &lt;h2&gt;API Result&lt;/h2&gt;
-        ///    @apiResult
+        ///@code{
+        ///    [Parameter] public string? Action { get; set; }
         ///}
-        ///
-        ///@code {
-        ///    private HttpResponseMessage response;
-        ///    private string apiResult;
-        ///
-        ///    protected override async Task OnInitia [rest of string was truncated]&quot;;.
+        ///.
         /// </summary>
-        internal static string add_dotnet_blazorserver_CallWebApi_razor {
+        internal static string add_Authentication_razor {
             get {
-                return ResourceManager.GetString("add_dotnet_blazorserver_CallWebApi_razor", resourceCulture);
+                return ResourceManager.GetString("add_Authentication_razor", resourceCulture);
             }
         }
         
@@ -106,54 +88,66 @@ internal static string add_dotnet_blazorserver_CallWebApi_razor {
         ///&lt;/AuthorizeView&gt;
         ///.
         /// </summary>
-        internal static string add_dotnet_blazorserver_LoginDisplay_razor {
+        internal static string add_blazorserver_LoginDisplay_razor {
             get {
-                return ResourceManager.GetString("add_dotnet_blazorserver_LoginDisplay_razor", resourceCulture);
+                return ResourceManager.GetString("add_blazorserver_LoginDisplay_razor", resourceCulture);
             }
         }
         
         /// <summary>
-        ///   Looks up a localized string similar to @page &quot;/showprofile&quot;
+        ///   Looks up a localized string similar to @using Microsoft.AspNetCore.Components.Authorization
+        ///@using Microsoft.AspNetCore.Components.WebAssembly.Authentication
+        ///
+        ///@inject NavigationManager Navigation
+        ///@inject SignOutSessionStateManager SignOutManager
+        ///
+        ///&lt;AuthorizeView&gt;
+        ///    &lt;Authorized&gt;
+        ///        Hello, @context.User.Identity?.Name!
+        ///        &lt;button class=&quot;nav-link btn btn-link&quot; @onclick=&quot;BeginLogout&quot;&gt;Log out&lt;/button&gt;
+        ///    &lt;/Authorized&gt;
+        ///    &lt;NotAuthorized&gt;
+        ///        &lt;a href=&quot;authentication/login&quot;&gt;Log in&lt;/a&gt;
+        ///    &lt;/NotAuthorized&gt;
+        ///&lt;/AuthorizeView&gt;
        /// [rest of string was truncated]&quot;;.
+        /// </summary>
+        internal static string add_blazorwasm_LoginDisplay_razor {
+            get {
+                return ResourceManager.GetString("add_blazorwasm_LoginDisplay_razor", resourceCulture);
+            }
+        }
+        
+        /// <summary>
+        ///   Looks up a localized string similar to @page &quot;/callwebapi&quot;
         ///
         ///@using Microsoft.Identity.Web
-        ///@using Microsoft.Graph
-        ///@inject Microsoft.Graph.GraphServiceClient GraphServiceClient
+        ///
+        ///@inject IDownstreamWebApi downstreamAPI
         ///@inject MicrosoftIdentityConsentAndConditionalAccessHandler ConsentHandler
         ///
-        ///&lt;h1&gt;Me&lt;/h1&gt;
+        ///&lt;h1&gt;Call an API&lt;/h1&gt;
         ///
-        ///&lt;p&gt;This component demonstrates fetching data from a service.&lt;/p&gt;
+        ///&lt;p&gt;This component demonstrates fetching data from a Web API.&lt;/p&gt;
         ///
-        ///@if (user == null)
+        ///@if (apiResult == null)
         ///{
         ///    &lt;p&gt;&lt;em&gt;Loading...&lt;/em&gt;&lt;/p&gt;
         ///}
         ///else
         ///{
-        ///    &lt;table class=&quot;table table-striped table-condensed&quot; style=&quot;font-family: monospace&quot;&gt;
-        ///        &lt;tr&gt;
-        ///            &lt;th&gt;Property&lt;/th&gt;
-        ///          [rest of string was truncated]&quot;;.
-        /// </summary>
-        internal static string add_dotnet_blazorserver_ShowProfile_razor {
-            get {
-                return ResourceManager.GetString("add_dotnet_blazorserver_ShowProfile_razor", resourceCulture);
-            }
-        }
-        
-        /// <summary>
-        ///   Looks up a localized string similar to @page &quot;/authentication/{action}&quot;
-        ///@using Microsoft.AspNetCore.Components.WebAssembly.Authentication
-        ///&lt;RemoteAuthenticatorView Action=&quot;@Action&quot; /&gt;
-        ///
-        ///@code{
-        ///    [Parameter] public string? Action { get; set; }
+        ///    &lt;h2&gt;API Result&lt;/h2&gt;
+        ///    @apiResult
         ///}
-        ///.
+        ///
+        ///@code {
+        ///    private HttpResponseMessage response;
+        ///    private string apiResult;
+        ///
+        ///    protected override async Task OnInitia [rest of string was truncated]&quot;;.
         /// </summary>
-        internal static string add_dotnet_blazorwasm_Authentication_razor {
+        internal static string add_CallWebApi_razor {
             get {
-                return ResourceManager.GetString("add_dotnet_blazorwasm_Authentication_razor", resourceCulture);
+                return ResourceManager.GetString("add_CallWebApi_razor", resourceCulture);
             }
         }
         
@@ -176,32 +170,31 @@ internal static string add_dotnet_blazorwasm_Authentication_razor {
         ///    /// &lt;summary&gt;
         ///    /// Extension  [rest of string was truncated]&quot;;.
         /// </summary>
-        internal static string add_dotnet_blazorwasm_GraphClientExtensions_cs {
+        internal static string add_GraphClientExtensions_cs {
             get {
-                return ResourceManager.GetString("add_dotnet_blazorwasm_GraphClientExtensions_cs", resourceCulture);
+                return ResourceManager.GetString("add_GraphClientExtensions_cs", resourceCulture);
             }
         }
         
         /// <summary>
-        ///   Looks up a localized string similar to @using Microsoft.AspNetCore.Components.Authorization
-        ///@using Microsoft.AspNetCore.Components.WebAssembly.Authentication
-        ///
-        ///@inject NavigationManager Navigation
-        ///@inject SignOutSessionStateManager SignOutManager
+        ///   Looks up a localized string similar to @using System.Security.Principal
         ///
-        ///&lt;AuthorizeView&gt;
-        ///    &lt;Authorized&gt;
-        ///        Hello, @context.User.Identity?.Name!
-        ///        &lt;button class=&quot;nav-link btn btn-link&quot; @onclick=&quot;BeginLogout&quot;&gt;Log out&lt;/button&gt;
-        ///    &lt;/Authorized&gt;
-        ///    &lt;NotAuthorized&gt;
-        ///        &lt;a href=&quot;authentication/login&quot;&gt;Log in&lt;/a&gt;
-        ///    &lt;/NotAuthorized&gt;
-        ///&lt;/AuthorizeView&gt;
        /// [rest of string was truncated]&quot;;.
+        ///&lt;ul class=&quot;navbar-nav&quot;&gt;
+        ///@if (User.Identity?.IsAuthenticated == true)
+        ///{
+        ///        &lt;span class=&quot;navbar-text text-dark&quot;&gt;Hello @User.Identity?.Name!&lt;/span&gt;
+        ///        &lt;li class=&quot;nav-item&quot;&gt;
+        ///            &lt;a class=&quot;nav-link text-dark&quot; asp-area=&quot;MicrosoftIdentity&quot; asp-controller=&quot;Account&quot; asp-action=&quot;SignOut&quot;&gt;Sign out&lt;/a&gt;
+        ///        &lt;/li&gt;
+        ///}
+        ///else
+        ///{
+        ///        &lt;li class=&quot;nav-item&quot;&gt;
+        ///            &lt;a class=&quot;nav-link text-dark&quot; asp-area=&quot;MicrosoftIdentity&quot; asp-controller=&quot;Account&quot; asp-ac [rest of string was truncated]&quot;;.
         /// </summary>
-        internal static string add_dotnet_blazorwasm_LoginDisplay_razor {
+        internal static string add_LoginPartial_cshtml {
             get {
-                return ResourceManager.GetString("add_dotnet_blazorwasm_LoginDisplay_razor", resourceCulture);
+                return ResourceManager.GetString("add_LoginPartial_cshtml", resourceCulture);
             }
         }
         
@@ -216,9 +209,38 @@ internal static string add_dotnet_blazorwasm_LoginDisplay_razor {
         ///}
         ///.
         /// </summary>
-        internal static string add_dotnet_blazorwasm_RedirectToLogin_razor {
+        internal static string add_RedirectToLogin_razor {
             get {
-                return ResourceManager.GetString("add_dotnet_blazorwasm_RedirectToLogin_razor", resourceCulture);
+                return ResourceManager.GetString("add_RedirectToLogin_razor", resourceCulture);
+            }
+        }
+        
+        /// <summary>
+        ///   Looks up a localized string similar to @page &quot;/showprofile&quot;
+        ///
+        ///@using Microsoft.Identity.Web
+        ///@using Microsoft.Graph
+        ///@inject Microsoft.Graph.GraphServiceClient GraphServiceClient
+        ///@inject MicrosoftIdentityConsentAndConditionalAccessHandler ConsentHandler
+        ///
+        ///&lt;h1&gt;Me&lt;/h1&gt;
+        ///
+        ///&lt;p&gt;This component demonstrates fetching data from a service.&lt;/p&gt;
+        ///
+        ///@if (user == null)
+        ///{
+        ///    &lt;p&gt;&lt;em&gt;Loading...&lt;/em&gt;&lt;/p&gt;
+        ///}
+        ///else
+        ///{
+        ///    &lt;table class=&quot;table table-striped table-condensed&quot; style=&quot;font-family: monospace&quot;&gt;
+        ///        &lt;tr&gt;
+        ///            &lt;th&gt;Property&lt;/th&gt;
+        ///          [rest of string was truncated]&quot;;.
+        /// </summary>
+        internal static string add_ShowProfile_razor {
+            get {
+                return ResourceManager.GetString("add_ShowProfile_razor", resourceCulture);
             }
         }
         
@@ -247,31 +269,9 @@ internal static string add_dotnet_blazorwasm_RedirectToLogin_razor {
         ///            &lt;td&gt; DisplayName &lt;/td&gt;
         ///            &lt;td&gt; @user.DisplayNa [rest of string was truncated]&quot;;.
         /// </summary>
-        internal static string add_dotnet_blazorwasm_UserProfile_razor {
-            get {
-                return ResourceManager.GetString("add_dotnet_blazorwasm_UserProfile_razor", resourceCulture);
-            }
-        }
-        
-        /// <summary>
-        ///   Looks up a localized string similar to @using System.Security.Principal
-        ///
-        ///&lt;ul class=&quot;navbar-nav&quot;&gt;
-        ///@if (User.Identity?.IsAuthenticated == true)
-        ///{
-        ///        &lt;span class=&quot;navbar-text text-dark&quot;&gt;Hello @User.Identity?.Name!&lt;/span&gt;
-        ///        &lt;li class=&quot;nav-item&quot;&gt;
-        ///            &lt;a class=&quot;nav-link text-dark&quot; asp-area=&quot;MicrosoftIdentity&quot; asp-controller=&quot;Account&quot; asp-action=&quot;SignOut&quot;&gt;Sign out&lt;/a&gt;
-        ///        &lt;/li&gt;
-        ///}
-        ///else
-        ///{
-        ///        &lt;li class=&quot;nav-item&quot;&gt;
-        ///            &lt;a class=&quot;nav-link text-dark&quot; asp-area=&quot;MicrosoftIdentity&quot; asp-controller=&quot;Account&quot; asp-ac [rest of string was truncated]&quot;;.
-        /// </summary>
-        internal static string add_dotnet_webapp_mvc_LoginPartial_cshtml {
+        internal static string add_UserProfile_razor {
             get {
-                return ResourceManager.GetString("add_dotnet_webapp-mvc_LoginPartial_cshtml", resourceCulture);
+                return ResourceManager.GetString("add_UserProfile_razor", resourceCulture);
             }
         }
         
diff --git a/src/MSIdentityScaffolding/Microsoft.DotNet.MSIdentity/Properties/Resources.resx b/src/MSIdentityScaffolding/Microsoft.DotNet.MSIdentity/Properties/Resources.resx
index fce3fc0e4..f5a953598 100644
--- a/src/MSIdentityScaffolding/Microsoft.DotNet.MSIdentity/Properties/Resources.resx
+++ b/src/MSIdentityScaffolding/Microsoft.DotNet.MSIdentity/Properties/Resources.resx
@@ -128,32 +128,32 @@
     <value>Adding package {0} . . .</value>
   </data>
   <assembly alias="System.Windows.Forms" name="System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />
-  <data name="add_dotnet_blazorserver_CallWebApi_razor" type="System.Resources.ResXFileRef, System.Windows.Forms">
-    <value>..\CodeReaderWriter\CodeFiles\Blazor\Server\CallWebApi.razor.txt;System.String, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089;Windows-1252</value>
+  <data name="add_Authentication_razor" type="System.Resources.ResXFileRef, System.Windows.Forms">
+    <value>..\CodeReaderWriter\CodeFiles\Blazor\wasm\Authentication.razor.txt;System.String, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089;utf-8</value>
   </data>
-  <data name="add_dotnet_blazorserver_LoginDisplay_razor" type="System.Resources.ResXFileRef, System.Windows.Forms">
+  <data name="add_blazorserver_LoginDisplay_razor" type="System.Resources.ResXFileRef, System.Windows.Forms">
     <value>..\CodeReaderWriter\CodeFiles\Blazor\Server\LoginDisplay.razor.txt;System.String, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089;Windows-1252</value>
   </data>
-  <data name="add_dotnet_blazorserver_ShowProfile_razor" type="System.Resources.ResXFileRef, System.Windows.Forms">
-    <value>..\CodeReaderWriter\CodeFiles\Blazor\Server\ShowProfile.razor.txt;System.String, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089;Windows-1252</value>
+  <data name="add_blazorwasm_LoginDisplay_razor" type="System.Resources.ResXFileRef, System.Windows.Forms">
+    <value>..\CodeReaderWriter\CodeFiles\Blazor\wasm\LoginDisplay.razor.txt;System.String, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089;Windows-1252</value>
   </data>
-  <data name="add_dotnet_blazorwasm_Authentication_razor" type="System.Resources.ResXFileRef, System.Windows.Forms">
-    <value>..\CodeReaderWriter\CodeFiles\Blazor\wasm\Authentication.razor.txt;System.String, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089;utf-8</value>
+  <data name="add_CallWebApi_razor" type="System.Resources.ResXFileRef, System.Windows.Forms">
+    <value>..\CodeReaderWriter\CodeFiles\Blazor\Server\CallWebApi.razor.txt;System.String, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089;Windows-1252</value>
   </data>
-  <data name="add_dotnet_blazorwasm_GraphClientExtensions_cs" type="System.Resources.ResXFileRef, System.Windows.Forms">
+  <data name="add_GraphClientExtensions_cs" type="System.Resources.ResXFileRef, System.Windows.Forms">
     <value>..\CodeReaderWriter\CodeFiles\Blazor\wasm\GraphClientExtensions.cs.txt;System.String, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089;Windows-1252</value>
   </data>
-  <data name="add_dotnet_blazorwasm_LoginDisplay_razor" type="System.Resources.ResXFileRef, System.Windows.Forms">
-    <value>..\CodeReaderWriter\CodeFiles\Blazor\wasm\LoginDisplay.razor.txt;System.String, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089;Windows-1252</value>
+  <data name="add_LoginPartial_cshtml" type="System.Resources.ResXFileRef, System.Windows.Forms">
+    <value>..\CodeReaderWriter\CodeFiles\WebApp\_LoginPartial.cshtml.txt;System.String, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089;iso-8859-1</value>
   </data>
-  <data name="add_dotnet_blazorwasm_RedirectToLogin_razor" type="System.Resources.ResXFileRef, System.Windows.Forms">
+  <data name="add_RedirectToLogin_razor" type="System.Resources.ResXFileRef, System.Windows.Forms">
     <value>..\CodeReaderWriter\CodeFiles\Blazor\wasm\RedirectToLogin.razor.txt;System.String, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089;utf-8</value>
   </data>
-  <data name="add_dotnet_blazorwasm_UserProfile_razor" type="System.Resources.ResXFileRef, System.Windows.Forms">
-    <value>..\CodeReaderWriter\CodeFiles\Blazor\wasm\UserProfile.razor.txt;System.String, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089;Windows-1252</value>
+  <data name="add_ShowProfile_razor" type="System.Resources.ResXFileRef, System.Windows.Forms">
+    <value>..\CodeReaderWriter\CodeFiles\Blazor\Server\ShowProfile.razor.txt;System.String, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089;Windows-1252</value>
   </data>
-  <data name="add_dotnet_webapp-mvc_LoginPartial_cshtml" type="System.Resources.ResXFileRef, System.Windows.Forms">
-    <value>..\CodeReaderWriter\CodeFiles\WebApp\_LoginPartial.cshtml.txt;System.String, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089;Windows-1252</value>
+  <data name="add_UserProfile_razor" type="System.Resources.ResXFileRef, System.Windows.Forms">
+    <value>..\CodeReaderWriter\CodeFiles\Blazor\wasm\UserProfile.razor.txt;System.String, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089;Windows-1252</value>
   </data>
   <data name="AppNotFound" xml:space="preserve">
     <value>Couldn't find app {0} in tenant {1}</value>
@@ -348,4 +348,4 @@
   <data name="UpdatingProjectPackages" xml:space="preserve">
     <value>Updating project packages ...</value>
   </data>
-</root>
+</root>
\ No newline at end of file