-
Notifications
You must be signed in to change notification settings - Fork 2.6k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
@azure/msal-angular works with Angular 17 #6719
Comments
We are waiting for an answer on the following issue 🥶 |
When the update will be available? Angular 17 was released on 6 of November, it's not acceptable that a component like MSAL is not updated at release time and therefore 1 month after! |
I don't have a timeline yet for Angular 17 support, but we are tracking and aware of it. Thank you for expressing your interest. |
To those updating @azure/msal-angular: Can you explain the typical timeline for updates to this package? Is it that the team must wait for Angular to release a version for the team to start upgrading @azure/msal-angular to catch up to Angular? It is fine if that is the case, but we need to know for planning purposes. It seems to me that this package is upgraded "months" after Angular releases a new version and knowing that on average this product will lag "x number of months" will help those of us depending on this component to plan and provide correct ETAs to our stakeholders. |
alot of project will need to updage to Angular 17, as it is a major update to framework. (improves so much things that developers are waiting for years). |
Any updates on this? I see today we have a 3.0.10 but it dosent seem documentation is updated it says still v15 and v16. What makes angular 17 so hard to update? |
I appreciate people adding more details on why this is important to their project. I have no new updates. We are aware and have this work in our backlog. To add more context, each major framework version requires evaluating the changes and balancing whether those are backwards compatible for MSAL versions or require our own major version bump. That is why we as the MSAL maintainers can't always predict how much time it takes to add the latest framework support. |
In case it's helpful to anyone, I spent a bit of time working to get I'm certain that once these kinks are ironed out in migrating to Angular 17, this will be a very clean integration. A big thanks to the MSAL.js team for all of the work that's gone into supporting so many different platforms, and particularly keeping Angular in the mix. |
I need @azure/msal-... for v17, because according to the appropriate roadmap, I hope @azure/msal-... will make a plan to update v17 for all devs around the world. |
Any roadmap / ETA will greatly help our internal release cadance 🔢 |
Is it a joke that Microsoft has not yet supported Angular 17 after three months? |
It's working for me with Angular 17. I don't understand what the problem is.
this is my package,json
tsconfig.json
|
@umberto-titola Actually it seems to work for 17.0, but not 17.1. I sitll don't understandand, but I'm not an expert, why... |
I made it work on 17.1. Basically is Subscribing to In your app.component.ts, import { Component, OnInit } from '@angular/core';
import { MsalBroadcastService, MsalService } from '@azure/msal-angular';
import { AuthenticationResult } from '@azure/msal-browser';
@Component({
selector: 'app-home',
templateUrl: './home.component.html',
styleUrls: ['./home.component.css']
})
export class HomeComponent implements OnInit {
account: WritableSignal<AccountInfo | null> = #signal(null);
constructor(private authService: MsalService) { }
ngOnInit(): void {
this.authService.handleRedirectObservable().subscribe({
next: (result: AuthenticationResult) => {
// Perform actions related to user accounts here
console.log('Redirect success', result);
this.account.set(this.authService.instance.getActiveAccount());
this.cdr.detectChanges();
},
error: (error) => console.log(error)
});
}
} Basically I copied lots of code from @JaimeStill 's repo but substitute the part that using
My project is still in the very beginning phase so I'm not sure what other difficulties will appear. |
I'm doing it inside app initializer to do it before I get to bootstrap the app.component |
I have had an issue when the MsalInterceptor has been swallowing and "hanging" (they weren't even fired) requests made via HttpClient during app initialization (aka.: procedures registered via APP_INITIALIZER). Had to subscribe to authService.handleRedirectObservable() too, upon which the Interceptor let the requests through. |
msal-angular is now one major release and two minor versions behind the product it should be supporting. Angular 17 was released 95 days ago on 2023-11-08. Angular 17.2 is being released this week. I cannot upgrade our applications despite every dependency screaming at me to resolve issues because msal-angular is blocking us. The maintainers behind msal-angular are obviously not resourced appropriately to support this product. Every time I discuss authentication issues with other CTOs, I now have to qualify my statements regarding Microsoft Entra / B2C. |
You can still use Azure AD/Entra authentication without using MSAL libraries. I recently removed my dependency on msal-angular and replaced it with a generic angular oauth library (angular-oauth2-oidc). It was relatively straightforward to do and works perfectly fine with Azure. |
Thanks everyone for your feedback and patience. Our engineer has been diligently working on adding the Angular 17 support, but we've run into a number of issues. Angular 17's new build system includes integrated server-side rendering and prerendering capabilities. As a library meant for single page applications running in a browser, MSAL Angular uses browser-only objects and is not designed to acquire tokens server-side, and has only minimally supported Angular Universal in the past. We have been working on ways around this issue. The standalone sample in particular is proving difficult. Because I know this has been an ongoing issue for the community for a while, we have a few options we are evaluating. We can release support earlier for the regular Angular sample but no standalone sample support. Or we can release later as our engineer continues to investigate the standalone and sever-side rendering issue. Even with more time, we may find that MSAL Angular is incompatible with the SSR capabilities of Angular for a standalone model. I'm inclined for the earlier release option but I am open to feedback from the community that the standalone model & SSR support is worth waiting for. |
Definitely on the side of releasing as soon as possible and worrying about all scenarios at a later date. I think delaying much longer will force most to migrate to another library and further give distrust to the reliability of support. |
I also selfishly agree with @Core121 - our hand is being forced and there is some serious questions being raised on our 3 projects by clients. I don't fully understand the challenge but I would think it represents a fairly small percentage of the user base? @EmLauber what's your estimated time frame on both scenarios - just roughly as that may put it into a bit clearer context. |
Hi @EmLauber ,first thank you for the feedback. For now, I think the best option is to release what works good with the limitations, but keep working on the resolving the limitations. Just to be clear the only limitation is SSR ? again thx for the help. |
Hello, |
Totally Agree with this approach; At least until you can invest more time in solving both functionalities. There are many Projects which needs Angular 17 support as soon as possible (most of them probably using regular SPA functionality). It is not so straightforward swapping for an alternative such as angular-oauth2-oidc library since MSAL deals with many configurations itself which requires dirty patches / code in any other library... Appreciate much you time in maintaining and evolving such great Project! |
The final answer on this will be critical for greenfield projects intent on leveraging the benefits of SSR with standalone components. |
I'm a bit biased so the actual reality may be less dark than my fear (and I'm presuming to a certain extent, due to sad experience). Please take my statement as a prediction (that I gladly be proven wrong on). I suspect that MSAL 3.x will not work for any Angular version from 17 and up due to changes in the Angular core set up. There's a reason why the original MSAL 1.x had to be re-released as 2.x/3.x and if you study the compatibility table, those version seem to correlate with major changes of default Angular project structure. I believe we're at such a stage right now: Angular 17 provides new syntax and, most importantly, new strategy of dependency injection (the service itself, not the module, governs DI now). That breaking change has not been addressed and MSAL didn't have any developers actively working on it. That's the reason why we have the current challenge. It's said that someone (single, one) has been assigned and it seems to me overly optimistic to rely on the promised ETA of 2024Q1. The realistic scenario I'm expecting for is that MSAL will be upgraded to version 4.0 at some point prior to Angular 18 being released at the end of May. I suspect that's the plan of the development "team" and Ng17 will be one of those sad stories teaching us the importance of proactivity. By that, they gain 6 more weeks of development time and we can consider the even versions to be the LTS version. |
Please correct me if I'm mistaken but I believe that Auth0 is now Okta, as they acquired it a while back. Perhaps it's still run as a autonomous software but with time, there's a risk of the merge to be complete and you may land into a tricky situation with your Okta aversed clients. |
It's positive that we've recognized the challenge points. With full respect to the efforts of others, I'd like to share my take on it. One of the major improvements (if not the most important one) in Angular 17+ is the standalone option. If support for it isn't included, there's really no point releasing an update. Those who desperately wait for MSAL 4.0 are stuck on the new syntax and can't go back on it (otherwise, they'd do like us, switch to Angular 16 for now). An update without support for it won't do any good in practical terms and I think we all agree that nobody gains of creating a false impression that something's being improved. As for the SSR, I dare not to pass any opinion because we're not affected by it. Angular being an SPA rhymes poorly with SSR. However, I lack experience with SSR of Angular and can't say how many that desire it. Probably less than those who went with standalone (as it's a great new feature and the main reason to go for 17 and up). Can we establish that Angular 18 (out by 20th of May) will be supported by MSAL 4.0? |
From what I can tell from tutorials available online and Angular samples in the community, Stand Alone Angular components are becoming more common but SSR seems like it still has very low adoption and may not even be useful to many Angular applications. Releasing early with Stand Alone Angular components will unblock the majority of use cases and give the MSAL team time to better understand if SSR is even possible with Angular 17+. |
I'd like to add another vote for releasing without support for SSR. Not only is SSR not a popular feature, it's not a functional one. Any application that functions with SSR can function without it. The same can not be said of authentication. |
We all need time to get used to the Stand Alone components but we cannot even get started without Authentication. SSR support is not a high priority for us. Using the latest Angular tech for UI is. |
Concur with those saying SSR is not a priority. Supporting standalone components and the new esbuild-based build system would be an ideal goal for truly supporting Angular 17+. I also want to apologize in the event I invalidated anyone’s frustrations with this release cycle. Microsoft should for sure have resources allocated to ensuring timely support, particularly around such a critical component. |
Thanks everyone for the feedback! My takeaways are 1) general Angular 17 support for auth is critical and worth releasing for basic scenarios earlier even if some scenarios are not supported 2) standalone support is more important than SSR. With this feedback on priority, we will release a minor version with the Angular 17 support after the remaining errors in standalone sample without SSR are resolved. I don't believe it will make it into our release planned for this week, but we will do an out-of-band release as soon as the issues are resolved and the PR is merged. |
As for some of the other comments:
|
We were able to add the Angular 17 support for today's release! The MSAL Angular ReadMe is updated and includes a sample of MSAL Angular working with an Angular 17 standalone sample https://github.com/AzureAD/microsoft-authentication-library-for-js/tree/dev/samples/msal-angular-v3-samples/angular17-standalone-sample. There are still gaps such as the server-side rendering. My hope though is this is enough to unblock a majority of your scenarios while we continue to work on the edge cases. Please do continue to provide feedback or any bug reports in this latest release. |
I can not run the example. I get errors like this.:
|
|
@BuZZ-dEE did u find a solution? |
@SamuelPXL and @BuZZ-dEE - that error looks to be caused by not doing an "npm install" first. I was able to get the example to run but I had to remove the dependency "e2e-test-utils": "^0.0.1", Once I removed that i could run it and login. I have yet to successfully hook it up to .NET despite all day on it today... I am an experienced dev and I find this stuff really hard. Am reading through documentation on redirects and upgrading from MSAL 2 to 3 at the moment to see if I can figure out what is awry, When i hit .NET endpoint I get an unauthorised error - when I remove the [Authorize] annotation from .NET controller i can see the User Claims Principal is "IsAuthenticated = false". I also do not see the bearer token in the browser.... Am a bit lost and stuck now... |
Debugging this MSAL library on Angular is extremely complicated. This is seriously making me consider other IdP options as there's just too many issues one runs into when dealing with MSAL |
@SamuelPXL yes, with the following version it works:
|
I'd recommend you to consider handling the authentication related processes without using the MSAL. You'd be surprised by how easy it actually is. I don't think the benefits MSAL may provide is worth the pain. |
@abdebek > I'd recommend you to consider handling the authentication related processes without using the MSAL. You'd be surprised by how easy it actually is. I don't think the benefits MSAL may provide is worth the pain. Can you recommend any reference projects that demonstrate solid, well-supported, and less painful alternatives? I was attracted to MSAL by the promise of low-cost, stable integration with Azure ADB2C. Giving up on MSAL implies overhauling the identity model for my project's backend. |
After further investigation, we will not be able to support server-side rendering in Angular 17. We will leave the support as released and investigate SSR support when evaluating Angular 18. I am closing this issue as Angular 17 support is available. Please open new Issues for other problems. |
I don't know exactly what has changed but I don't have the issues I had anymore. |
Core Library
MSAL.js (@azure/msal-browser)
Wrapper Library
MSAL Angular (@azure/msal-angular)
Public or Confidential Client?
Public
Description
Please update it to angular 17, I noticed that the current version dosent work with esmodule builder.
Source
External (Customer)
The text was updated successfully, but these errors were encountered: