MobileServiceUser returns wrong UserId

Question

I have an existing user in my Xamarin Forms app whose Details are as follows:

First Name: Jim Last Name: Smith ProviderLoginId = jsmith@google.com OAuth Provider: Google When I first create this user, I use the following method to authenticate against google as follows:

result = await AuthenticationClient.AcquireTokenInteractive("https://***.onmicrosoft.com/profile.read/profile.read")
                                .ExecuteAsync();

            JObject objToken = new JObject();
            objToken.Add("access_token", result.IdToken);
            MobileServiceUser user = await App.syncMgr.CurrentClient.LoginAsync(MobileServiceAuthenticationProvider.WindowsAzureActiveDirectory, objToken);

Now, I take the UserId property from the MobileServiceUser user variable and store it into my User Table as primary key.

Subsequently, I create another new user with the following details:

First Name: Jim Last Name: Smith ProviderLoginId = jsmith@hotmail.com OAuthProvider: Microsoft

When I create the user using the same steps as above, I get the same UserId back from Azure. Obviously, I am not able to store it in my User table for the second user. This only happens when the first name and the last name are the same regardless of which ProviderLoginId was used (whether it was Google OAuth or Microsoft OAuth).

Should I not be getting a unique UserId in each case? Since the bug surfaces only when the first and last names are same, I am assuming it is some sort of a bug.

Any and all help is appreciated.

Answer 1

You are using the older client, which is no longer supported.

You should be submitting the access token to the service, not the IdToken. You haven't stated what the AuthenticationClient is, but hopefully it is ADAL (since the older service doesn't work with MSAL).

The newer client and service completely abstracts the authentication code, allowing you to use whatever authentication mechanism you like and just dealing with standard OAuth2/OIDC and bearer tokens (Authorization header) instead of the non-standard X-ZUMO-AUTH header that was used in the past. My recommendation is to upgrade the client and server.