How can I authenticate MQTT with OAuth?

Unfortunately that guide only covers the back-end setup, and doesn't provide any concrete examples of connection code. I have, however, completed the setup as per the guide.

Thanks for the updated article, but I'm still not having any joy... I am trying to run the perfsdk_c utility the blog article refers to, but a) it's not clear which of id_token or access_token are required, and b) neither of them work anyway. I still see nothing in the stats, except that there are tokens received that apparently drop in a black hole; they do not report any error, nor do they report success. How can I see some kind of indication what the broker is doing with those tokens? Does no one have a working .NET code sample? Preferably MQTT/OAuth2, but even SMF OAuth2 would be fine.

After working with the Solace support team, I was able to come up with the following working code:

{
  private ClaimsPrincipal User;
  private IMqttClient _mqttClient;

  [CascadingParameter] private Task<AuthenticationState> AuthenticationState { get; set; }

  protected override async Task OnInitializedAsync()
  {
    const string cacheKey = "Microsoft.AspNetCore.Components.WebAssembly.Authentication.CachedAuthSettings";
    var authSettingsRAW = await JSRuntime.InvokeAsync<string>("sessionStorage.getItem", new[] { cacheKey });
    if (authSettingsRAW == null) return;
    var authSettings = JsonConvert.DeserializeObject<CachedAuthSettings>(authSettingsRAW);
    if (authSettings == null) return;
    var userRAW = await JSRuntime.InvokeAsync<string>("sessionStorage.getItem", new[] { authSettings.OIDCUserKey });
    if (userRAW == null) return;
    var user = JsonConvert.DeserializeObject<UserData>(userRAW);
    if (user == null) return;
    var request = await TokenProvider.RequestAccessToken();
    var response = request.TryGetToken(out var accessToken);
    if (!response) return;
    var factory = new MqttFactory();
    _mqttClient = factory.CreateMqttClient();
    var settings = new MqttClientOptionsBuilder()
      .WithClientId(Guid.NewGuid().ToString())
      .WithConnectionUri("wss://mr-connection-xxxxxxxxxxx.messaging.solace.cloud:8443")
      .WithCredentials("ignoreme_unless_validating", $"OAUTH~MyOAuthProfile~{user.access_token}")
      .Build();
    Console.WriteLine(user.id_token);
    Console.WriteLine(user.access_token);
    await _mqttClient.ConnectAsync(settings);
    var message = factory.CreateApplicationMessageBuilder()
      .WithTopic("my-mqtt-topic")
      .WithPayload(Encoding.UTF8.GetBytes(@"{""Id"": 1234, ""Text"": ""Hello from Blazor WASM!""}"))
      .Build();
    await _mqttClient.PublishAsync(message);
  }

  class UserData
  {
    public string id_token;
    public string access_token;
    public string expires_at;
  }

  class CachedAuthSettings
  {
    public string? authority { get; set; }
    public string? metadataUrl { get; set; }
    public string? client_id { get; set; }
    public string[]? defaultScopes { get; set; }
    public string? redirect_uri { get; set; }
    public string? post_logout_redirect_uri { get; set; }
    public string? response_type { get; set; }
    public string? response_mode { get; set; }
    public string? scope { get; set; }

    public string OIDCUserKey => $"oidc.user:{authority}:{client_id}";
  }
}

Hope this helps somebody! This is working from Blazor WASM. Thanks to the Solace team for working through this with me. Note that the code above is written with the broker in Resource Server role. If it were in Client mode, you would send id_token instead.