Implementing Client Credentials Grant Type Using Owin In ASP.NET Web API

Introduction

• OAuth2.0 And OpenID Connect (OIDC) Core Concepts - What? Why? How?
• Understanding Workflow Of OAuth2.0 Authorization Grant Types

Configuring OAuth Provider Using Owin

• Owin.Security.OAuth
• Owin.Host.SystemWeb

using System;  
using System.Configuration;  
using System.Security.Claims;  
using System.Threading.Tasks;  
using Microsoft.Owin.Security.OAuth;  
namespace OAuth2App.Provider {  
    public class OAuthProvider: OAuthAuthorizationServerProvider {  
        public override async Task ValidateClientAuthentication(OAuthValidateClientAuthenticationContext context) {  
            string clientId;  
            string clientSecret;  
            Guid client IdGuid;  
            if (!context.TryGetBasicCredentials(outclientId, outclientSecret)) {  
                context.TryGetFormCredentials(outclientId, outclientSecret);  
            }  
            if (null == context.ClientId || null == clientSecret || !Guid.TryParse(clientId, outclientIdGuid)) {  
                context.SetError("invalid_credentials", "A valid client_Id and client_Secret must be provided.");  
                context.Rejected();  
                return;  
            }  
            //validate aginstdb or config: GetClient(clientIdGuid, clientSecret);  
            bool is Valid Client = Configuration Manager.AppSettings["ClientId"] == clientId && Configuration Manager.AppSettings["ClientSecret"] == clientSecret;  
            if (!isValidClient) {  
                context.SetError("invalid_credentials", "A valid client_Id and client_Secret must be provided.");  
                context.Rejected();  
                return;  
            }  
            awaitTask.Run(() => context.Validated(clientId));  
        }  
        public override async Task GrantClientCredentials(OAuthGrantClientCredentialsContext context) {  
            GuidclientId;  
            Guid.TryParse(context.ClientId, outclientId);  
            //validate aginstdb or config: GetByClientId(clientId);  
            bool client = ConfigurationManager.AppSettings["ClientId"] == clientId.ToString().ToUpper();  
            if (!client) {  
                context.SetError("invalid_grant", "Invaild client.");  
                context.Rejected();  
                return;  
            }  
            var claims Identity = newClaimsIdentity(context.Options.AuthenticationType);  
            claims Identity.AddClaim(new Claim("LoggedOn", DateTime.Now.ToString()));  
            await Task.Run(() => context.Validated(claimsIdentity));  
        }  
        public override Task TokenEndpoint(OAuthTokenEndpointContext context) {  
            if (context.TokenIssued) {  
                context.Properties.ExpiresUtc = DateTimeOffset.UtcNow.AddSeconds(3600);  
            }  
            return Task.FromResult < object > (null);  
        }  
    }  
}  

Here, we have overridden three methodsc alled "ValidateClientAuthentication", "GrantClientCredentials" and “TokenEndpoint”.

• The "ValidateClientAuthentication" method is responsible for validating client id and client secret against web.config or DB.Inside it, "TryGetBasicCredentials" used to retrieve the values of the client credential from basic authorization header. In addition, "TryGetFormCredentials" used to retrieve client id and secret as form-encoded POST parameters.
• The "GrantClientCredentials" method is responsible to validate the client id before adding claims details into the access token. Based on the need, we can add different sets of claims.
• The "TokenEndpoint" method is responsible to override token lifetime. If you have multiple clients, app and token lifetime varies based on the client, then this override method will be useful to set it.