Token Based Authentication Using ASP.Net Web API, OWIN and Identity With Entity Framework

private void ConfigureOAuth(IAppBuilder app)  
{  
    ...
    ... 
    app.UseOAuthAuthorizationServer(new OAuthAuthorizationServerOptions  
    {  
        TokenEndpointPath = new PathString("/oauth/token"),  
        Provider = new AuthorizationServerProvider(),  
        AccessTokenExpireTimeSpan = TimeSpan.FromMinutes(30),  
        AllowInsecureHttp = true,  
                   
    });  
    app.UseOAuthBearerAuthentication(new OAuthBearerAuthenticationOptions());  
}

An Authorization Server uses a default implementation of IOAuthAuthorizationServerProvider to communicate with a web application while processing the request. OAuthAuthorizationServerProvider provides some default behavior like as used as a virtual base class and offers delegate properties that may be used to handle individual calls without creating the instance.

Here I just override the methods that I need here: ValidateClientAuthentication and GrantResourceOwnerCredentials.

ValidateClientAuthentication

It is called to validate that the requester (origin of the request) is a registered client_id and the correct credentials for that client are present on the request.

"OAuthValidateClientAuthenticationContext.TryGetBasicCredentials" may be able to retrieve the values of the client credential request header if the web application accepts basic authentication credentials. If the web application accepts a client id and secret as form-encoded POST parameters, "OAuthValidateClientAuthenticationContext.TryGetFormCredentials" can be used to retrieve this value. Finally, if "OAuthValidateClientAuthenticationContext.Validated” is not called then the request will not proceed further.

GrantResourceOwnerCredentials

It is called when the request to the token endpoint arrives with a "grant_type" of "password". This occurs when the user provides a user id and password directly to the client application using the client application user interface. If the web application supports the resource owner credentials grant type, it must validate the username and password property of context. To issue the access token, the request must end with the “OAuthGrantResourceOwnerCredentialsContext.Validated" method. The default behavior is to reject this grant type.

public class AuthorizationServerProvider : OAuthAuthorizationServerProvider  
{  
    public override async Task ValidateClientAuthentication(OAuthValidateClientAuthenticationContext context)  
    {  
    }  
    public override async Task GrantResourceOwnerCredentials(OAuthGrantResourceOwnerCredentialsContext context)  
    {  
    }  
}

The following is a probable implementation of the ValidateClientAuthentication method.

public override async Task ValidateClientAuthentication(OAuthValidateClientAuthenticationContext context)  
{  
    string clientId;  
    string clientSecret;  
  
    if (context.TryGetBasicCredentials(out clientId, out clientSecret))  
    {   
        // validate the client Id and secret against database or from configuration file.  
        context.Validated();  
    }  
    else  
    {  
        context.SetError("invalid_client", "Client credentials could not be retrieved from the Authorization header");  
        context.Rejected();  
    }  
}

The following is an implementation of the GrantResourceOwnerCredentials method.

public override async Task GrantResourceOwnerCredentials(OAuthGrantResourceOwnerCredentialsContext context)  
{  
    UserManager<IdentityUser> userManager = context.OwinContext.GetUserManager<UserManager<IdentityUser>>();  
    IdentityUser user;  
    try  
    {  
        user = await userManager.FindAsync(context.UserName, context.Password);  
    }  
    catch  
    {  
        // Could not retrieve the user due to error.  
        context.SetError("server_error");  
        context.Rejected();  
        return;  
    }  
    if (user != null)  
    {  
        ClaimsIdentity identity = await userManager.CreateIdentityAsync(  
                                                user,  
                                                DefaultAuthenticationTypes.ExternalBearer);  
        context.Validated(identity);  
    }  
    else  
    {  
        context.SetError("invalid_grant", "Invalid User Id or password'");  
        context.Rejected();
    }
}

An HTTP POST request is made to the URL "/oauth/token" endpoint with grant_type parameter "password"; it will first arrive at the ValidateClientAuthentication method. In this place we can retrieve the client credentials and validate it. If the client credential is invalid, we need to return an unauthorized request using the context.Rejected method. If we grant the request in the ValidateClientAuthentication method, the request will arrive at the GrantResourceOwnerCredentials method. Inside this method, we need to validate that the user is using resource-owner credentials.

Step 6 - Test the Project

To test the preceding approach I created a console project in my solution. Create the following Token class within the console application.

using Newtonsoft.Json;  
  
namespace OWINTest  
{  
    public class Token  
    {  
        [JsonProperty("access_token")]  
        public string AccessToken { get; set; }  
        [JsonProperty("token_type")]  
        public string TokenType { get; set; }  
        [JsonProperty("expires_in")]  
        public int ExpiresIn { get; set; }  
        [JsonProperty("refresh_token")]  
        public string RefreshToken { get; set; }  
        [JsonProperty("error")]  
       public string Error { get; set; }  
    }  
}

Program.cs code

using System;  
using System.Collections.Generic;  
using System.Net.Http;  
using System.Net.Http.Formatting;  
  
namespace OWINTest  
{  
    class Program  
    {  
        static void Main(string[] args)  
        {  
            string baseAddress = "http://localhost:4312";  
            using (var client = new HttpClient())  
            {  
                var form = new Dictionary<string, string>    
               {    
                   {"grant_type", "password"},    
                   {"username", "jignesh"},    
                   {"password", "user123456"},    
               };  
                var tokenResponse = client.PostAsync(baseAddress + "/oauth/token", new FormUrlEncodedContent(form)).Result;  
                //var token = tokenResponse.Content.ReadAsStringAsync().Result;  
                var token = tokenResponse.Content.ReadAsAsync<Token>(new[] { new JsonMediaTypeFormatter() }).Result;  
                if (string.IsNullOrEmpty(token.Error))  
                {  
                    Console.WriteLine("Token issued is: {0}", token.AccessToken);  
                }  
                else  
                {  
                    Console.WriteLine("Error : {0}", token.Error);  
                }  
                Console.Read();  
            }  
        }  
    }  
} 

Using the following script, insert some dummy data into the AspNetUser table. Here I have encrypted my password using Abstraction for the password hashing methods of the Microsoft.AspNet.Identity namespace available with the UserManger class.

INSERT [dbo].[AspNetUsers] ([Id], [Email], [EmailConfirmed], [PasswordHash], [SecurityStamp],   
[PhoneNumber], [PhoneNumberConfirmed], [TwoFactorEnabled], [LockoutEndDateUtc], [LockoutEnabled],   
[AccessFailedCount], [UserName])   
VALUES (N'9f15bdd0fcd5423190c2e877ba0228ee', N'[email protected]', 1,   
N'ALkHGax/i5KBYWJ7q4jhJmMKmm2quBtnnqS8KcmLWd2kQpN6FaGVulDmmX12s7YAyQ==',   
N'a7bc5c5c-6169-4911-b935-6fc4df01d313', NULL, 0, 0, NULL, 0, 0, N'Jignesh')  

Output

We receive the response in the form of JSON and we convert it into our Token class using the Content.ReadAsAsync method. The Result Token class contains either the access token or an error. If we pass the wrong credentials, the system will generate the error:

In the next request we use this token for the authentication and the token will be sent in the request header. The Token is valid up to its expiry time.

To test it, I added a controller to my Web API project and created a test method as in the following.

using System.Web.Http;  
  
namespace OwinAuthentication.Controllers  
{  
    [Authorize]  
    public class POCController : ApiController  
    {  
        [HttpGet]  
        [Route("api/TestMethod")]  
        public string TestMethod()  
        {  
            return "Hello, C# Corner Member. ";  
        }  
    }  
}

Here we must mark our controller or action method with the Authorize attribute to check whether the request has a valid token.

The following is needed to append in a client application (console application in our case). First of all we need to get the token using the code described in the preceding section and then use this token to process the request.

using (HttpClient httpClient1 = new HttpClient())  
{  
    httpClient1.BaseAddress = new Uri(baseAddress);  
    httpClient1.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("bearer", token.AccessToken);  
    HttpResponseMessage response = httpClient1.GetAsync("api/TestMethod").Result;  
    if (response.IsSuccessStatusCode)  
    {  
        System.Console.WriteLine("Success");  
    }  
    string message = response.Content.ReadAsStringAsync().Result;  
    System.Console.WriteLine("URL responese : " + message);  
}

Output

Summary

Using this article we can set up our authorization server and we have a working OAuth 2.0 token endpoint that only supports "Resource Owner Password Credentials Grant" as of now.