Token Based Authentication using Web API 2, Owin, and Identity

Now, you can see the created "DataContext.edmx" in the "Models" folder. In this created model, you can see the Model class and diagram as shown in the below image.

Step 2.4. Add "Startup" Class and add support for OAuth Bearer Tokens Generation.

Right-click on your project then add a new class named "Startup". To do so, go to the Solution Explorer > Right Click on Project Name from the Solution Explorer > Add > New Item > Select class > Enter the class name as Startup. cs > and then click on the Add button and it will contain the code below:

using Microsoft.Owin;
using Microsoft.Owin.Cors;
using Microsoft.Owin.Security.OAuth;
using OauthApi.Provider;
using Owin;
using System;
using System.Web.Http;

namespace OauthApi
{
    public class Startup
    {
        public void Configuration(IAppBuilder app)
        {
            ConfigureAuth(app);
            GlobalConfiguration.Configure(WebApiConfig.Register);
        }

        public void ConfigureAuth(IAppBuilder app)
        {
            // This is very important line Cross Origin Source (CORS) it is used to enable cross-site HTTP requests
            // For security reasons, browsers restrict cross-origin HTTP requests
            app.UseCors(CorsOptions.AllowAll);
            
            var OAuthOptions = new OAuthAuthorizationServerOptions
            {
                AllowInsecureHttp = true,
                TokenEndpointPath = new PathString("/token"),
                AccessTokenExpireTimeSpan = TimeSpan.FromMinutes(30), // Token expiration time
                Provider = new OauthProvider()
            };

            app.UseOAuthBearerTokens(OAuthOptions);
            app.UseOAuthAuthorizationServer(OAuthOptions);
            app.UseOAuthBearerAuthentication(new OAuthBearerAuthenticationOptions());

            HttpConfiguration config = new HttpConfiguration();
            WebApiConfig.Register(config); // Register the request
        }
    }
}

Here we created a new instance of the "OAuthAuthorizationServerOptions" class and then set the path for generating the tokens as "http://localhost:port/token". We have specified the expiry time for the access token as 30 minutes. We have also specified the implementation on how to validate the client credentials for users asking for the access tokens in the custom class named "OauthProvider". Then we passed the options to the extension method "UseOAuthAuthorizationServer" which will add the authentication middleware to the pipeline.

No need to use Global.asax class and fire up the Application_Start event after we’ve configured our "Startup" class so feel free to delete it.

Step 2.5. Implement the "OauthProvider" class

Add a new folder named "Providers" to the project then add a new class named "OauthProvider", and paste the below code snippet to it.

using Microsoft.Owin.Security.OAuth;
using OauthApi.Models;
using System;
using System.Linq;
using System.Security.Claims;
using System.Threading.Tasks;

namespace OauthApi.Provider
{
    public class OauthProvider : OAuthAuthorizationServerProvider
    {
        public override async Task ValidateClientAuthentication(OAuthValidateClientAuthenticationContext context)
        {
            await Task.Run(() => context.Validated());
        }

        public override async Task GrantResourceOwnerCredentials(OAuthGrantResourceOwnerCredentialsContext context)
        {
            var identity = new ClaimsIdentity(context.Options.AuthenticationType);

            using (var db = new DataContext())
            {
                if (db != null)
                {
                    var user = db.ApiUsers.Where(o => o.UserName == context.UserName && o.UserPasswd == context.Password).FirstOrDefault();
                    if (user != null)
                    {
                        identity.AddClaim(new Claim(ClaimTypes.Role, user.UserRole));
                        identity.AddClaim(new Claim(ClaimTypes.Name, user.UserName));
                        identity.AddClaim(new Claim("LoggedOn", DateTime.Now.ToString()));
                        await Task.Run(() => context.Validated(identity));
                    }
                    else
                    {
                        context.SetError("Wrong Credentials", "Provided username and password is incorrect");
                    }
                }
                else
                {
                    context.SetError("Wrong Credentials", "Provided username and password is incorrect");
                }
                return;
            }
        }
    }
}

In the above code the "OauthProvider" class inherits from class "OAuthAuthorizationServerProvider", we’ve overridden two methods "ValidateClientAuthentication" and "GrantResourceOwnerCredentials". The "ValidateClientAuthentication" method is responsible for validating the "Client" and the "GrantResourceOwnerCredentials" method is responsible for validating the username and password sent to the authorization server’s token endpoint.

Step 3. Modify Web API Controller

Now we will add an action method "GetValues" to "ValueController" so that we can check whether the Token-Based Authentication is working fine or not. To do that open the ValueController and add the below action method to it.

// This method is for all types of role
[Authorize(Roles = "SuperAdmin, Admin, User")]
[HttpGet]
[Route("api/values/getvalues")]
public IHttpActionResult GetValues()
{
    var identity = (ClaimsIdentity)User.Identity;
    var roles = identity.Claims
                    .Where(c => c.Type == ClaimTypes.Role)
                    .Select(c => c.Value);
    var LogTime = identity.Claims
                    .FirstOrDefault(c => c.Type == "LoggedOn").Value;
    return Ok("Hello: " + identity.Name + ", " +
              "Your Role(s) are: " + string.Join(",", roles.ToList()) +
              "Your Login time is :" + LogTime);
}

Testing the Web API Application

To test this first, you need to run your Web API application. Here I am using a client tool called Postman to test web API.

Step 4.1. Test without Access Token

Open the Postman application and provide the necessary details as given in the below image.

Here we will get 401 unauthorized responses.

Step 4.2. Create the Access Token

First, we try to create an Access Token with invalid credentials.

Here we will get the status as 400 Bad Request and also get the error describing that the provided username and password are incorrect. Let’s generate the access token with valid credentials as shown in the below image.

Now we will get status code 200 OK and access token value, token type as Bearer, and the token expiration in seconds in the Response section.

Step 4.3. Test with Access Token

Copy the access token and use it as shown in the below image.

If all is correct we’ll receive HTTP status 200 along with the secured data in the response body.

In this article, we will learn how to create Access Token and how to use it using Token Based Authentication. Hope this article will help the readers. Happy Coding!