OAuth Login with Phone number or Email address web api

This is the complete code, I customized the Authorization Server as per your need.

public class Startup
{
public void Configuration(IAppBuilder app)
{
app.UseCors(Microsoft.Owin.Cors.CorsOptions.AllowAll);
var myProvider = new AuthProvider();
OAuthAuthorizationServerOptions options = new OAuthAuthorizationServerOptions
{
AllowInsecureHttp = true,
TokenEndpointPath = new PathString("/token"),
AccessTokenExpireTimeSpan = TimeSpan.FromDays(1),
Provider = myProvider
};
app.UseOAuthAuthorizationServer(options);
app.UseOAuthBearerAuthentication(new OAuthBearerAuthenticationOptions());
HttpConfiguration config = new HttpConfiguration();
WebApiConfig.Register(config);
}
}
public class AuthProvider: OAuthAuthorizationServerProvider
{
public override Task ValidateClientAuthentication(OAuthValidateClientAuthenticationContext context)
{
//Here we get the Custom Field sent in /Token
var Email= context.Parameters.Where(x => x.Key == "Email").Select(x => x.Value).FirstOrDefault();
var Phone= context.Parameters.Where(x => x.Key == "Phone").Select(x => x.Value).FirstOrDefault();
if (Email !=null)
{
context.OwinContext.Set("Email", Email);
}
if(Phone!=null)
{
context.OwinContext.Set<int>("phone", phone);
}
// Resource owner password credentials does not provide a client ID.
if (context.ClientId == null)
{
context.Validated();
}
return
Task.FromResult
(null);
        }
        public override async Task GrantResourceOwnerCredentials(OAuthGrantResourceOwnerCredentialsContext context)
        {
            var identity = new ClaimsIdentity(context.Options.AuthenticationType);
            string Email= context.OwinContext.Get("Email");
            string Phone=context.OwinContext.Get<int>("phone");
            if(Email!=null){
             {
                Email== "[email protected]"; // compare from database
                context.Validated(identity);
              }
if(Phone!=null){
             {
                phone== 123456; // compare from database
                context.Validated(identity);
              }
            else
            {
                context.SetError("invalid_grant", "Provided username and password is incorrect");
                return;
            }
        }
    }
Now send additional parameters like phone or Email while requesting for token and it will work.
$.ajax({
        type: 'POST',
        url: /Token,
        data: { username: 'John', password: 'Smith', grant_type: 'password', Email:[email protected]' },
        dataType: "json",
        contentType: 'application/x-www-form-urlencoded; charset=utf-8',
        xhrFields: {
        withCredentials: true
    },

});

1 Reply

Know the answer? Post it — somebody with the same question will find it here.

Sachin Singh5y ago
This is the complete code, I customized the Authorization Server as per your need.
public class Startup
    {
        public void Configuration(IAppBuilder app)
        {
            app.UseCors(Microsoft.Owin.Cors.CorsOptions.AllowAll);
            var myProvider = new AuthProvider();
            OAuthAuthorizationServerOptions options = new OAuthAuthorizationServerOptions
            {
                AllowInsecureHttp = true,
                TokenEndpointPath = new PathString("/token"),
                AccessTokenExpireTimeSpan = TimeSpan.FromDays(1),
                Provider = myProvider
            };
            app.UseOAuthAuthorizationServer(options);
            app.UseOAuthBearerAuthentication(new OAuthBearerAuthenticationOptions());


            HttpConfiguration config = new HttpConfiguration();
            WebApiConfig.Register(config);
        }
    }

public class AuthProvider: OAuthAuthorizationServerProvider
    {
        public override Task ValidateClientAuthentication(OAuthValidateClientAuthenticationContext context)
        {
            //Here we get the Custom Field sent in /Token
          var Email= context.Parameters.Where(x => x.Key == "Email").Select(x => x.Value).FirstOrDefault();
          var Phone=  context.Parameters.Where(x => x.Key == "Phone").Select(x => x.Value).FirstOrDefault();
            if (Email !=null)
            {
                context.OwinContext.Set("Email", Email);
            }
if(Phone!=null)
{
                context.OwinContext.Set<int>("phone", phone);
            }
            // Resource owner password credentials does not provide a client ID.
            if (context.ClientId == null)
            {
                context.Validated();
            }

            return Task.FromResult