Two Factor authentication in Web Api mvc

I want email or phonenumber login .in default Web Api have username authentication i don't know how to customize that.this is my mvc code.i just call web api here in https://localhost:44327/Token

[AllowAnonymous]

        //[ValidateAntiForgeryToken]
        [HttpPost]
        public async Task Login(Login model, string returnUrl)
        {
            /*This will depend totally on how you will get access to the identity provider and get your token, this is just a sample of how it would be done*/
            /*Get Access Token Start*/
            HttpClient httpClient = new HttpClient();
            httpClient.BaseAddress = new Uri("https://localhost:44327/Token");
            var postData = new List>();
            postData.Add(new KeyValuePair("Username", model.UserName));
            postData.Add(new KeyValuePair("Email", model.Email));
            postData.Add(new KeyValuePair("Password", model.Password));
            postData.Add(new KeyValuePair("grant_type", "password"));
            HttpContent content = new FormUrlEncodedContent(postData);

            HttpResponseMessage response = await httpClient.PostAsync("https://localhost:44327/Token", content);
            // response.EnsureSuccessStatusCode();
            string AccessToken = response.Content.ReadAsStringAsync().Result;
            //string AccessToken = /*Newtonsoft.Json.*/JsonConvert.DeserializeObject(result);
            /*Get Access Token End*/

            if (AccessToken.Length >= 200)
            {

                TempData["userid"] = "userid";
                TempData["name"] = model.UserName;
                return RedirectToAction("Home");
            }

            ModelState.AddModelError("Username", "Username and password is not valid");
            return View(model);
        }

As far as I could understand, you send a username and password to the token endpoint and then receive a token that you use in successive requests.

The problem is, you are using a readymade code for authenticating the request, you need to create a custom Authorization Server that will verify the request based on Email/Phone Number instead of a username like shown below.

step 1. The startup class

public class Startup
{
public void Configuration(IAppBuilder app)
{
app.UseCors(Microsoft.Owin.Cors.CorsOptions.AllowAll);
var myProvider = new AuthProvider();
OAuthAuthorizationServerOptions options = new OAuthAuthorizationServerOptions
{
AllowInsecureHttp = true,
TokenEndpointPath = new PathString("/token"),
AccessTokenExpireTimeSpan = TimeSpan.FromDays(1),
Provider = myProvider
};
app.UseOAuthAuthorizationServer(options);
app.UseOAuthBearerAuthentication(new OAuthBearerAuthenticationOptions());
HttpConfiguration config = new HttpConfiguration();
WebApiConfig.Register(config);
}
}

step 2. Custom Authorization Server as per your need.

public class AuthProvider: OAuthAuthorizationServerProvider
{
public override Task ValidateClientAuthentication(OAuthValidateClientAuthenticationContext context)
{
//Here we get the Custom Field sent in /Token
var Email= context.Parameters.Where(x => x.Key == "Email").Select(x => x.Value).FirstOrDefault();
if (Email.Length > 0 && Email[0].Trim().Length > 0)
{
context.OwinContext.Set("Email", Email[0].Trim());
}
// Resource owner password credentials does not provide a client ID.
if (context.ClientId == null)
{
context.Validated();
}
return Task.FromResult

3 Replies

Know the answer? Post it — somebody with the same question will find it here.

Sachin Singh5y ago
As far as I could understand, you send a username and password to the token endpoint and then receive a token that you use in successive requests.
The problem is, you are using a readymade code for authenticating the request, you need to create a custom Authorization Server that will verify the request based on Email/Phone Number instead of a username like shown below.
step 1. The startup class
public class Startup
    {
        public void Configuration(IAppBuilder app)
        {
            app.UseCors(Microsoft.Owin.Cors.CorsOptions.AllowAll);
            var myProvider = new AuthProvider();
            OAuthAuthorizationServerOptions options = new OAuthAuthorizationServerOptions
            {
                AllowInsecureHttp = true,
                TokenEndpointPath = new PathString("/token"),
                AccessTokenExpireTimeSpan = TimeSpan.FromDays(1),
                Provider = myProvider
            };
            app.UseOAuthAuthorizationServer(options);
            app.UseOAuthBearerAuthentication(new OAuthBearerAuthenticationOptions());


            HttpConfiguration config = new HttpConfiguration();
            WebApiConfig.Register(config);
        }
    }
step 2. Custom Authorization Server as per your need.
public class AuthProvider: OAuthAuthorizationServerProvider
    {
        public override Task ValidateClientAuthentication(OAuthValidateClientAuthenticationContext context)
        {
            //Here we get the Custom Field sent in /Token
          var Email= context.Parameters.Where(x => x.Key == "Email").Select(x => x.Value).FirstOrDefault();
            if (Email.Length > 0 && Email[0].Trim().Length > 0)
            {
                context.OwinContext.Set("Email", Email[0].Trim());
            }
            // Resource owner password credentials does not provide a client ID.
            if (context.ClientId == null)
            {
                context.Validated();
            }

            return Task.FromResult