OAuth Authentication For Web API

Authentication means verifying the user who is accessing the system. We have available different types of authentication in .NET programming like Windows Authentication, Forms Authentication, Claim Based Authentication, Token-Based Authentication, etc.

 

Token-based Authentication

 

In token-based authentication, you pass your credentials [user name and password], to the server, which verifies your credentials and if it is a valid user, then it will return a signed token to the client system, which has an expiration time. The client can store this token locally using any mechanism like local storage, session storage, etc. and if the client makes any other call to the server for data, then it does not need to pass its credentials every time. The client can directly pass the token to the server, which will be validated by the server and if the token is valid, then you will able to access your data.

 

OAuth

 

(Open Authorization) is an open standard for token-based authentication and authorization on the Internet.

 

OAuth versions

 

There are two versions of OAuth authorization OAuth 1 (using HMAC-SHA signature strings) and OAuth 2 (using tokens over HTTPS).

 

OAuth Tokens

 

There are two types of tokens involved in OAuth 2,

 

Access Token

 

The access token is used to for authentication and authorization to get access to the resources from the resource server.

 

Refresh Token

 

The refresh token normally is sent together with the access token.

 

The refresh token is used to get a new access token when the old one expires. Instead of the normal grant type, the client provides the refresh token and receives a new access token.

 

Token Types

 

Access tokens have a type, which defines how they are constructed.

• Bearer Tokens
  The bearer tokens use HTTPS security, and the request is not signed or encrypted. Possession of the bearer token is considered authentication.
  
  
• MAC Tokens
  More secure than bearer tokens, MAC tokens are similar to signatures, in that they provide a way to have (partial) cryptographic verification of the request.

How To Implement OAuth in WebAPI

 

Step 1 - Create a WebAPI Project

 

Step 2 - Add the below packages from Nuget Packages

 

Packages Required

1. Microsoft.Owin – Implementation of OAuth Services.
2. Microsoft.Owin.Host.SystemWeb- OWIN server that enables OWIN-based applications to run on IIS using the ASP.NET request pipeline.
3. Microsoft.Owin.Security.OAuth- Middleware that enables an application to support any standard OAuth 2.0 authentication workflow.
4. Microsoft.Owin.Security- Common types which are shared by the various authentication middleware components.
5. Microsoft.AspNet.Identity.Owin-Owin implementation for ASP.NET Identity.
6. Microsoft.Owin.Cors - components to enable Cross-Origin Resource Sharing (CORS) in OWIN middleware.

Step 3 - Owin Startup Configuration

 

Remove the Global.asax.cs file and add a startup file in place of that. Add the below line for creating owin start-up.

 

[assembly: OwinStartup(typeof(EmployeeService.Startup))]

 

If Application-specific functions like Application_Init, Application_Start, etc are needed we can make Global.asax itself as owin startup.

 

In a startup, the file adds the below configurations of Token. This will act as Web API Configuration and when every time web API is refreshed this configuration will also be refreshed.

IAppBuilder AppBuilder;
public void ConfigureAuth(IAppBuilder app) {
    AppBuilder = app;
    var OAuthOptions = new OAuthAuthorizationServerOptions {
        AllowInsecureHttp = true,
            TokenEndpointPath = new PathString("/token"),
            AccessTokenExpireTimeSpan = TimeSpan.FromMinutes(1),
            Provider = new SimpleAuthorizationServerProvider(),
            RefreshTokenProvider = new SimpleRefreshTokenProvider()
    };
    app.UseOAuthBearerTokens(OAuthOptions);
    app.UseOAuthAuthorizationServer(OAuthOptions);
    app.UseOAuthBearerAuthentication(new OAuthBearerAuthenticationOptions());
    HttpConfiguration config = new HttpConfiguration();
    WebApiConfig.Register(config);
}
public void Configuration(IAppBuilder app) {
    ConfigureAuth(app);
    GlobalConfiguration.Configure(WebApiConfig.Register);
}

• TokenEndpointPath - It’s the request to be sent from the client end to generate the token.
• AccessTokenExpireTimeSpan - This is the access token expiry time.
• Provider/ RefreshTokenProvider - It’s a class where the token generation functionalities are included.

Step 4 - Adding Token & Refresh Token Providers

 

Token Provider

 

"SimpleAuthorizationServerProvider" class which inherits from OAuthAuthorizationServerProvider. It contains two override methods.

• ValidateClientAuthentication – This method is to validate each service request.
• c– This method will grant to access the application based on your credentials.
• GrantRefreshToken – This method is used to generate the refresh token.

[EnableCors(origins: "*", headers: "*", methods: "*")]
public class SimpleAuthorizationServerProvider: OAuthAuthorizationServerProvider {
        public override async Task ValidateClientAuthentication(OAuthValidateClientAuthenticationContext context) {
            context.Validated();
        }
        public override async Task GrantResourceOwnerCredentials(OAuthGrantResourceOwnerCredentialsContext context) {
            var identity = new ClaimsIdentity(context.Options.AuthenticationType);
            context.OwinContext.Response.Headers.Add("Access-Control-Allow-Origin", new [] {
                "*"
            });
            //db Logic to validate user
            If(user validated) {
                identity.AddClaim(new Claim("Age", "16"));
                var props = new AuthenticationProperties(new Dictionary < string, string > {
                    {
                        "userdisplayname",
                        context.UserName
                    },
                    {
                        "role",
                        "admin"
                    }
                });
                var ticket = new AuthenticationTicket(identity, props);
                context.Validated(ticket);
            }
            Else {
                context.SetError("invalid_grant", "Provide username and password is incorrect");
                context.Rejected();
            }
        }
        public override Task GrantRefreshToken(OAuthGrantRefreshTokenContext context) {
            var newIdentity = new ClaimsIdentity(context.Ticket.Identity);
            newIdentity.AddClaim(new Claim("newClaim", "newValue"));
            var newTicket = new AuthenticationTicket(newIdentity, context.Ticket.Properties);
            context.Validated(newTicket);
            return Task.FromResult < object > (null);
        }

Refresh Token Providers

 

Refresh Token Provider is used to produce refresh tokens. It inherits ‘AuthenticationTokenProvider’. It contains two methods,

public class SimpleRefreshTokenProvider: IAuthenticationTokenProvider {
    private static ConcurrentDictionary < string, AuthenticationTicket > _refreshTokens = new ConcurrentDictionary < string, AuthenticationTicket > ();
    public async Task CreateAsync(AuthenticationTokenCreateContext context) {
        var guid = Guid.NewGuid().ToString();
        _refreshTokens.TryAdd(guid, context.Ticket);
        context.SetToken(guid);
    }
    public async Task ReceiveAsync(AuthenticationTokenReceiveContext context) {
        AuthenticationTicket ticket;
        if (_refreshTokens.TryRemove(context.Token, out ticket)) {
            context.SetTicket(ticket);
        }
    }
}

Step 5 - Create a Controller

 

Add a new controller and add a method to it which is having [Authorize] attribute.

public class EmployeeController: ApiController {
    [HttpGet]
    [Authorize]
    public List < Employee > GetEmployees() {
        using(var db = new TESTEntities()) {
            var employees = db.Employees.ToList();
            return employees;
        }
    }
}

GetEmployees method will only return 200 OK Success message if bearer token is passed in headers. Otherwise the request will return 401 Unauthorized code.

 

We can customize the authentication attribute according to our logic if needed.

 

Step 6 - Enable CORS in WebAPIconfig

 

CORS is a mechanism that allows restricted resources on a web page to be requested from another domain, outside the domain from which the resource originated. Enable CORS by adding following lines in WEBAPIconfig,

EnableCorsAttribute cors = new EnableCorsAttribute("*", "*", "*");
config.EnableCors(cors);

How To Run OAuth Web API

 

By following the above 6 Steps OAuth WebAPI is created. Now, let us see how to frame service requests for token generation, Refresh Token, etc.

 

Host the Web API in IIS in Integrated Pipeline Mode.

 

Call the ~/token method below format.

• Headers – Set Application Type as application/x-www-form-urlencoded
• Body – Pass user credentials (Username & Password), and grant_type as ‘password’

In Response, if data passed are correct and validated successfully, Token, Token type along with its expiry time and refresh token will be returned. The access token is valid for 59s according to the above response, It can be regenerated by passing the refresh token request.

 

To Refresh the token call the ~/token method in the below format,

• Headers – Set Application Type as application/x-www-form-urlencoded
• Body – Pass refresh_token as <refresh_token_value>, and grant_type as ‘refresh_token’

For Accessing a service request with Authorize attribute frame the request in the below format.

• Headers – Set Application Type as application/x-www-form-urlencoded, Set Authorization as ‘bearer <access_token_value>’