For user authentication with external providers such as Google, it is using specific Owin middlewares. As for example Microsoft.Owin.Security.Google. WebAPI2 template uses this to support implicit flow authentication (response_type=token). But what about Code flow?
Is it possible to implement Code flow (response_type=code)?
After debugging those OAuth providers I noticed that passing return_type=code to Google, it successfully authenticates and returns json with access and refresh tokens, then user gets signed in by api/Account/ExternalLogin endpoint but at the end of the flow I get redirected to http://localhost:50321/?error=unsupported_response_type#.
I could not really find the flow where and why it is setting this specific error in the assembly.
Startup.Auth.cs looks like this:
public void ConfigureAuth(IAppBuilder app) { app.UseExternalSignInCookie(DefaultAuthenticationTypes.ExternalCookie); PublicClientId = "self"; var tokenTimeSpanInHours = ConfigurationManager.AppSettings["AccessTokenLifeTimeInHours"]; OAuthServerOptions = new OAuthAuthorizationServerOptions { Provider = new ApplicationOAuthProvider(PublicClientId), TokenEndpointPath = new PathString("/api/token"), AuthorizeEndpointPath = new PathString("/api/Account/ExternalLogin"), AccessTokenExpireTimeSpan = TimeSpan.FromHours(Convert.ToInt16(tokenTimeSpanInHours)), AllowInsecureHttp = true }; app.UseOAuthBearerTokens(OAuthServerOptions); var googleOAuthOptions = new GoogleOAuth2AuthenticationOptions { AccessType = "offline", Provider = new CustomGoogleAuthProvider(), ClientId = ConfigurationManager.AppSettings["GoogleAccountClientId"].ToString(), ClientSecret = ConfigurationManager.AppSettings["GoogleAccountClientSecret"].ToString() }; googleOAuthOptions.Scope.Add("profile"); googleOAuthOptions.Scope.Add("email"); googleOAuthOptions.Scope.Add("https://www.googleapis.com/auth/gmail.send"); app.UseGoogleAuthentication(googleOAuthOptions); } Where is the problem then? Do I need some explicit configuration to tell that I want code flow? Is it supported?
0 comments:
Post a Comment