ASP.NET Web API 2: How to login with external authentication services?

According to this post http://www.asp.net/web-api/overview/security/external-authentication-services... i'm able to login with local authentication service (with new Asp.net identity framework)

but can't find a walktrough to call properly (from a mobile app or Postman ) the default web api generated in Visual Studio 2013 SPA template.

Can anyone help me?

Answers


I had the same problem today and found the following solution:

At first get all available providers

GET /api/Account/ExternalLogins?returnUrl=%2F&generateState=true

The response message is a list in json format

[{"name":"Facebook",
  "url":"/api/Account/ExternalLogin?provider=Facebook&response_type=token&client_id=self&redirect_uri=http%3A%2F%2Flocalhost%3A15359%2F&state=QotufgXRptkAfJvcthIOWBnGZydgVkZWsx8YrQepeDk1",
  "state":"QotufgXRptkAfJvcthIOWBnGZydgVkZWsx8YrQepeDk1"}]

Now send a GET request to the url of the provider you want to use. You will be redirected to the login page of the external provider. Fill in your credentials and the you will be redirected back to your site. Now parse the access_token from the url.

http://localhost:15359/#access_token=[..]&token_type=bearer&expires_in=[..]&state=QotufgXRptkAfJvcthIOWBnGZydgVkZWsx8YrQepeDk1

If the user already has a local account, the .AspNet.Cookies cookie is set and you are done. If not, only the .AspNet.ExternalCookie cookie is set and you have to register a local account.

There is an api to find out if the user is registered:

GET /api/Account/UserInfo

The response is

{"userName":"xxx","hasRegistered":false,"loginProvider":"Facebook"}

To create a local account for the user, call

POST /api/Account/RegisterExternal
Authorization: Bearer VPcd1RQ4X... (access_token from url)
Content-Type: application/json
{"UserName":"myusername"}

Now send the same request with the provider url as before

GET /api/Account/ExternalLogin?provider=Facebook&response_type=token&client_id=self&redirect_uri=http%3A%2F%2Flocalhost%3A15359%2F&state=QotufgXRptkAfJvcthIOWBnGZydgVkZWsx8YrQepeDk1

But this time the user already has an account and gets authenticated. You can verify this by calling /api/Account/UserInfo again.

Now extract the access_token from the url. You have to add the Authorization: Bearer [access_token] header to every request you make.


I found another post showing pretty details how this external authentication works. The client is WPF and server uses ASP.NET Identity.


For those trying to use Web Api 2 External Login with Facebook in Android App this post is explaining only the first part of what we have to do. Here is a very explanatory link of the whole picture:

[Authenticated access to WebAPI via Facebook token from Android App


Need Your Help

How do I change the font of a UILabel in swift without changing the font size?

ios swift fonts labels

I have programatically created a label which I have set the adjustsToFitWidth to true. Now I want to change its font, but I can't do that without making the font size of the label constant. Does an...

How to put a horizontal divisor line between edit text's in a activity

android user-interface

I'm making an activity to configure my app, and I have to divide the sections of my configuration window with a line. I used this: divider_horizontal_bright, from this example: