Xamarin auth and tokens using ASP.NET MVC identity as backend - web-services

Question

So I set up an ASP.NET MVC app with Identity and Oauth2 using this tutorial:
http://bitoftech.net/2014/06/01/token-based-authentication-asp-net-web-api-2-owin-asp-net-identity/
I can't recommend that tutorial enough if you are trying to do this, it is quite excellent. I'm now able to login using the usernames / passwords stored in the MVC database with the following HTTP request:
POST /token HTTP/1.1
Host: mymvcsite.azurewebsites.net
Accept: application/json
Content-Type: application/x-www-form-urlencoded
Cache-Control: no-cache
grant_type=password&username=MyUserName&password=MyPassword
I used javascript just as a proof of concept using an HttpRequest and it works amazingly well. I get a token back and everything. My response looks like this:
{
"access_token": "A Really long character string",
"token_type": "bearer",
"expires_in": 86399
}
So everything works outside of Xamarin at the moment and now I'm trying to wrap my head around how to plug all this into my Xamarin project. My first source of confusion is the Xamarin.auth plugin and how it might be used in this case, if at all. I cannot find anything on this plugin that doesn't use Facebook or Google as the auth provider and what I'm doing doesn't seem to fit into that model where you have a client secret and and ClientID and the like. The second thing I'm trying to undertstand is what I'm doing with the token once I have it. The ultimate goal here is to create a few web services in the MVC site, have users authenticate against the MVC identity using oauth, then access those web services securely. So my questions are:
1) Would I use Xamain.auth in this case? If so, are there any good resources that have examples of what I'm trying to do?
2) Once I have the token, how do I secure a web service to expect an oauth2 token like this?

Answer 1

Great resource you've posted there. I've used that as well and I've built a whole (Xamarin) portable class library that automatically submits this token with every request etc.
In ASP.NET MVC it's as easy as adding the
[Authorize]
-attribute over your API-controllers. THis will instantly secure them if you followed the guide properly.
After securing your API's you'll need to send requests containing the bearer token. This is how I implemented it in my projects:
// First logging in and getting a token:
public async Task<bool> OAuthLoginAsync(string username, string password)
{
var formContent = new FormUrlEncodedContent(new[]
{
new KeyValuePair<string, string>("username", username),
new KeyValuePair<string, string>("password", password),
new KeyValuePair<string, string>("grant_type", "password")
});
Token = await PostAndReadAsync<TokenResponse>(_oauthEndpointUri, formContent);
}
// this method is responsible for sending the request and returning an object
public async Task<T> PostAndReadAsync<T>(string path, HttpContent content)
{
var httpClient = new HttpClient();
httpClient.DefaultRequestHeaders.Add("Accept", "application/json");
var responseMessage = await httpClient.PostAsync(path, content, cancellationToken);
if (!responseMessage.IsSuccessStatusCode) {
throw new Exception("Something went wrong...");
}
return await responseMessage.Content.ReadAsAsync<T>(cancellationToken);
}
}
Token definition:
public class TokenResponse
{
[JsonProperty("access_token")]
public string AccessToken { get; set; }
[JsonProperty("token_type")]
public string TokenType { get; set; }
[JsonProperty("expires_in")]
public int ExpiresIn { get; set; }
[JsonProperty("refresh_token")]
public string RefreshToken { get; set; }
[JsonProperty("as:client_id")]
public string ClientId { get; set; }
[JsonProperty("userName")]
public string UserName { get; set; }
[JsonProperty(".issued")]
public DateTime IssueDate { get; set; }
[JsonProperty(".expires")]
public DateTime ExpireDate { get; set; }
}
Then in any subsequent api calls (where you should be providing an oauth token) you should add the access token.
HttpClient.DefaultRequestHeaders.Authorization =
new AuthenticationHeaderValue("Bearer", Token.AccessToken);
As an added bonus the PostAndReadAsync method specified earlier can be reused to call any other resource (as it returns <T>) so it's reusable.
I hope this will help you (and many other facing the same issue). Feel free to ask for more information if this isn't complete for your situation.
Please note that I removed all try/catches and cancellationtokens for simplicity.
You'll need the following nuget packages in your (shared) mobile project:
Microsoft.Bcl
Microsoft.Bcl.Build
Microsoft.Bcl.Http
Microsoft.AspNet.WebApi.Client
Newtonsoft.Json