OAuth 2.0 for MVC, Two Legged Implementation

OAuth 2.0 for MVC, Two Legged Implementation

tdupont 

Fri, Mar 18 2011 9:30 AM 

• 13

OAuth 1.0 was one complicated beast. The OAuth 2.0 spec greatly simplified things, but that also had the wonderful side effect of rending all of our old OAuth 1.0 code obsolete. They say that "the only thing a pioneer gets is an arrow in the back," I disagree, I say "the thing that only a pioneer gets to have is an adventure."

For example, I got to help write this wonderful, cutting edge, open source, OAuth 2.0 implementation for MVC!

OAuth 2.0 Overview

OAuth is all about tokens. You start by getting a Request Token from the server, and then using that to secure your login information. When you have successfully logged in you will be given a role/permission specific Access Token, you will then submit this token with all of your future requests. You will also get a Refresh Token with your Access Token. Once your Access Token has expired, you can then submit your Refresh Token to get a new pair of Access and Request Tokens.

Two Legged vs Three Legged

A two legged implementation is rather straight forward, you log into the server you are trying to access. A three legged implementation allows you to gain access to a resource by authentication with a third party server.  For the time being this project only supports two legged authentication.

Implementation

You must implement four classes to use this library:

1. OAuthIdentityBase
2. OAuthPrincipalBase
3. OAuthProviderBase
4. OAuthServiceBase

The first three are very small classes, requiring only a few short lines of code. The Service is the work horse where most of your code will go, but even then it only requires the implementation of four methods.

public abstract class OAuthServiceBase : ProviderBase, IOAuthService

{

    public static IOAuthService Instance { get; set; }

    public abstract OAuthResponse RequestToken();

    public abstract OAuthResponse AccessToken(string requestToken, string grantType, string userName,string password, bool persistent);

    public abstract OAuthResponse RefreshToken(string refreshToken);

    public abstract bool UnauthorizeToken(string token);

}

Then of course you will need to update your Web.config:

<configuration>

  <configSections>

    <section name="oauth" type="OAuth2.Mvc.Configuration.OAuthSection, OAuth2.Mvc, Version=1.0.0.0, Culture=neutral"/>

  </configSections>

  <oauth defaultProvider="DemoProvider" defaultService="DemoService">

    <providers>

      <add name="DemoProvider" type="OAuth2.Demo.OAuth.DemoProvider, OAuth2.Demo" />

    </providers>

    <services>

      <add name="DemoService" type="OAuth2.Demo.OAuth.DemoService, OAuth2.Demo" />

    </services>

  </oauth>

  <system.web>

    <httpModules>

      <add name="OAuthAuthentication" type="OAuth2.Mvc.Module.OAuthAuthenticationModule, OAuth2.Mvc, Version=1.0.0.0, Culture=neutral"/>

    </httpModules>

  </system.web>

</configuration>

Securing Your Pages

That's the easy part, just add the MVC Authorize Attribute to any actions or controllers that you want to secure.

public class HomeController : Controller

{

    public ActionResult Index()

    {

        return View();

    }

 

    [Authorize]

    public ActionResult Secure()

    {

        return View();

    }

}

The Demo Project in Action

1.  2.

3.  4.

The Demo API in Action

• /oauth/requesttoken
  • Request Params
    • None
  • Result
    • RequestToken = a028f1895cc548af9de744f63d283f6e
    • Expires = 300
    • Success = true
• /oauth/accesstoken
  • Request Params
    • oauth_token = a028f1895cc548af9de744f63d283f6e
    • username = tom
    • password = c4e5995d4cb8b26970336b956054ac1be9cc50b3
  • Result
    • AccessToken = 3b23ee5f128a45c88e657ecc74c41bbc
    • Expires = 300
    • RefreshToken = 85126a53bca940f1ae7c9d797f63a274
    • Success = true
• /oauth/refreshtoken
  • Request Params
    • refreshToken = 85126a53bca940f1ae7c9d797f63a274
  • Result
    • AccessToken = 8cfc317af6ed45b2b065a8fa5da3ba81
    • Expires = 300
    • RefreshToken = d0b4a8898d974e939ca83b55cfeabcac
    • Success = true
• /oauth/unauthorize
  • Request Params
    • oauth_token = 8cfc317af6ed45b2b065a8fa5da3ba81
  • Result
    • Success = true

Additional Resources

• Sample Project Download
• OAuth 2.0 Spec
• OAuth 1.0 MVC Project

Happy authenticating!
~ Tom