ASP.NET Web API 2: How to log in using external authentication services?

Question

According to this post http://www.asp.net/web-api/overview/security/external-authentication-services ... I can log in using the local authentication service (with a new ASP.NET identity framework)

but I can’t find a step-by-step guide for correctly calling (from a mobile application or postman ) the default web API created in the Visual Studio 2013 SPA template.

Can someone help me?

Answer 1

Today I had the same problem and found the following solution:

Get all available suppliers first

GET /api/Account/ExternalLogins?returnUrl=%2F&generateState=true 

The response message is a list in json format

 [{"name":"Facebook", "url":"/api/Account/ExternalLogin?provider=Facebook&response_type=token&client_id=self&redirect_uri=http%3A%2F%2Flocalhost%3A15359%2F&state=QotufgXRptkAfJvcthIOWBnGZydgVkZWsx8YrQepeDk1", "state":"QotufgXRptkAfJvcthIOWBnGZydgVkZWsx8YrQepeDk1"}] 

Now send a GET request to the address of the provider you want to use. You will be redirected to the external provider login page. Fill out your credentials and you will be redirected back to your site. Now access_token by url.

 http://localhost:15359/#access_token=[..]&token_type=bearer&expires_in=[..]&state=QotufgXRptkAfJvcthIOWBnGZydgVkZWsx8YrQepeDk1 

If the user already has a local account, the cookie .AspNet.Cookies set and everything is ready. If not, only the .AspNet.ExternalCookie cookie is .AspNet.ExternalCookie , and you must register a local account.

There is an api to find out if a user is registered:

 GET /api/Account/UserInfo 

Answer

 {"userName":"xxx","hasRegistered":false,"loginProvider":"Facebook"} 

To create a local user account, call

 POST /api/Account/RegisterExternal Authorization: Bearer VPcd1RQ4X... (access_token from url) Content-Type: application/json {"UserName":"myusername"} 

Now send the same request with the provider url as before

 GET /api/Account/ExternalLogin?provider=Facebook&response_type=token&client_id=self&redirect_uri=http%3A%2F%2Flocalhost%3A15359%2F&state=QotufgXRptkAfJvcthIOWBnGZydgVkZWsx8YrQepeDk1 

But this time, the user already has an account and receives authentication. You can verify this by calling /api/Account/UserInfo again.

Now access_token from the url. You must add an Authorization: Bearer [access_token] for each of your requests.

Answer 2

I found another post detailing how this external authentication works. The client is WPF, and the server uses the ASP.NET identifier.

Answer 3

For those who are trying to use external access via Web Api 2 via Facebook in an Android application, this post explains only the first part of what we should do. Here is a very explanatory link to the whole picture:

[ Authenticated access to WebAPI via Facebook token from Android application