ASP.NET Web API 2: How do I log in with external authentication services?

by

I had the same problem today and found the following solution:

At first get all available providers

GET /api/Account/ExternalLogins?returnUrl=%2F&generateState=true

The response message is a list in json format

[{"name":"Facebook",
  "url":"/api/Account/ExternalLogin?provider=Facebook&response_type=token&client_id=self&redirect_uri=http%3A%2F%2Flocalhost%3A15359%2F&state=QotufgXRptkAfJvcthIOWBnGZydgVkZWsx8YrQepeDk1",
  "state":"QotufgXRptkAfJvcthIOWBnGZydgVkZWsx8YrQepeDk1"}]

Now send a GET request to the url of the provider you want to use. You will be redirected to the login page of the external provider. Fill in your credentials and the you will be redirected back to your site. Now parse the access_token from the url.

http://localhost:15359/#access_token=[..]&token_type=bearer&expires_in=[..]&state=QotufgXRptkAfJvcthIOWBnGZydgVkZWsx8YrQepeDk1

If the user already has a local account, the .AspNet.Cookies cookie is set and you are done. If not, only the .AspNet.ExternalCookie cookie is set and you have to register a local account.

There is an api to find out if the user is registered:

GET /api/Account/UserInfo

The response is

{"userName":"xxx","hasRegistered":false,"loginProvider":"Facebook"}

To create a local account for the user, call

POST /api/Account/RegisterExternal
Authorization: Bearer VPcd1RQ4X... (access_token from url)
Content-Type: application/json
{"UserName":"myusername"}

Now send the same request with the provider url as before

GET /api/Account/ExternalLogin?provider=Facebook&response_type=token&client_id=self&redirect_uri=http%3A%2F%2Flocalhost%3A15359%2F&state=QotufgXRptkAfJvcthIOWBnGZydgVkZWsx8YrQepeDk1

But this time the user already has an account and gets authenticated. You can verify this by calling /api/Account/UserInfo again.

Now extract the access_token from the url. You have to add the Authorization: Bearer [access_token] header to every request you make.

More Related Contents:

  1. Web API Queryable – how to apply AutoMapper?
  2. ‘System.Net.Http.HttpContent’ does not contain a definition for ‘ReadAsAsync’ and no extension method
  3. All requests to ASP.NET Web API return 404 error
  4. What is the best way to read/parse the XML files [closed]
  5. ASP.NET Web Site or ASP.NET Web Application?
  6. ASP.NET Web API – PUT & DELETE Verbs Not Allowed – IIS 8
  7. MVC3 and Entity Framework
  8. Accessing Session Using ASP.NET Web API
  9. What is the App_Data folder used for in Visual Studio?
  10. How to get the current logged in user ID in ASP.NET Core?
  11. ASP.NET Identity DbContext confusion
  12. Adding ASP.NET MVC5 Identity Authentication to an existing project
  13. How serious is this new ASP.NET security vulnerability and how can I workaround it?
  14. ASP.NET Web API OperationCanceledException when browser cancels the request
  15. Asp.net Identity password hashing
  16. Global ASAX – get the server name
  17. Custom Authorization in Asp.net WebApi – what a mess?
  18. How to pass a datetime parameter?
  19. Difference between Html.RenderAction and Html.Action
  20. How to Customize ASP.NET Web API AuthorizeAttribute for Unusual Requirements
  21. How to deploy ASP.NET MVC 4 application using localDB to local IIS on Windows 7?
  22. Cannot use a leading ../ to exit above the top directory
  23. ASP.NET Core change EF connection string when user logs in
  24. What’s the difference between ASP.NET 5, .NET Core, and ASP.NET Core 5? [closed]
  25. ASP.NET Identity reset password
  26. ASP.net MVC4 WebApi route with file-name in it
  27. What does the web.config compilation/assemblies element do?
  28. Disable User in ASPNET identity 2.0
  29. Is there a way to handle form post data in a Web Api controller?
  30. URL Routing, Image Handler & “A potentially dangerous Request.Path value”

Leave a Comment