Facebook api – WebApi + Authenication. How to do it?

This is a bit complex so Im going to explain what you have to do.

1) The first thing is use an OAuth provider. Microsoft is improving Identity Server.

Identity server give to you Authorization and Authentication, based on openid.

2) Identity server must be compile in another project and will create 18 tables in data base to control users and your clients.

A client is the app with access, for example, Android app, angular app or resource server. Depending on you application you must to choose a work flow. In identity server you can choose between 5 of them

https://github.com/IdentityServer

Identity server 3 is for asp.net mvc 4.5+ and Identity server 4 is for ASP.NET Core 1

I guess your server will be a resource server so if you will save user accounts you must to do 2 sign up, a sign up in identity server and then in your resource server.

To configure you resource server and understand the communication between both, you must to configure your StartUp.cs with something like this:

 public class Startup
    {
        public void Configuration(IAppBuilder app)
        {
            // Any connection or hub wire up and configuration should go here
            var clientId = (string)ConfigurationManager.AppSettings["oauth2.clientid"];
            var authority = (string)ConfigurationManager.AppSettings["oauth2.authority"];

            app.UseIdentityServerBearerTokenAuthentication(new IdentityServerBearerTokenAuthenticationOptions
            {
                Authority = authority,
                ValidationMode = ValidationMode.ValidationEndpoint,
                RequiredScopes = new[] { clientId },
            });

            app.UseResourceAuthorization(new AuthorizationManager());

        }


        private void ConfigureOAuth()
        {
            var formatters = GlobalConfiguration.Configuration.Formatters;
            var jsonFormatter = formatters.JsonFormatter;
            var settings = jsonFormatter.SerializerSettings;
            settings.Formatting = Formatting.Indented;
        }
    }

When you provide a token and you call the service by REST you will send in your http header the next thing:

header.add(“Authorization”, “TypeToken Token”);

The most used type token is Bearer

This token is provided by identity server when you do a loggin with the identity.client class in C# giving to you an awesome tool to do the hardest part.

Configure client:

  private TokenClient GetTokenClient()
        {
            var clientId = (string)ConfigurationManager.AppSettings["oauth2.clientid"];
            var clientSecret = (string)ConfigurationManager.AppSettings["oauth2.client-secret"];
            var tokenEndPoint = (string)ConfigurationManager.AppSettings["openid.endpoints.token"];

            var client = new TokenClient(
                tokenEndPoint,
                clientId,
               clientSecret
            );

            return client;
        }

Getting Token:

Route("LoginOAUth")]
        [HttpPost]
        public async Task<TokenResponse> LoginOAUth(LoginViewModel credentials)
        {
            var result = await GetTokenClient().RequestResourceOwnerPasswordAsync(credentials.Correo, credentials.Password,
                            "offline_access AppNameExample-IdentityClient-morgan");

            return result;
        }

  public class LoginModel
    {
        public string Email { get; set; }
        public string Password { get; set; }
    }

This token must be stored by the client, and also each time you do a call to the end points your resource server will do a internal call to Identity server to check if your token is valid or not, and if your token is expired or not.

In the token you get 2 kind information scopes and claims, those scopes and claim say to you the “rights on the resources” and the user data information like id, email, name, etc. To read those attributes here is an example of a custom AuthorizationAttribute:

  public class AuthorizationManager : ResourceAuthorizationManager
    {

        public override Task<bool> CheckAccessAsync(ResourceAuthorizationContext context)
        {

            switch (context.Resource.First().Value)
            {
                case "claims":
                    return AuthorizeValues(context);
                default:
                    return Nok();
            }
        }

        Task<bool> AuthorizeValues(ResourceAuthorizationContext context)
        {
            switch (context.Action.First().Value)
            {
                case "read":
                    return Eval(context.Principal.HasClaim("role", "api-read"));
                default:
                    return Nok();
            }
        }

    }

Is really complex and I spended 1 months studuying the OAuth 2.0 protocol and how works identity server. I wish you the best of lucks