OAuth in C# as a client

Question

I've been given 6 bits of information to access some data from a website:

1. Website Json Url (eg: http://somesite.com/items/list.json)
2. OAuth Authorization Url (eg: http://somesite.com/oauth/authorization)
3. OAuth Request Url (eg: http://somesite.com/oauth/request)
4. OAuth Access Url (eg: http://somesite.com/oauth/access)
5. Client Key (eg: 12345678)
6. Client Secret (eg: abcdefghijklmnop)

Now, I've looked at DotNetOpenAuth and OAuth.NET libraries, and while I'm sure they are very capable of doing what I need, I just can't figure out how to use either in this way.

Could someone post some sample code of how to consume the Url (Point 1.) in either library (or any other way that may work just as well)?

Thanks!

Answer 1

I also just started working with OAuth a month ago and was also confused by all these libraries. One thing I realized about these libraries is that they're quite complicated (as you have found out). Another thing that makes it hard is that there wasn't a lot of example (it was worse in my case because I was trying to implement a Provider and not a Client).

Originally, I wanted to use the latest OAuth 2.0 but the only .NET library out there that implements it is DotNetOpenAuth. It's probably one of the most complete .NET OAuth library out there but it'll take too long for me to understand (due to not knowing WCF, MVC, etc). I have since downgraded to OAuth 1.0a because I found these examples for DevDefined OAuth. I don't know about you but I found it easier to learn from examples.

It looks like you only want to implement a Client so make sure to look at the Consumer examples. Try to compile the examples and ignore the Provider examples because you don't need them and it'll make you more confused. Be patient. If you're still confused, it might be a good idea to look at some of the libraries made for other languages as they might have easier to understand documentations.

Answer 2

OK, I know your last post was months ago, but in case you were still working on this (or for people like me who would have loved to see an answer to this question), here's some information regarding the NullReferenceException you encountered creating the OAuth request:

The null reference comes from the IServiceLocator that is used to resolve dependencies. If you don't explicitly pass one into the constructor, it uses the static property ServiceLocator.Current in the Microsoft.Practices.ServiceLocation namespace.

This is one of the many pitfalls of using static methods and global state, is you hide issues like this from the consumer of your API. So if you haven't specified a default service locator, then null is returned, resulting in the NullReferenceException.

So to fix this issue, I wired up an implementation of IServiceLocator that uses StructureMap (one of the many IoC containers available) as the container. Lastly, you will need to register instances for two interfaces: ISigningProvider and INonceProvider. Luckily, several standard implementations exist in the OAuth.Net.Components assembly, such as GuidNonceProvider and HmacSha1SigningProvider.

The resulting code looks like something like this:

var container = new Container();

container.Configure(a => a.For<INonceProvider>().Use<GuidNonceProvider>());
container.Configure(a => a.For<ISigningProvider>()
                          .Use<HmacSha1SigningProvider>()
                          .Named("signing.provider:HMAC-SHA1"));

var locator = new StructureMapAdapter(container);
ServiceLocator.SetLocatorProvider(delegate { return locator; });

I realize this isn't the final solution to your original question (I'm still working on getting it working myself), but I hope it gets you a few steps further. And if you've long abandoned this implementation altogether... well, happy coding anyway!

Answer 3

For OAuth 2.0:

I learned that it's easiest to just put up the authentication page in an HTML window then trap the returned access_token. You can then do that using in client-side web browser.

For example, in MonoTouch it would be:

//
// Present the authentication page to the user
//
var authUrl = "http://www.example.com/authenticate";
_borwser.LoadRequest (new NSUrlRequest (new NSUrl (authUrl)));

//
// The user logged in an we have gotten an access_token
//
void Success(string access_token) {

    _web.RemoveFromSuperview();

    var url = "http://www.example.com/data?access_token=" + access_token;

    // FETCH the URL as needed
}

//
// Watch for the login
//
class Del : UIWebViewDelegate
{
    public override void LoadingFinished (UIWebView webView)
    {
        try {
            var url = webView.Request.Url.AbsoluteString;
            var ci = url.LastIndexOf ("access_token=");
            if (ci > 0) {
                var code = url.Substring (ci + "access_token=".Length);
                _ui.Success (code);
            }
        } catch (Exception error) {
            Log.Error (error);
        }
    }
}