OAuth v2.0 in combination with ASP.NET MVC 4 Web API

Question

I’m trying to build a Web API that uses the oauth 2 standard to authenticate users with my existing application where the Web API communicates with. Therefore I want to setup a oauth 2 server/service that checks the users with my existing applications that has users and roles. Unfortunately I can’t get a good/simple example of how to setup a service like that. So my question is do you have examples or better ideas to authenticate my users?

Answer 1

I didn't quite understand your question to be honest, so I'm not sure if you're asking about general OAuth integration or how to find an OAuth server to integrate your app with.

I'll take my chance and share some search results with you. Hope these will help.

This is a good article about oauth integration. Although it suggests to take a look at http://www.asp.net/identity first to get a better understanding of OAuth and Asp.Net integration.

http://blog.mszcool.com/index.php/2013/12/asp-net-4-5-1-webapi-general-integration-with-oauth2-and-oauth-authentication-servers/

As seen in the post, this flow can guide you to implement your own OAuth server and then you can integrate it with your WebApi.

There is also this article: http://www.developerfusion.com/article/147914/protecting-your-aspnet-web-api-using-oauth2-and-the-windows-azure-access-control-service/

This one has the following headlines:

• Why would I need an API?
• API characteristics
• Building an API in ASP.NET
• Getting to know OAuth2
• Windows Azure Access Control Service
• Consuming an API protected using OAuth2
• Building an API protected using OAuth2 (and Windows Azure ACS)

And finally this SO post might be helpful as well. It is about authentication using OAuth in WebApi.

Good luck!

Edit

Since you said you want to implement your own OAuth server I'm adding a couple more references about OAuth 1.0 protocol.

RFC 5849 OAuth 1.0 Protocol and there is this guide which might help you get a better understanding of OAuth workflow. enter link description here

As for the implementing part, I'm not an expert on that but, you first need to read and understand OAuth protocol so that your own OAuth server can be generic to other OAuth clients and you're actually implementing OAuth. After you understand the OAuth protocol itself, you can pretty much code your server the way you like.

Hope this extra information helps too.