Web API authorization access_token validation

Question

Now I am working with authorization with OAUTH2.0. I want to do my own authorization server(WEB API). I have a Dummy MVC project to test this. I succeeded to create some access token in server(WEB API) using 'SimpleAuthorizationServerProvider'. I have to call some API Calls but should authorized. so I can send this call with my token like.

https://localhost/Profile?access_token=...

or can send access_token through header. This much is OK now from my side. But I need to validate this access_token in server side. I can get access token from client(Dummy MVC project).

private static TokenResponse GetToken()
    {
            var client = new OAuth2Client(new Uri("http://localhost:2727/token"),"client1", "secret");
            var response = client.RequestResourceOwnerPasswordAsync("bob", "bob").Result;
            return response;
    }

But could not uderstand where it's created from server side. And Where we Can Validate the access_token in server side (Web API). I read lot but still very much confused. Please help me. Thanks!!

Answer 1

You don't need to worry about access token on server side. Access token on server side is parsed and validated by Katana middleware. If you need more details on how access token is created/used then search for DeserializeTicket and SerializeTicket methods in Katana sources, you will find that these methods are used in conjunction with Token to serialize/deserialize ClaimsIdentity which you have pased on client side(DummyMVC).

Anyway you are using SimpleAuthorizationServerProvider from Embedded AuthorizationServer Thinktecture project which is wrapper around OAuthAuthorizationServerProvider. Am I right? I belive you want to validate credentials. In your case you can override GrantResourceOwnerCredentials.

    public override async Task GrantResourceOwnerCredentials(OAuthGrantResourceOwnerCredentialsContext context)
    {
        // validate user credentials (demo!)
        // user credentials should be stored securely (salted, iterated, hashed yada)
        if (context.UserName != context.Password)
        {
            context.Rejected();
            return;
        }
        context.Validated();
    }

Best will be if you look at Thinktecture examples.