此请求被拒绝获得授权

Question

I have configured my Web API 2 project to work with OAuth using OWIN

    public class Startup
    {
        public void Configuration(IAppBuilder app)
        {
            ConfigureOAuth(app);

            HttpConfiguration config = new HttpConfiguration();
            WebApiConfig.Register(config);
            app.UseWebApi(config);
        }

        public void ConfigureOAuth(IAppBuilder app)
        {

            OAuthAuthorizationServerOptions OAuthServerOptions = new OAuthAuthorizationServerOptions()
            {

                AllowInsecureHttp = true,
                TokenEndpointPath = new PathString("/token"),
                AccessTokenExpireTimeSpan = TimeSpan.FromDays(1),
                Provider = new MyAuthorizationServerProvider()
            };

            // Token Generation
            app.UseOAuthAuthorizationServer(OAuthServerOptions);

            app.UseOAuthBearerAuthentication(new OAuthBearerAuthenticationOptions());

        }

    }

The implementation of MyAuthorizationServerProvider:

public class MyAuthorizationServerProvider : OAuthAuthorizationServerProvider
{
    public override async Task ValidateClientAuthentication(OAuthValidateClientAuthenticationContext context)
    {
        context.Validated();
    }

    public override async Task GrantResourceOwnerCredentials(OAuthGrantResourceOwnerCredentialsContext context)
    {
        var repo = new AuthRepository();
        context.OwinContext.Response.Headers.Add("Access-Control-Allow-Origin", new[] { "*" });

        var user = repo.ValidateUserCredentials(context.UserName, context.Password);

        if (user == null)
        {
            context.SetError("invalid_grant", "The user name or password is incorrect.");
            return;
        }

        var identity = new ClaimsIdentity(context.Options.AuthenticationType);
        identity.AddClaim(new Claim("sub", context.UserName));
        identity.AddClaim(new Claim("role", "user"));

        context.Validated(identity);
    }
}

I am able to get a Token.. then i send it to a controller decorated with [Authorized] and still getting

{
  "message": "Authorization has been denied for this request."
}

The request headers with token here:

Content-Type:application/json
Authorization:Bearer m6ukGHOmp_MgM6rsb70n8Rd_BlBEXbgyPNr5ZNzGzkm__7zdntVPYAMAhFPXVdw1S6-ohv960c6mzMMwkY0G_AL-2uIq2aOjkoojxDPKuITuml8sgC4ng0KC2AqUFrBBEn0eCsSAnc3UK_jyKSB59Ao_eL9JPoJHoJHP-xBs42KGAGl4iKdYtzdfg2zY0Ucif_IpPH3Gbvs6iyLVMf0jlKgj4EOBtrDHanikeqkWc0W2pWjIIac8cyUrOtZCj7h3

What am I doing wrong here ?

Also .. wonder.. where is the token stored ? how can Web API validate the the received token is attached to the user in question ?

Am I missing a custom implementation of some token store class ? if so where can I find information on how to implement a custom token store ?

Answer 1

The token is not stored anywhere, it's just an encoded bit of data and you can extract the info from it when you receive it on the other side.

The validation happens inside the ValidateClientAuthentication method. You've just set the context to authenticated with no checks at all. This is where you check the ClientID / Client Secret combination is correct, the name indicates that as well. You can add extra stuff in there.

I personally don't use OAuth2 for user level authentication but nothing stops you from doing that if that's what you need. I prefer to keep the token application related, not user related, but that's just my preference.

GrantResourceOwnerCredentials sets a context error on invalid_grant? The grant has nothing to do with the username / password you're trying to pass through. You only set the grant_type when you request the token and it's usually of type password. invalid_grant means you're trying a different grant type and that's not clear from your code at all.

You also haven't shown us your token format class, how you create it, what info you put in it, etc.

Also, one thing I've noticed you're using both

UseOAuthBearerAuthentication - with empty options and also UseOAuthAuthorizationServer.

The last one should be enough I would think. I've used JWT when using OAuth2 but it doesn't look like you're actually using it. The code looks a bit all over the place to be honest.

I wonder if you'd mind creating a repo with just enough code to replicate the issue.

I will try to have a look tonight, see if I can replicate the issue. You're welcome to hit me up on Twitter later on today.