如何以编程方式获取访问令牌？

Question

In my web api based project. I am using Token based authentication.

 public override async Task GrantResourceOwnerCredentials(OAuthGrantResourceOwnerCredentialsContext context)
    {
        var allowedOrigin = context.OwinContext.Get<string>("as:clientAllowedOrigin");

        if (allowedOrigin == null)
        {
            allowedOrigin = "*";
        }

        context.OwinContext.Response.Headers.Add("Access-Control-Allow-Origin", new[] { allowedOrigin });

        /* db based authenication*/
        var user = ValidateUser(context.UserName.Trim(), context.Password.Trim());
        if (user != null)
        {
            /* db based authenication*/
            var identity = new ClaimsIdentity(context.Options.AuthenticationType);
            identity.AddClaim(new Claim(ClaimTypes.Name, context.UserName));
            identity.AddClaim(new Claim(ClaimTypes.Role, "user"));
            identity.AddClaim(new Claim("sub", context.UserName));

            var props = new AuthenticationProperties(new Dictionary<string, string>
            {
                { 
                    "Status", "Success"
                },
                { 
                    "StatusCode", "200"
                },
                { 
                    "data", context.UserName.Trim()
                },
                { 
                    "message", "User valid"
                }
            });

            var ticket = new AuthenticationTicket(identity, props);
            //add token to header
            context.OwinContext.Response.Headers.Add("Authorization", new []{"Bearer " + ticket});
            context.Validated(ticket);
        }
        else
        {
            context.Rejected();
            //_reponse = _util.Create(0, HttpStatusCode.Forbidden, message: "User Invaid.", data: null);

        }


    }

If user credentials are valid, it returns the response as below:-

{"access_token":"-cmhkjwPvXieXEvs_TUsIHiMVdMAR4VxcvUK6XucNv3yx9PNVc4S8XtDdjEjc3cI8bU9EWhoXUI4g8I0qhcAh8WlgZKKJIXMZUhuJtUanUsOds_t-k0OoISIzb6zrk0XutfvCBkg7RMxrXBHWRO59PEJijDJd4JVmU-ekNeSalnVlC-k6CD4cOfRESBanDwSJJ9BU1PxIDqGGXHJtfIrlyruGn2ZuzqFstyCyfgdbJDekydj_RNnbO7lNAi0Xzw7bNItkBDNZ0yceWAFFzyKGAvm54Hemz7oEMcV0U0rlmE0LXM8O9D6GB8nT8rI9KOSjFKAoNOXgwB-L9nowmgqahRkc8DDwlsTUseM5tf-POBhcuMwBVatejtUJjfybqlt","token_type":"bearer","expires_in":1799,"Status":"Success","StatusCode":"200","data":"admin@website.com","message":"User valid"}

I tried to override this method as below

public override async Task<ResponseTO> GrantResourceOwnerCredentials(OAuthGrantResourceOwnerCredentialsContext context)
{
}

But this give me build error.

My requirement is if user is valid the response should be a JSON string as below.

{
  "Status", "Success",
   "message": "User is valid",
   "data" context.userName
}

Is user credentials are invalid.

 {
  "Status", "Error",
   "message": "User Invalid",
   "data" context.userName
}

I don't want to pass the token in the response body but add the token & its validity detail in the header for the subsequent requests.

Answer 1

Have you tried myabe to put return

Task.FromResult< ResponseTO >(new ResponseTO{ //your properties filled });

so something like:

 public override async Task GrantResourceOwnerCredentials(OAuthGrantResourceOwnerCredentialsContext context)
        {
            var allowedOrigin = context.OwinContext.Get<string>("as:clientAllowedOrigin");

            if (allowedOrigin == null)
            {
                allowedOrigin = "*";
            }

            context.OwinContext.Response.Headers.Add("Access-Control-Allow-Origin", new[] { allowedOrigin });

            /* db based authenication*/
            var user = ValidateUser(context.UserName.Trim(), context.Password.Trim());
            if (user != null)
            {
                /* db based authenication*/
                var identity = new ClaimsIdentity(context.Options.AuthenticationType);
                identity.AddClaim(new Claim(ClaimTypes.Name, context.UserName));
                identity.AddClaim(new Claim(ClaimTypes.Role, "user"));
                identity.AddClaim(new Claim("sub", context.UserName));

                var props = new AuthenticationProperties(new Dictionary<string, string>
                {
                    { 
                        "Status", "Success"
                    },
                    { 
                        "StatusCode", "200"
                    },
                    { 
                        "data", context.UserName.Trim()
                    },
                    { 
                        "message", "User valid"
                    }
                });

                var ticket = new AuthenticationTicket(identity, props);
                //add token to header

                context.Validated(ticket);
// TRY THIS
            context.Request.Context.Authentication.SignIn(identity);
            }
            else
            {
                context.Rejected();
                //_reponse = _util.Create(0, HttpStatusCode.Forbidden, message: "User Invaid.", data: null);

            }

//RETURN YOUR DTO
  context.Response.WriteAsync(JsonConvert.SerializeObject(new Responseto{ // propeties here}, new JsonSerializerSettings { Formatting = Formatting.Indented }));
        }