Hi matt have you seen the thread I had with John. We both had the idea of using identity server to do what you are describing. I posted some code which used the umbraco user manager as backing for the authentication.

See here if its any help to you https://our.umbraco.org/forum/developers/extending-umbraco/74636-use-identityserver-with-user-membership

I was using an authentication code flow with refresh tokens to provide long lived access but it also works with implicit flow if thats more appropriate.

Not sure which OAuth version you're looking for. When following the OAuth 2.0 specification, a user must specify an access token.

In the very small example below, my OAuthAttribute class will validate the access token, and find the member behind the access token. Given that this is just an example, the access token is simply validated against a small switch statement.

In a real scenario, you should obviously have some way of generating and storing the access tokens for each member, and possibly also log the member in for that particular request.

using System.Web;
using System.Web.Http;
using System.Web.Http.Controllers;
using Umbraco.Web.WebApi;

[OAuthAuthorizeAttribute]
public class OAuthApiController : UmbracoApiController {

    // Just a "dummy" class that you should inherit from

}

public class OAuthAuthorizeAttribute : AuthorizeAttribute {

    protected override bool IsAuthorized(HttpActionContext actionContext) {

        string accessToken = HttpContext.Current.Request.QueryString["access_token"];

        int memberId = 0;
        switch (accessToken) {
            case "let me in": memberId = 1096; break;
            case "come on": memberId = 1097; break;
            case "i have cookies": memberId = 1098; break;
        }

        return memberId > 0;

    }

}

OAuth 1.0a involves a lot more security, but that should be possible as well.

So I have managed to get this working based on the suggestions from Shan. Right now it's just a POC so not very friendly to share, but if I can tidy things up, I'll post on here.

Needless to say, if you do follow Shans guidelines, you should be able to get it working. It's just a steep learning curve if you don't know what you are doing (like me).

I'd also like to to see any code. I've got all the token server and token auth working but only for the back office on the end point /umbraco/oauth/token.

I can not get the backoffice to create a token if i change the token end point in UseUmbracoBackOfficeTokenAuth method so i am not sure how this gets invoked.

I've also copied the UseUmbracoBackOfficeTokenAuth and created a new method UseUmbracoMemberTokenAuth with a MemberAuthServerProvider which uses: UmbracoMembersUserManager

So any pointers would be much appreciated.

I should add this is version 7.5.2

cheers,

mark

I would be keen on some sample code as well. I have followed Shan's instructions. But I am getting a error in the AuthServerprovider.

I changed BackOfficeAuthServerProvider in the GrantResourceOwnerCredentials to

var userManager = context.OwinContext.GetUserManager<UmbracoMembersUserManager<UmbracoApplicationMember>>()`;

But it is returning a null. as userManager.

I worked out the issue. Here is what I my MembersAuthServerprovider has ended up as

  public class MembersAuthServerProvider : OAuthAuthorizationServerProvider
{
    private readonly MembersAuthServerProviderOptions _options;

    public MembersAuthServerProvider(MembersAuthServerProviderOptions options = null)
    {
        if (options == null)
            options = new MembersAuthServerProviderOptions();
        _options = options;
    }

    /// <summary>
    /// Called at the final stage of a successful Token endpoint request. An application may implement this call in order to do any final 
    ///             modification of the claims being used to issue access or refresh tokens. This call may also be used in order to add additional 
    ///             response parameters to the Token endpoint's json response body.
    /// </summary>
    /// <param name="context">The context of the event carries information in and results out.</param>
    /// <returns>
    /// Task to enable asynchronous execution
    /// </returns>        
    public override Task ValidateTokenRequest(OAuthValidateTokenRequestContext context)
    {
        ProcessCors(context);

        return base.ValidateTokenRequest(context);
    }

    public override async Task GrantResourceOwnerCredentials(OAuthGrantResourceOwnerCredentialsContext context)
    {
        var userManager = context.OwinContext
                .GetUserManager<UmbracoMembersUserManager<UmbracoApplicationMember>>();

        var user = await userManager.FindAsync(context.UserName, context.Password);

        if (user == null)
        {
            context.SetError("invalid_grant", "The user name or password is incorrect.");
            return;
        }

        ClaimsIdentity oAuthIdentity = await userManager.ClaimsIdentityFactory.CreateAsync(userManager, user, OAuthDefaults.AuthenticationType);
        ClaimsIdentity cookiesIdentity = await userManager.ClaimsIdentityFactory.CreateAsync(userManager, user, CookieAuthenticationDefaults.AuthenticationType); 



        AuthenticationProperties properties = CreateProperties(user.UserName, 1).ToString());
        AuthenticationTicket ticket = new AuthenticationTicket(oAuthIdentity, properties);
        context.Validated(ticket);
        context.Request.Context.Authentication.SignIn(cookiesIdentity);

    }

    public override Task TokenEndpoint(OAuthTokenEndpointContext context)
    {
        foreach (KeyValuePair<string, string> property in context.Properties.Dictionary)
        {
            context.AdditionalResponseParameters.Add(property.Key, property.Value);
        }

        return Task.FromResult<object>(null);
    }

    public static AuthenticationProperties CreateProperties(string userName, string id)
    {
        IDictionary<string, string> data = new Dictionary<string, string>
        {
            { "userName", userName },
             { "id", id}
        };
        return new AuthenticationProperties(data);
    }

    private void ProcessCors(OAuthValidateTokenRequestContext context)
    {
        var accessControlRequestMethodHeaders = context.Request.Headers.GetCommaSeparatedValues(CorsConstants.AccessControlRequestMethod);
        var originHeaders = context.Request.Headers.GetCommaSeparatedValues(CorsConstants.Origin);
        var accessControlRequestHeaders = context.Request.Headers.GetCommaSeparatedValues(CorsConstants.AccessControlRequestMethod);
        var corsRequest = new CorsRequestContext
        {
            Host = context.Request.Host.Value,
            HttpMethod = context.Request.Method,
            Origin = originHeaders == null ? null : originHeaders.FirstOrDefault(),
            RequestUri = context.Request.Uri,
            AccessControlRequestMethod = accessControlRequestMethodHeaders == null ? null : accessControlRequestMethodHeaders.FirstOrDefault()
        };
        if (accessControlRequestHeaders != null)
        {
            foreach (var header in context.Request.Headers.GetCommaSeparatedValues(CorsConstants.AccessControlRequestMethod))
            {
                corsRequest.AccessControlRequestHeaders.Add(header);
            }
        }

        var engine = new CorsEngine();

        if (corsRequest.IsPreflight)
        {
            try
            {
                // Make sure Access-Control-Request-Method is valid.
                // ReSharper disable once UnusedVariable
                var test = new HttpMethod(corsRequest.AccessControlRequestMethod);
            }
            catch (ArgumentException)
            {
                context.Response.StatusCode = (int)HttpStatusCode.BadRequest;
                context.SetError("Access Control Request Method Cannot Be Null Or Empty");
                //context.RequestCompleted();
                return;
            }
            catch (FormatException)
            {
                context.Response.StatusCode = (int)HttpStatusCode.BadRequest;
                context.SetError("Invalid Access Control Request Method");
                //context.RequestCompleted();
                return;
            }

            var result = engine.EvaluatePolicy(corsRequest, _options.CorsPolicy);

            if (!result.IsValid)
            {
                context.Response.StatusCode = (int)HttpStatusCode.BadRequest;
                context.SetError(string.Join(" | ", result.ErrorMessages));
                //context.RequestCompleted();
                return;                    
            }

            WriteCorsHeaders(result, context);
        }
        else
        {
            var result = engine.EvaluatePolicy(corsRequest, _options.CorsPolicy);

            if (result.IsValid)
            {
                WriteCorsHeaders(result, context);                    
            }
        }
    }

    private void WriteCorsHeaders(CorsResult result, OAuthValidateTokenRequestContext context)
    {
        var headers = result.ToResponseHeaders();

        if (headers != null)
        {
            foreach (var header in headers)
            {
                context.Response.Headers.Append(header.Key, header.Value);
            }
        }
    }
}

Hi, I've to do the same thing. Do it work?

So, you installed:

• Umbracoidentity
• Umbracoidentityextension
• UmbracoRestApi

Here is a JWT implementation : https://creativewebspecialist.co.uk/2015/01/06/securing-umbraco-web-apis-using-json-web-tokens/

is working on a reply...