I have a scenario where in I want to authorize my web api which is a part of different application.
Let say I have a Single Page application "A". Now "A" wants to call an api present in application "B" via ajax or angulars $http.
Now to do that, can I create a web api in application "A" which will return me the token for application "B" when called via ajax and save that token in browsers session storage.
Can i use this code in my application "A" web api to return me token
string authority = "https://adfs.corp.adfssample.com/adfs";
string resourceURI = "https://adfssample.com/OWIN-ADAL-ADFS-WebMVC";
string clientID = "82A2A9DE-131B-4837-8472-EDE0561A0EF6";
string clientReturnURI = "http://anarbitraryreturnuri/";
var ac = new AuthenticationContext(authority, false);
var ar = await ac.AcquireTokenAsync(resourceURI, clientID, new Uri(clientReturnURI), new AuthorizationParameters(PromptBehavior.Auto, new WindowInteropHelper(this).Handle));
string authHeader = ar.CreateAuthorizationHeader
And now every ajax call to Application "B" will have this token in header.
Related
Fundamentally all I need to do is grab a users profile photo after successful login (asp.net 4.8) since it doesn't seem that I can request the photo to come over with the login claims.
This is the callback handler
SecurityTokenValidatedNotification<Microsoft.IdentityModel.Protocols.OpenIdConnect.OpenIdConnectMessage, OpenIdConnectAuthenticationOptions> notification
This is how I get the Identity from that callback and it's all there looking good
var identity = notification.AuthenticationTicket.Identity;
So I'm trying to callback with RestSharp
var client = new RestSharp.RestClient("https://graph.microsoft.com");
var request = new RestSharp.RestRequest($"/v1.0/users/{email}/photo/$value", RestSharp.Method.GET);
var callbackResult = client.Execute(request);
Debugger.Break();
if (callbackResult.StatusCode == HttpStatusCode.OK)
{
Debugger.Break();
}
But it keeps (I suppose OBVIOUSLY) coming back as unauthorized. Is there some token or something I can use now that the user has authenticated to add a header or querystring or something that will just get me the extra data easily?
So my problem is little bit complicated.
Main goal: register account (class / table) that contains list of Players (class / table) from a web application into a SQL Server database through a WCF service.
So for creating the classes I used Linq-to-SQL which created the Account and Player class. The Player has a foreign key AccountEmail to the Account table. Due to that the class Account has EntitySet<Player> _Players;.
Now the web application has reference to this service and when user finish registration I am making an POST request with WebClient and DataContractJsonSerializer to the service .
Unfortunately the service or the http protocol cannot understand the request :
System.Net.WebException: The remote server returned an error: (400)
Full error response from server
https://s31.postimg.org/x6b27uqqj/errorrr.png
The fail is on service side for some reason it doesn't know how to read the json player DB.designer.cs:line 295 at ReadPlayerFromJson(XmlReaderDelegator
Service:
[OperationContract]
[WebInvoke(UriTemplate = "/Register",
RequestFormat = WebMessageFormat.Json,
ResponseFormat = WebMessageFormat.Json, Method = "POST")]
void RegisterAccount(Account account);
Client side :
DataContractJsonSerializer ser = new DataContractJsonSerializer(typeof(Account));
MemoryStream mem = new MemoryStream();
Account a = new Account { EMAIL = Email.Text, PASSWORD = Password.Text, NAME = nickname.Text};
a.Players = accountPLayers.ToArray();
ser.WriteObject(mem, a);
string data = Encoding.UTF8.GetString(mem.ToArray(), 0, (int)mem.Length);
WebClient webClient = new WebClient();
webClient.Headers["Content-type"] = "application/json";
webClient.Encoding = Encoding.UTF8;
webClient.UploadString(WEB_SITE_URL+ "/Register", "POST", data);
When sending Account without the list of players, the operation succeeds:
{"EMAIL":"test#gmail.com","NAME":"1","PASSWORD":"test","Players":null}
With the list of players the operation fails :
{"EMAIL":"test#gmail.com","NAME":"1","PASSWORD":"test","Players":[{"Account":null,"AccountEmail":"test#gmail.com","FirstName":"test","Id":0,"LastName":"test","Type":-1}]}
Questions:
I guess that REST service expecting to get only Account and doesn't know what is the list of players? I have to define that somehow.
Why in the service does the Account have EntitySet<Player> _Players;? And in the client after adding reference to service it is an array Player[] ?
Why does Linq-to-SQL add field Account to player? What should it contain? As you can see this field is null in the json.
Is complex object/known types has to do something with my problem ?
Please help me to solve this issue, thanks!
Solved !!!
So if any one ever will get this problem ,
The thing is that player has foreign key of EMAIL column to Account Email .
When you create your JSON DO NOT PUT EMAIL INSIDE EACH PLAYER
LINQTOSQL knows the association and will add it automatically when parsing the JSON .
So my JSON Sent to the service looks like this :
{"EMAIL":"test#gmail.com","NAME":"test","PASSWORD":"test#A","Players":[{"Account":null,"AccountEmail":null,"FirstName":"wow","Id":0,"LastName":"koko","Type":null}]}.
While I'm logged into a web application 1, I would like to navigate to web application 2 without explicitly logging on manually.
In application 1 I have an OnClick that gathers up my current login credentials and attempts to POST them to applications 2:
long timestamp = DateTime.Now.Ticks;
string userName = currentUser.Credentials.UserName;
string accountName = currentUser.Account.Name;
string ssoUrl = AppUtil.SalesViewSsoUrl;
var ssoKey = new Guid(AppUtil.SalesViewHashKey);
// Build request
System.Net.WebRequest request = System.Net.WebRequest.Create(ssoUrl);
string postData = BuildPostString(userName, accountName, timestamp.ToString("x"), ssoKey);
byte[] postDataBytes = Encoding.Default.GetBytes(postData);
//Request.Headers.Add("SSOParams", postData);
//request.Method = "POST";
//request.ContentType = "application/x-www-form-urlencoded";
//request.ContentLength = postDataBytes.Length;/
//Stream sOut = request.GetRequestStream();
//sOut.Write(postDataBytes, 0, postDataBytes.Length);
//sOut.Flush();
//sOut.Close();
So, the problem here is that I remain on the same page. I can't figure out how to do that basic operation but stay on the newly logged-in application 2 page.
Is there any other way to send those parameters over without putting them in a query string? I want to avoid that.
Any assistance is appreciated.
To my knowledge you should use ASP.NET Web Config tool. You can also handcraft your code. This website has lots of tutorials on ASP.NET. It has some videos about the Authentication and Authorization, etc. in the Advanced ASP.NET section. Manzoor the trainer
I'm using the Facebook C# SDK and am trying to figure out exactly how it works. I actually use an AJAX web method to lookup the Facebook account details based on the authenticated user ID, which looks something like this:
if (response.status === "connected")
{
KitchenPC.LogonFB(response.authResponse.userID, checkResult, facebookError);
}
On the server side, the LogonFB web method does something like:
Client = new FacebookClient(applicationId, applicationSecret);
var result = Client.Get(path) as IDictionary<string, object>;
UserId = Int64.Parse((String)result["id"]);
Name = result["name"] as String;
FirstName = result["first_name"] as String;
LastName = result["last_name"] as String;
Location = result.ContainsKey("location") ? result["location"] as String : "";
Gender = result.ContainsKey("gender") ? result["gender"] as String : "";
Email = result["email"] as String;
Where path is the user ID passed in from the client.
My Question:
I'm switching from ASP.NET Web Service to WCF, and WCF does not support cookies. In fact, HttpContext.Current will be null within the WCF pipeline. I was under the impression that the Facebook C# SDK depended on the fbm_ and fmsr_ cookies being passed in on the request, which would be used to validate the session with the Facebook server. However, much to my surprise, the .Get() call still works, and user information is returned. I also dug through the SDK source code and nowhere in it do I find references to HttpContext.Current.
Does the Facebook C# SDK work completely independently of cookies? Does this mean that all I need is the user's Facebook ID, and as long as they've previously approved my app ID, I can grab information about their account?
I just want to make sure I'm not doing anything wrong, and I'm not going to run into trouble in production.
When you pass the constructor with appId and appSecret, it will auto set the access token as app access token using string.Concat(appId, '|', appSecret). That constructor has been removed in newer version of the sdk. https://github.com/facebook-csharp-sdk/facebook-csharp-sdk/issues/103
Set it to null if you don't want the access token.
Client = new FacebookClient(applicationId, applicationSecret);
Client.AccessToken = null;
var result = Client.Get(path) as IDictionary<string, object>;
In my ASP.NET application I am implementing Google Document List API, to fetch User data I using OAuth2 to do so I did some code:
string CLIENT_ID = "123456789321.apps.googleusercontent.com";
string CLIENT_SECRET = "xxxxxxxxxxxxxxxxxxxxxxxx";
string SCOPE = "https://docs.google.com/feeds/ https://docs.googleusercontent.com/ https://spreadsheets.google.com/feeds/";
string REDIRECT_URI = "urn:ietf:wg:oauth:2.0:oob";
parameters = new OAuth2Parameters();
parameters.ClientId = CLIENT_ID;
parameters.ClientSecret = CLIENT_SECRET;
parameters.RedirectUri = REDIRECT_URI;
parameters.Scope = SCOPE;
parameters.AccessCode = Convert.ToString(HttpContext.Current.Session["AccessCode"]);
OAuthUtil.GetAccessToken(parameters);
settings = new RequestSettings("My Application", parameters);
Every time OAuthUtil.GetAccessToken(parameters); gives error that is:
Can any one tell me where I am doing mistake?
Also, how to access RefreshToken??
You are using the redirect URI for installed in a web application.
I'd recommend you to update your code to use the newer Drive API, which also includes a complete ASP.NET sample application and tutorial:
https://developers.google.com/drive/examples/dotnet