Incremental Google OAuth with Asp.Net Owin Oauth - asp.net

Question

I'm looking for a solution to doing incremental authorization against Google's api's with Asp.Net's Owin OAuth Libraries.
I know how to set scope for specific api's, but I would like to do it incrementally and can only see how to set it on globally.
Doc on Google Oauth Incremental Auth...
https://developers.google.com/accounts/docs/OAuth2WebServer#incrementalAuth
Current VB Code...
Public Sub ConfigureAuth(app As IAppBuilder)
Dim googleCreds = New GoogleOAuth2AuthenticationOptions() With {
.ClientId = "xxxx",
.ClientSecret = "xxx"
}
googleCreds.Scope.Add("https://www.googleapis.com/auth/analytics.readonly")
app.UseGoogleAuthentication(googleCreds)
' Would like to add another way to specify GoogleDrive, YouTube, Google+ scopes
' Example code that doesn't work that would add a 2nd Google Oauth Listener
googleCreds.Scope.Clear()
googleCreds.Scope.Add("https://www.googleapis.com/auth/drive.file")
googleCreds.AuthenticationType = "GoogleDrive"
app.UseGoogleAuthentication(googleCreds)
End Class

Answer 1

Here is the solution I came up with. It involves passing a "scope" parameter in the url and then parsing that in the "OnApplyRedirect" function of the Authentication options and then manually injecting the correct scope url into the redirect url.
Dim googleCreds = New GoogleOAuth2AuthenticationOptions() With {
.ClientId = "xxx",
.ClientSecret = "xxx",
.Provider = New Microsoft.Owin.Security.Google.GoogleOAuth2AuthenticationProvider() With { _
.OnApplyRedirect = Function(context)
Dim queryString = HttpContext.Current.Request.QueryString.ToString()
Dim queryParms = HttpUtility.ParseQueryString(queryString)
' Change the value of "redirect" here
' e.g. append access_type=offline
Dim redirect As String = context.RedirectUri
redirect += "&access_type=offline"
redirect += "&approval_prompt=force"
redirect += "&include_granted_scopes=true"
Dim uri = New Uri(redirect)
If (Not String.IsNullOrEmpty(queryParms.Get("scope"))) Then
Dim scope = queryParms.Get("scope")
Dim redirectQueryString = HttpUtility.ParseQueryString(uri.Query)
Select Case scope
Case "Analytics"
redirectQueryString.Set("scope", "https://www.googleapis.com/auth/analytics.readonly")
Case "YoutTube"
redirectQueryString.Set("scope", "https://gdata.youtube.com")
Case "Drive"
redirectQueryString.Set("scope", "https://www.googleapis.com/auth/drive.file")
Case Else
LoggingUtility.LogErrorMessage("Invalid scope passed in: scope: " + scope)
End Select
redirect = uri.GetLeftPart(UriPartial.Path) + "?" + redirectQueryString.ToString()
End If
context.Response.Redirect(redirect)
End Function, _
}
}
'Google Analytics
app.UseGoogleAuthentication(googleCreds)

Answer 2

In OWIN version 3.1 incremental authentication works as expected. (It may well work in earlier versions, I've not tested that).
There were two tricks that were necessary to get this working:
OWIN expects a 401
If you try and call:
var ctx = HttpContext.Current.Request.GetOwinContext();
var properties = new AuthenticationProperties
{
RedirectUri = "/your/redirect",
};
ctx.Authentication.Challenge(properties, "Google");
While logged in to your application, the call to Google from the Middleware will not happen.
This can be confusing, since it just works, when using the exact same code during login.
The reason is that the Middleware only works when the current HTTP response is 401, so after the call above you need something like:
Page.Response.StatusCode = 401;
Page.Response.End();
Specification of scopes is picky
In my original code to try and call with a new scope, I had something like this:
var ctx = HttpContext.Current.Request.GetOwinContext();
var properties = new AuthenticationProperties
{
RedirectUri = redirect,
};
properties.Dictionary["scope"] ="https://www.googleapis.com/auth/calendar.readonly";
This was calling Google as expected and Goggle was correctly challenging based on the requested scopes, but then the response back to my server was breaking (never did find out where).
What I found I needed to do was to resend all my base scopes as well:
var scopes = new List<string>
{
"https://www.googleapis.com/auth/plus.me",
"https://www.googleapis.com/auth/userinfo.email",
"https://www.googleapis.com/auth/userinfo.profile",
};
if (additionalScopes != null)
{
scopes = scopes.Union(additionalScopes).ToList();
}
properties.Dictionary["scope"] = string.Join(" ", scopes);