1

I've been trying to get the GetClientAccessToken flow to work with the latest release 4.1.0 (via nuget), where I'm in control of all three parties: client, authorization server and resource server.

The situation I have started to prototype is that of a Windows client app (my client - eventually it will be WinRT but its just a seperate MVC 4 app right now to keep it simple), and a set of resources in a WebAPI project. I'm exposing a partial authorization server as a controller in the same WebAPI project right now.

Every time (and it seems regardless of the client type e.g. UserAgentClient or WebServerClient) I try GetClientAccessToken, by the time the request makes it to the auth server there is no clientIdentifier as part of the request, and so the request fails with:

2012-10-15 13:40:16,333 [41   ] INFO   {Channel} Prepared outgoing AccessTokenFailedResponse (2.0) message for <response>: 
error: invalid_client
error_description: The client secret was incorrect.

I've debugged through the source into DNOA and essentially the credentials I'm establishing on the client are getting wiped out by NetworkCredential.ApplyClientCredential inside ClientBase.RequestAccessToken. If I modify clientIdentifier to something reasonable, I can track through the rest of my code and see the correct lookups/checks being made, so I'm fairly confident the auth server code is ok.

My test client currently looks like this:

public class AuthTestController : Controller
{
    public static AuthorizationServerDescription AuthenticationServerDescription
    {
        get
        {
            return new AuthorizationServerDescription()
            {
                TokenEndpoint = new Uri("http://api.leave-now.com/OAuth/Token"),
                AuthorizationEndpoint = new Uri("http://api.leave-now.com/OAuth/Authorise")
            };
        }
    }

    public async Task<ActionResult> Index()
    {
        var wsclient = new WebServerClient(AuthenticationServerDescription, "KieranBenton.LeaveNow.Metro", "testsecret");

        var appclient = new DotNetOpenAuth.OAuth2.UserAgentClient(AuthenticationServerDescription, "KieranBenton.LeaveNow.Metro", "testsecret");
        var cat = appclient.GetClientAccessToken(new[] { "https://api.leave-now.com/journeys/" }); 

        // Acting as the Leave Now client we have access to the users credentials anyway
        // TODO: CANNOT do this without SSL (turn off the bits in web.config on BOTH sides)
        /*var state = client.ExchangeUserCredentialForToken("kieranbenton", "password", new[] { "https://api.leave-now.com/journeys/" });

        // Attempt to talk to the APIs WITH the access token
        var resourceclient = new OAuthHttpClient(state.AccessToken);
        var response = await resourceclient.GetAsync("https://api.leave-now.com/journeys/");
        string sresponse = await response.Content.ReadAsStringAsync();*/

        // A wrong one
        /*var wresourceclient = new OAuthHttpClient("blah blah");
        var wresponse = await wresourceclient.GetAsync("https://api.leave-now.com/journeys/");
        string wsresponse = await wresponse.Content.ReadAsStringAsync();

        // And none
        var nresourceclient = new HttpClient();
        var nresponse = await nresourceclient.GetAsync("https://api.leave-now.com/journeys/");
        string nsresponse = await nresponse.Content.ReadAsStringAsync();*/

        return Content("");
    }
}

I can't figure out how to prevent this or if its by design what I'm doing incorrectly.

Any help appreciated.

1 Answer 1

2

The NetworkCredentialApplicator clears the client_id and secret from the outgoing message as you see, but it applies it as an HTTP Authorization header. However, HttpWebRequest clears that header on the way out, and only restores its value if the server responds with an HTTP error and a WWW-Authenticate header. It's quite bizarre behavior on .NET's part, if you ask me, to suppress the credential on the first outbound request.

So if the response from the auth server is correct (at least, what the .NET client is expecting) then the request will go out twice, and work the second time. Otherwise, you might try using the PostParameterApplicator instead.

4
  • Thanks Andrew - how odd! Have you got an example of how to use PostParameterApplicator instead? I'm not sure I understand how to control that part of the behaviour of the clients. Oct 17, 2012 at 7:30
  • 1
    Scratch that, I figured out how to do it appclient.ClientCredentialApplicator = ClientCredentialApplicator.PostParameter("testsecret");. Thanks Andrew! Oct 17, 2012 at 7:52
  • Sorry Andrew - me again. Have you got any more pointers on how to get the NetworkCredentialApplicator working? From everything I've tried its not trapping the 401 and retrying. Oct 18, 2012 at 15:17
  • I don't know how to get the NetworkCredentialApplicator working for those folks who report it doesn't yet. I hope in a future version of DNOA that we can get it working more reliably. Oct 25, 2012 at 16:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.