实施外部认证的移动应用在ASP.NET的WebAPI 2 [英] Implementing External Authentication for Mobile App in ASP.NET WebApi 2

问题描述

我试图建立一个由一所学校项目中的原生移动应用所消耗的API（使用ASP.NET的WebAPI）。 （我不关心/开发移动应用程序，这个责任落在不同的成员）
我在一个点，我需要实现基于Facebook登录的令牌。有很多关于如何实现这一功能的基于浏览器的应用程序提供教程（这是非常简单的，大部分涉及内置），但我不认为我跟着怎么这将与本地应用程序的工作。我不明白的是重定向是如何工作的？

I'm trying to build an API (using ASP.NET WebApi) that will be consumed by a native mobile app for a school project. (I'm not concerned about/developing the mobile app, this responsibility falls on a different member) I'm at a point where I need to implement a token based Facebook login. There are a lot of tutorials available for how to implement this feature for browser based apps (this is pretty straight forward and most of it comes inbuilt), but I don't think I follow how this would work with native apps. What I don't understand is how the redirects would work?

根据这个的链接，没有什么需要由我的服务器专门处理。而且我不认为我了解这会工作？将如何从Facebook的令牌如何处理？

According to this link, nothing needs to be handled specifically by my server. And I don't think I understand how this would work? How would the tokens from Facebook be handled?

另外，我应该执行什么样的道理处理的一部分，我真的无法找到的WebAPI外部登录验证好的文档。

Also, what part of token handling should I implement, I couldn't really find good documentation for WebApi external login authentication.

无论如何，如果有人可以点我的这种情况发生的，什么是由ASP.NET默认情况下实现的令牌交换的准确流动，这将是超级有帮助的。

Anyway, if someone could point me to the exact flow of token exchanges that happen and what is implemented by default by ASP.NET, that would be super helpful.

此外，混乱对我最大的问题是我不明白怎么被Facebook返回的令牌将被处理。

Also, the biggest point of confusion for me is I don't understand how the token returned by Facebook will be handled.

1. 我假设令牌将被返回给客户端（手机应用程序），我如何才能访问它我的服务器上？


2. 如何创建Facebook的令牌本地令牌？
   是这一切由ASP.NET在内部完成/自动神奇？

的我很抱歉，如果这是我应该已经能够弄清楚。我也做了相当多的研究，我发现自己在（与&安培;无关）溺水的信息。我不认为我知道如何寻找我需要的信息的

某些链接我读过：

索赔和基于令牌身份验证（的ASP.NET Web API）

的使用的ASP.NET Web API基于2令牌认证，Owin和身份

的的ASP.NET Web API 2 Facebook和谷歌外部登录在AngularJS应用

推荐答案

我不得不做的漂亮多的我工作的一个应用程序同样的事情。我也有很多很难找到关于它的信息。这似乎是一切，我发现接近我所需要的，但不能完全解决方案。我结束了拍摄的点点滴滴从一堆不同的博客文章，文章等，并把它们放在一起，以得到它的工作。

I had to do pretty much the same thing for an application I was working on. I also had a lot of trouble finding information about it. It seemed like everything I found was close to what I needed, but not exactly the solution. I ended up taking bits and pieces from a bunch of different blog posts, articles, etc. and putting them all together to get it to work.

我记得两个你的链接贴有索赔和基于令牌认证和的ASP.NET Web API 2 Facebook和谷歌在AngularJS应用外部登录作为是那些有有用的信息。

I remember two of the links you posted "Claims and Token Based Authentication" and "ASP.NET Web API 2 external logins with Facebook and Google in AngularJS app" as being ones that had useful information.

我不能给你一个全面的答案，因为我不记得所有的事情我不得不这样做，也没有我甚至明白了一切我当时做的，但我可以给你的总体思路。你是在正确的轨道上。

I can't give you a comprehensive answer since I don't remember everything I had to do, nor did I even understand everything I was doing at the time, but I can give you the general idea. You are on the right track.

基本上我结束了使用被Facebook所授予的令牌，以确认他们登录到他们的Facebook账户，根据他们在Facebook创建了一个用户。用户ID，并授予他们自己承载的令牌，他们可以用它来访问我的API

Essentially I ended up using the token granted by Facebook to confirm that they were logged into their Facebook account, created a user based on their Facebook user ID, and granted them my own bearer token that they could use to access my API.

流程看起来是这样的：

1. 客户与Facebook通过任何方法进行验证（我们使用 oauth.io ）
   
   
   
   
   • 的Facebook返回它们的标记
   
   

• 令牌使用Facebook的图形API，它返回用户信息


• 的用户在创建验证通过ASP.NET身份数据库与他们的Facebook用户ID作为关键

• 令牌使用Facebook的图形API，它返回用户信息


• 验证用户信息被用于查找在数据库中的用户，确认他们以前注册


• ASP.NET身份被用来产生针对该用户


• 新令牌即令牌返回到客户端

• The token is validated using Facebook's Graph API, which returns user info
• The user info is used to look up the user in the database, confirm they have previously registered
• ASP.NET Identity is used to generate a new token for that user
• That token is returned to the client

• 如果该端点的WebAPI有[授权]属性，ASP.NET身份将自动验证承载令牌，拒绝访问，如果它是无效

有最终被ASP.NET的身份实施的OAuth的东西很多自定义代码，而这些链接，您包括您展示一些的。希望这一信息将帮助你一点点，抱歉，我不能帮助更多。

There ended up being a lot of custom code for implementing the OAuth stuff with ASP.NET Identity, and those links you included show you some of that. Hopefully this information will help you a little bit, sorry I couldn't help more.

这篇关于实施外部认证的移动应用在ASP.NET的WebAPI 2的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！