OAuth2建立webapi认证服务供自己的客户端使用--密码模式

场景：你自己实现了一套webApi，想供自己的客户端调用，又想做认证。

第一步：通过vs2015建立web api项目，Startup.cs,这个类将会作为Owin的启动类。

第二步：在webapi.config中添加如下代码：

第三步：在web.config中添加连接字符串（这里使用了EF Code First）

第四步：添加上下文对象

第五步：添加AuthRepository类，增加用户注册和查找功能：

第六步：增加AccountController（

using Microsoft.AspNet.Identity;

using Owin2.Auth;

using Owin2.Entitys;

using System;

using System.Collections.Generic;

using System.Linq;

using System.Net;

using System.Net.Http;

using System.Threading.Tasks;

using System.Web.Http;

namespace Owin2.Controllers

{

    [RoutePrefix("api/Account")]

    public class AccountController : ApiController

    {

        private readonly AuthRepository _authRepository = null;

        public AccountController()

        {

            _authRepository = new AuthRepository();

        }

        // POST api/Account/Register Register方法打上了AllowAnonymous标签，意味着调用这个api无需任何授权。

        [AllowAnonymous]

        [Route("Register")]

        public async Task<IHttpActionResult> Register(UserModel userModel)

        {

            if (!ModelState.IsValid)

            {

                return BadRequest(ModelState);

            }

            IdentityResult result = await _authRepository.RegisterUser(userModel);

            IHttpActionResult errorResult = GetErrorResult(result);

            if (errorResult != null)

            {

                return errorResult;

            }

            return Ok();

        }

        protected override void Dispose(bool disposing)

        {

            if (disposing)

            {

                _authRepository.Dispose();

            }

            base.Dispose(disposing);

        }

        private IHttpActionResult GetErrorResult(IdentityResult result)

        {

            if (result == null)

            {

                return InternalServerError();

            }

            if (!result.Succeeded)

            {

                if (result.Errors != null)

                {

                    foreach (string error in result.Errors)

                    {

                        ModelState.AddModelError("", error);

                    }

                }

                if (ModelState.IsValid)

                {

                    //  No ModelState errors are available to send, so just return an empty BadRequest.

                    return BadRequest();

                }

                return BadRequest(ModelState);

            }

            return null;

        }

    }

}

认证策略的类：

using Microsoft.AspNet.Identity.EntityFramework;

using Microsoft.Owin.Security;

using Microsoft.Owin.Security.OAuth;

using System;

using System.Collections.Generic;

using System.Linq;

using System.Security.Claims;

using System.Threading.Tasks;

using System.Web;

namespace Owin2.Auth

{

    public class SimpleAuthorizationServerProvider: OAuthAuthorizationServerProvider

    {

        /// <summary>

        /// ValidateClientAuthentication方法用来对third party application 认证，

        /// 具体的做法是为third party application颁发appKey和appSecrect，

        /// 在本例中我们省略了颁发appKey和appSecrect的环节，

        /// 我们认为所有的third party application都是合法的，context.Validated();

        /// 表示所有允许此third party application请求。

        /// </summary>

        /// <param name="context"></param>

        /// <returns></returns>

        public override Task ValidateClientAuthentication(OAuthValidateClientAuthenticationContext context)

        {

            context.Validated();

            return Task.FromResult<object>(null);

        }

        /// <summary>

        /// GrantResourceOwnerCredentials方法则

        /// 是resource owner password credentials模式的重点

        /// 由于客户端发送了用户的用户名和密码，

        /// 所以我们在这里验证用户名和密码是否正确，

        /// 后面的代码采用了ClaimsIdentity认证方式，

        /// 其实我们可以把他当作一个NameValueCollection看待。

        /// 最后context.Validated(ticket); 表明认证通过

        /// </summary>

        /// <param name="context"></param>

        /// <returns></returns>

        public override async Task GrantResourceOwnerCredentials(OAuthGrantResourceOwnerCredentialsContext context)

        {

            using (AuthRepository _repo = new AuthRepository())

            {

                IdentityUser user = await _repo.FindUser(context.UserName, context.Password);

                if (user == null)

                {

                    context.SetError("invalid_grant", "The  user name or password is incorrect.");

                    return;

                }

            }

            var identity  = new ClaimsIdentity(context.Options.AuthenticationType);

            identity.AddClaim(new Claim(ClaimTypes.Name, context.UserName));

            identity.AddClaim(new Claim(ClaimTypes.Role, "user"));

            identity.AddClaim(new Claim("sub", context.UserName));

            var props = new AuthenticationProperties(new Dictionary<string, string>

                {

                {

                    "as:client_id",context.ClientId ?? string.Empty

                },

                {

                    "userName",context.UserName

                }

                });

            var ticket = new AuthenticationTicket(identity, props);

            context.Validated(ticket);

        }

        /// <summary>

        /// TokenEndpoint方法将会把Context中的属性加入到token中。

        /// </summary>

        /// <param name="context"></param>

        /// <returns></returns>

        public override Task TokenEndpoint(OAuthTokenEndpointContext context)

        {

            foreach (KeyValuePair<string, string> property in context.Properties.Dictionary)

            {

                context.AdditionalResponseParameters.Add(property.Key, property.Value);

            }

            return Task.FromResult<object>(null);

        }

}

}