Using both OAuth and Basic Auth in Asp.Net Web Api with Owin

Question

I've implemented OAuth authentication in my Web Api project based on these blog posts

It works well, including the refresh token logic.

I want to add an option for basic authentication as well for a couple of calls for scheduled jobs.

I've tried adding a Basic Auth solution as middleware but I'm still getting 401 asking for the Bearer token.

I can get it to work by removing the [Authorize] attribute from those api calls and checking manually in code if the user is authenticated but seems like the wrong way to solve it.

Is there a way to support both Basic Auth and OAuth authentication using OWin?

Taiseer Joudeh Taiseer Joudeh · Accepted Answer · 2015-02-09T09:07:39

How about you attribute your actions or controller with you want to implement Basic authentication with the attribute [OverrideAuthentication] Then you create custom authentication filter attribute which inherits from Attribute, IAuthenticationFilter as the code below

public class BasicAuthenticationAttribute : Attribute, IAuthenticationFilter
{
    public Task AuthenticateAsync(HttpAuthenticationContext context, CancellationToken cancellationToken)
    {
        var req = context.Request;
        // Get credential from the Authorization header 
        //(if present) and authenticate
        if (req.Headers.Authorization != null && "basic".Equals(req.Headers.Authorization.Scheme, StringComparison.OrdinalIgnoreCase))
        {
            var rawCreds = req.Headers.Authorization.Parameter;

            var credArray = GetCredentials(rawCreds);

            var clientId = credArray[0];
            var secret = credArray[1];

            if (ValidCredentials(clientId, secret))
            {
                var claims = new List<Claim>()
                      {
                        new Claim(ClaimTypes.Name, clientId)
                      };

                var identity = new ClaimsIdentity(claims, "Basic");
                var principal = new ClaimsPrincipal(new[] { identity });
                // The request message contains valid credential
                context.Principal = principal;
            }
            else
            {
                context.ErrorResult = new UnauthorizedResult(new AuthenticationHeaderValue[0], context.Request);
            }

        }
        else
        {
            context.ErrorResult = new UnauthorizedResult(new AuthenticationHeaderValue[0], context.Request);
        }

        return Task.FromResult(0);
    }

    private string[] GetCredentials(string rawCred)
    {

        var encoding = Encoding.GetEncoding("UTF-8");

        var cred = encoding.GetString(Convert.FromBase64String(rawCred));

        var credArray = cred.Split(':');

        if (credArray.Length == 2)
        {
            return credArray;
        }
        else
        {
            return credArray = ":".Split(':');
        }

    }

    private bool ValidCredentials(string clientId, string secret)
    {

        //compare the values from web.config

        if (clientId == secret)
        {
            return true;
        }
        return false;
    }

    public Task ChallengeAsync(HttpAuthenticationChallengeContext context,CancellationToken cancellationToken)
    {
        context.Result = new ResultWithChallenge(context.Result);
        return Task.FromResult(0);
    }

    public class ResultWithChallenge : IHttpActionResult
    {
        private readonly IHttpActionResult next;
        public ResultWithChallenge(IHttpActionResult next)
        {
            this.next = next;
        }
        public async Task<HttpResponseMessage> ExecuteAsync( CancellationToken cancellationToken)
        {
            var response = await next.ExecuteAsync(cancellationToken);
            if (response.StatusCode == HttpStatusCode.Unauthorized)
            {
                response.Headers.WwwAuthenticate.Add(new AuthenticationHeaderValue("Basic"));
            }
            return response;
        }
    }

    public bool AllowMultiple
    {
        get { return false; }
    }
}

Now you use it to attribute you controllers or actions as the code below:

 [OverrideAuthentication]
    [BasicAuthentication]
    [Route("")]
    public async Task<IHttpActionResult> Get()
{
}

Notice how we are creating claims identity and setting the Authentication scheme to Basic, you can put any claims you want here.

Using both OAuth and Basic Auth in Asp.Net Web Api with Owin

1 Answers