Non-interactive login inside WebService

Question

ASP.NET application interoperates with another service with access token. That token we retrieve from login screen.

The problem is that some web service operations (in ASP.NET) have to use special user whose credentials we read from config.

I'm looking for a silent way to get access token for this user, but I am new to IDP stuff and can't seem to figure out url parameters for that.

I set prompt=none. I also don't think I need returnUrl, but Idp service isn't happy when ommiting returnUrl parameter.

var authorizeBehindTheSceneUrl = https://localhost/MyIdentityServer/connect/authorize?client_id=MyAppId&response_type=id_token+token&scope=openid+email&redirect_uri=http%3A%2F%2Flocalhost%2FsomeCallback.aspx&state=eyJVcmwiOiJodHR&nonce=3b119c54c48f9b8673&acr_values=idp%3A&prompt=none

And I would like to write something like:

using(var client = new WebClient())
{
  var response = client.DownloadString(authorizeBehindTheSceneUrl);
  
  // Do json parsing of response and retrieve clams
 }

From straightforward code above you can see that I don't expect any user interaction, redirection.

Could anyone propose url structure to achieve what I need? What parameter I should use to pass credentials? "state"?

Rob Davis Rob Davis · Accepted Answer · 2017-08-12T14:32:10

It sounds like you could potentially use the the Resource Owner Password Credentials Grant. However, you need to be careful with that approach as a client typically should not be collecting credentials itself.

However, you said "...have to use special user whose credentials we read from config". This makes me think that perhaps you should look into using the Client Credentials Grant. The difference here is that the client itself is the resource owner (not a user). Identity Server can authenticate these types of clients with shared keys or client certs. The Identity Server 3 repo has examples of clients that use this flow.

Here's a nice blog post from one of the Identity Server 3 authors that breaks down the different flows (and discusses client credentials): Which OpenID Connect/OAuth 2.0 Flow is the right One?

Non-interactive login inside WebService

1 Answers