I am having an issue with the Google OAuth middleware.
Context: VS2013 Update 2, created brand new ASP.NET Web Project using MVC with Individual accounts.
This brought in the following versions of the various assemblies via nuget
Microsoft.ASP.NET Identity Core, version 2.0.1
Microsoft.OWIN.Security, version 2.1.0
Microsoft.OWIN.Security.Cookies, version 2.1.0
Microsoft.OWIN.Security.Google, version 2.1.0
I was following a tutorial from Rick Anderson and Erik Reitan (http://www.asp.net/mvc/tutorials/mvc-5/create-an-aspnet-mvc-5-app-with-facebook-and-google-oauth2-and-openid-sign-on)
but when I tried to log in via Google the system redirected (ultimately) back to the Login page.
Having a look at the network calls, I can see the following
Get /Login
POST /ExternalLogin -> 302 to https://accounts.google.com/o/oauth2/auth?...
... {google stuff here}
GET /signin-google?state=... -> 302 to /Account/ExternalLoginCallback
GET /Account/ExternalLoginCallback -> 302 to /Account/Login
GET /Login
The ExternalLoginCallback controller method redirects back to the Login action if the AuthenticationManager.GetExternalLoginInfoAsync function returns null, which it is doing, instead of continuing onto the ExternalLoginConfirmation view.
The Google OWIN middleware has successfully created the AuthenticationTicket and I have my user information present in the context BEFORE the redirect from signin-google to ExternalLoginCallback. I checked this by adding an OnAuthenticated handler to the GoogleOAuth2AuthenticationProvider
instance passed to the UseGoogleAuthentication function.
The redirect response from the /signin-goggle doesn't set any cookies, nor transfer any information on the querystring.
The Startup.Auth.cs file has the same code as the starter kit generates, with the exception of the google secrets.
I can log into the site wthout using an external provider using forms auth.
I cannot test any other external provider as work blocks Twitter and Facebook, and the Microsoft application system doesn't allow "localhost" a redirect Uri ( how do you expect people to develop without using "real" urls - not everyone can publish to Azure ).
Can anyone help to tip or tricks to work out what is going on.
Can anyone point me to some documentation on how this thing is supposed to work, technically - I don't need to see another diagram of the process flow; I got that bit already.
Cheers...
Robert