PREREQUISITES:
I have implemented WebApi site with OAuth authorization and authentication inside
OAuthAuthorizationServerOptions OAuthServerOptions = new OAuthAuthorizationServerOptions() { AllowInsecureHttp = true, TokenEndpointPath = new PathString("/token"), AccessTokenExpireTimeSpan = TimeSpan.FromMinutes(1), Provider = _unityConfiguration.Resolve<SimpleAuthorizationServerProvider>(), RefreshTokenProvider = _unityConfiguration.Resolve<SimpleRefreshTokenProvider>(), ApplicationCanDisplayErrors = true }; // Token Generation app.UseOAuthAuthorizationServer(OAuthServerOptions); app.UseOAuthBearerAuthentication(new OAuthBearerAuthenticationOptions());
TASK:
Lets say this WebApi located on http://mywebapi.com/
So now i may develop or allow any amount of WebUI sites to access this WebApi by requesting http://mywebapi.com/token with their uniue client_id and client_secret using user/password or refresh_token information.
Also there is implemented WebApi method like http://mywebapi.com/api/account/activeUser which return all needed information about active user
Based on this information WebSites / Desktop client / whatever may convert to ClaimsIdentity object.
MY CURRENT ACTIONS:
On WebUI site I have
app.UseCookieAuthentication(new CookieAuthenticationOptions() { AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie, LoginPath = new PathString("/Account/Login"), });
Site does not have access to the database. All actions is done through WebApi. All registered users, roles, allowed actions and claims should be / will be given by WebApi also.
For sure I may develop (and already developing) logic on one of such sites which will call http://mywebapi.com/token on login using HttpClient, which will call refresh token on received 401 error (ActionFilterAttribute) or redirect to account/login page to
enter user credential again if refresh token method returns 400 error.
But this is my own implementation and i this to think about other business cases like register user, cookie expiration and so on.
QUESTION:
Is there is simpler standard way to automatically call http://mywebapi.com/token whenewer it needed (login, refresh token), expire website cookie when bearer access token / refresh token expired and so on?
If possible please provide code pieces :) Thanks.