Access OAuth2 endpoint from an ASP.NET Core Web API application

Question

I have a ASP.NET Core Web API application, and this web API needs to call another 3rd-party API which is authenticated using OAuth2. It is required to invoke the /token endpoint of this 3rd-party API by passing client_id and client_secret, and the grant type is client_credentials. And then make a subsequent request using the bearer token received to retrieve data from the 3rd-party API .

Based on my research this requirement can be implemented using HttpClient, and call 3rd-party API from the .NET Core Web API controller (or ideally in a service class accessed by the controller).

My question is is there another way/better approach to achieve this requirement? One concern I have in above approach is it will call the 3rd-party /token endpoint for each request. Is it possible to do some implementation in Startup.cs class?

I recommends read this article Which OAuth2 0 flow should I use first. After you choose the most appropriate flow for your needs, you could create a class ThirdPartyClient that extends from HttpClient and append the logic for the authentication flow you choose. With this, you would have a client to consume the 3rd-party API that you could inject wherever you need. NOTE: In the Startup.cs only use it to configure the DI and necessary services. — Frank
– Frank, Commented Jun 18, 2021 at 18:30

abdusco · Accepted Answer · 2021-06-18 22:34:22Z

4

Take a look at IdentityModel. It provides extension methods for HttpClient to handle client_credentials (and other) OAuth flow, caches the token (until it expires), so you don't hammer /token endpoint at every request and refreshes the token when needed.

You need to configure it in your Startup class, or implement ITokenClientConfigurationService if you need configure HttpClients dynamically.

services.AddAccessTokenManagement(options =>
{
    options.Client.Clients.Add("identityserver", new ClientCredentialsTokenRequest
    {
        Address = "https://demo.identityserver.io/connect/token",
        ClientId = "m2m.short",
        ClientSecret = "secret",
        Scope = "api" // optional
    });
});

answered Jun 18, 2021 at 22:34

abdusco

11.3k3 gold badges38 silver badges50 bronze badges

Sign up to request clarification or add additional context in comments.

5 Comments

Nilmi Nawalage Over a year ago

Thank you @abdusco. If we do this, will the 1st token be retrieved when the application starts, or will it be retrieved on demand only, when it is actually required to call the 3rd-party api?

abdusco Over a year ago

It's fetches tokens on-demand. You could attach a IHostedService and prefetch a token if that's important.

Nilmi Nawalage Over a year ago

I was able to access the API using this. But when I expand the httpClient instance return from HttpClientFactory, the Authorization header is null. I expected the bearer token to be available in Authorization header. So how this is working, where is the token set in the header?

abdusco Over a year ago

It's adding a DelegatingHandler to HttpClients which works like a middleware. It intercepts the request you send, adds / inspects the response to see if it needs to refresh the token github.com/IdentityModel/IdentityModel.AspNetCore/blob/…

Florent Over a year ago

Is there a way to use this altogether with an username and password? I need to provide that also for the auth request.

Collectives™ on Stack Overflow

Access OAuth2 endpoint from an ASP.NET Core Web API application

1 Answer 1

5 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

5 Comments

Your Answer

Sign up or log in

Post as a guest

Related