Custom Authentication on Asp.Net 4.5 with WIF

Question

I have an application set up with Azure ACS and .net 4.5 using claims. My application uses dropbox also. I was wondering if i could let users identify them self with dropbox alone.

I get a token from dropbox when the user logs in with dropbox and a unique id. Where in the .net pipe do i tell it that i have authenticated a user, such the principals are set on the next request also.

To make the example simple, lets say i have a form with two inputs. name,pass. If the name is 1234 and pass is 1234. then i would like to tell the asp.net pipeline that the user is authenticated. Is this possible? or do i need to create custom token handlers an such to integrate it into WIF?

Update

I found this: I would like comments on the solution, if there are security concerns i should be aware off.

        var sam = FederatedAuthentication.SessionAuthenticationModule;
        if (sam != null)
        {
            var cp = new ClaimsPrincipal(new ClaimsIdentity(new List<Claim> {new Claim("Provider","Dropbox")}, "OAuth"));
            var transformer = FederatedAuthentication.FederationConfiguration.IdentityConfiguration.ClaimsAuthenticationManager;
            if (transformer != null)
            {
                cp = transformer.Authenticate(String.Empty, cp);
            }
            var token = new SessionSecurityToken(cp);
            sam.WriteSessionTokenToCookie(token);
        }

All code:

public HttpResponseMessage get_reply_from_dropbox(string reply_from)
{
    var response = this.Request.CreateResponse(HttpStatusCode.Redirect);
    var q = this.Request.GetQueryNameValuePairs();
    var uid = q.FirstOrDefault(k => k.Key == "uid");
    if (!string.IsNullOrEmpty(uid.Value))
    {
        var sam = FederatedAuthentication.SessionAuthenticationModule;
        if (sam != null)
        {
            var cp = new ClaimsPrincipal(new ClaimsIdentity(new List<Claim> {new Claim("Provider","Dropbox")}, "OAuth"));
            var transformer = FederatedAuthentication.FederationConfiguration.IdentityConfiguration.ClaimsAuthenticationManager;
            if (transformer != null)
            {
                cp = transformer.Authenticate(String.Empty, cp);
            }
            var token = new SessionSecurityToken(cp);
            sam.WriteSessionTokenToCookie(token);
        }
    }

    response.Headers.Location = new Uri(reply_from);
    return response;
}
public async Task<string> get_request_token_url(string reply_to)
{

    var client = new HttpClient();
    client.DefaultRequestHeaders.Authorization =
        new AuthenticationHeaderValue("OAuth", 
            string.Format("oauth_version=\"1.0\", oauth_signature_method=\"PLAINTEXT\", oauth_consumer_key=\"{0}\", oauth_signature=\"{1}&\"",
            "<dropboxkey>","<dropboxsecret>"));
    var data = await client.GetStringAsync("https://api.dropbox.com/1/oauth/request_token");

    var pars = data.Split('&').ToDictionary(k=>k.Substring(0,k.IndexOf('=')),v=>v.Substring(v.IndexOf('=')+1));

    return "https://www.dropbox.com/1/oauth/authorize?oauth_token=" + pars["oauth_token"]
        + "&oauth_callback=<MYSITE>/api/dropbox/get_reply_from_dropbox?reply_from=" + reply_to;


}

It works by the user request the authentication url, when the user authenticates my app it returns to get_reply_from_dropbox and logs in the user.

I offcause needs to handle some other stuff also, like what if the request do not come from dropbox.

Answer 1

I did this for my site using WIF 3.5 (not exactly the same) but it did use ACS+forms auth+OAuth all together, basically it uses form auth (which you can control completely) or use ACS/OAuth and link the accounts together or just use ACS/OAuth by itself.

You will have to handle logging off differently though.

http://garvincasimir.wordpress.com/2012/04/05/tutorial-mvc-application-using-azure-acs-and-forms-authentication-part-1/

DropBox uses OAuth, so I would go that route and then if you want to "link the accounts" create a user/password for forms auth linked to the DropBox Oauth account. The user doesn't necessarily have to know what auth conventions are being used. ASP.NET MVC 4 has the OAuth/forms auth built in the default project.