OpenID: Trying to Get Email Address from Google OP

Ok figured it out. I posted a question on Goolge’s Federated Log API group and was told to use Attribute exchange. Below is the code for DotNetOpenAuth. Please don’t use this code in production. This is for illustration purposes only! The Request: using (OpenIdRelyingParty openid = new OpenIdRelyingParty()) { IAuthenticationRequest request = openid.CreateRequest(openidurl); var fetch … Read more

Unable to use PLAINTEXT signature with a DotNetOpenAuth ServiceProvider

OAuth Authentication is done in three steps: The Consumer obtains an unauthorized Request Token. The User authorizes the Request Token. The Consumer exchanges the Request Token for an Access Token. So here’s what that would look like: public class InMemoryTokenManager : IConsumerTokenManager, IOpenIdOAuthTokenManager { private Dictionary<string, string> tokensAndSecrets = new Dictionary<string, string>(); public InMemoryTokenManager(string consumerKey, … Read more

Securing my REST API with OAuth while still allowing authentication via third party OAuth providers (using DotNetOpenAuth)

First I’d like to emphasize the difference between authentication and authorization: A user authenticates to your web site by supplying some credential such as a username+password. OpenID allows this to be displaced by having the user authenticate to another service, which then asserts the user’s identity to your web site on the user’s behalf. Your … Read more