How to add parameters to redirect_uri in WebApi Oauth Owin authentication process?

Question

I'm creating a webapi project with oauth bearer token authenthication and external login providers (google, twitter, facebook etc.). I started with the basic VS 2013 template and got everything to work fine!

However, after a user successfully logs is, the owin infrastructure creates a redirect with the folllowing structure:

http://some.url/#access_token=<the access token>&token_type=bearer&expires_in=1209600

In my server code I want to add an additional parameter to this redirect because in the registration process of my app, a new user needs to first confirm and accept the usage license before he/she is registered as a user. Therefore I want to add the parameter "requiresConfirmation=true" to the redirect. However, I've no clue about how to do this. I tried setting AuthenticationResponseChallenge.Properties.RedirectUri of the AuthenticationManager but this doesn't seem to have any affect.

Any suggestions would be greatly appreciated!

Answer 1

It should be relatively easy with the AuthorizationEndpointResponse notification:

In your custom OAuthAuthorizationServerProvider implementation, simply override AuthorizationEndpointResponse to extract your extra parameter from the ambient response grant, which is created when you call IOwinContext.Authentication.SignIn(properties, identity). You can then add a custom requiresConfirmation parameter to AdditionalResponseParameters: it will be automatically added to the callback URL (i.e in the fragment when using the implicit flow):

public override Task AuthorizationEndpointResponse(OAuthAuthorizationEndpointResponseContext context) {
    var requiresConfirmation = bool.Parse(context.OwinContext.Authentication.AuthenticationResponseGrant.Properties.Dictionary["requiresConfirmation"]);
    if (requiresConfirmation) {
        context.AdditionalResponseParameters.Add("requiresConfirmation", true);
    }

    return Task.FromResult<object>(null);
}

In your code calling SignIn, determine whether the user is registered or not and add requiresConfirmation to the AuthenticationProperties container:

var properties = new AuthenticationProperties();
properties.Dictionary.Add("requiresConfirmation", "true"/"false");

context.Authentication.SignIn(properties, identity);

Feel free to ping me if you need more details.