Question

I want to use DotNetOpenAuth in my website for authentication + authorization (gmail).

However, I would like to ask: What should I persist?

I thought:

1. In the DB: for each user save a Guid and his gmail (fetched)
2. In formAuthentication cookie the Guid I have assigned to that user.

Any other suggestions?

public bool Login()
{
    IAuthenticationResponse authResponse = GoogleConsumerHandler.RelyingParty.GetResponse();
    if (authResponse != null)
    {
        HandleAuthResponse(authResponse);
    }
    else
    {
        HandleAuthNullResponse(authResponse);
    }

    return false;
}

#region private methods

private void HandleAuthResponse(IAuthenticationResponse authResponse)
{
    switch (authResponse.Status)
    {
        case AuthenticationStatus.Authenticated:
            State.FetchResponse = authResponse.GetExtension<FetchResponse>();
            var consumer = new WebConsumer(GoogleConsumerHandler.ServiceDescription, mConsumerTokenManager);
            AuthorizedTokenResponse accessToken = consumer.ProcessUserAuthorization(authResponse);
            if (accessToken != null)
            {                  
                var email = authResponse.ClaimedIdentifier;

                //existing or new
                Guid userId = mCRMService.GetUserId(email, accessToken.AccessToken);

                State.GoogleAccessToken = accessToken.AccessToken;

                FormsAuthentication.SetAuthCookie(userId.ToString(), false);

                //authenticat and authorized
                //Response.Redirect("~/Browser.htm");
            }
            else
            {
                //authenticated and not authorized
                //MultiView1.SetActiveView(AuthorizationDenied);
            }
            break;

        case AuthenticationStatus.Canceled:
            break;
        case AuthenticationStatus.Failed:
            break;
        default:
            //not authenticated
            //this.MultiView1.SetActiveView(this.AuthenticationFailed);
            break;
    }
}

private void HandleAuthNullResponse(IAuthenticationResponse authResponse)
{
    // Google requires that the realm and consumer key be equal,
    // so we constrain the realm to match the realm in the web.config file.
    // This does mean that the return_to URL must also fall under the key,
    // which means this sample will only work on a public web site
    // that is properly registered with Google.
    // We will customize the realm to use http or https based on what the
    // return_to URL will be (which will be this page).

    var consumer = new WebConsumer(GoogleConsumerHandler.ServiceDescription, mConsumerTokenManager);

    //Realm realm = "http://localhost:8976/";
    Realm realm = System.Web.HttpContext.Current.Request.Url.Scheme + Uri.SchemeDelimiter + consumer.ConsumerKey + "/";
    IAuthenticationRequest authReq = GoogleConsumerHandler.RelyingParty.CreateRequest(GoogleConsumerHandler.GoogleOPIdentifier, realm);

    // Prepare the OAuth extension
    string scope = GoogleConsumerHandler.GetScopeUri(GoogleConsumerHandler.Applications.Gmail);
    consumer.AttachAuthorizationRequest(authReq, scope);

    // We also want the user's email address
    var fetch = new FetchRequest();
    fetch.Attributes.AddRequired(WellKnownAttributes.Contact.Email);
    authReq.AddExtension(fetch);

    authReq.RedirectToProvider();
}

Answer 1

For authentication purposes you should store the OpenID ClaimedIdentifier you get back in the IAuthenticationResponse object. That serves as the “primary key” for your users so you can recognize them when they return. I suggest you use the claimed_id as the FormsAuthentication username instead of a random GUID as well. Also storing the email address you collect is fine, but it’s inadvisable to use that as the means to recognize a returning user.

Remember that you can’t log in “gmail users”. You can log in OpenID users, that may use any Provider. You can limit that to “Google” users by filtering on the IAuthenticationResponse.Provider.Uri for the Google OP Endpoint, but even then you’re not guaranteed that those accounts use Gmail (their email address might be [e-mail] anyway).

Finally, if all you need is their authentication and email address (whatever email that is) you can do so using the OpenID AX extension (built into DNOA) and you don’t need “authorization”, which might greatly simplify your code.