How to implement OAuth 2.0 in ASMX (web-reference)?

Question

I am very new in implementing OAuth 2.0. I have implemented web-reference (ASMX file) in my xamarin project. Now I need to implement OAuth 2.0 for authentication. But I am not sure if ASMX supports OAuth2.0 or not. Do I need to implement WCF instead of Web refernce(ASMX) or is it possible in web reference (ASMX) to implement the OAuth2.0?

Answer 1

One possible solution is to add the token aquired from the authority to the Authorization header. Your code could look similar to this:

var redirectURI = Windows.Security.Authentication.Web.WebAuthenticationBroker.GetCurrentApplicationCallbackUri();
var _authContext = new AuthenticationContext(authority);
var tokenResult = await _authContext.AcquireTokenAsync(serviceResourceId, clientId, redirectURI);
if (tokenResult.Status != AuthenticationStatus.Success)
{
    //Not authenticated
    return;
}
var svc = new YourServiceReference.YourClient();
using (var scope = new OperationContextScope(svc.InnerChannel))
{
    var httpRequestProperty = new HttpRequestMessageProperty();
    httpRequestProperty.Headers[System.Net.HttpRequestHeader.Authorization] = tokenResult.AccessToken;
    OperationContext.Current.OutgoingMessageProperties[HttpRequestMessageProperty.Name] = httpRequestProperty;
    var result = svc.MyFunction();
    //Do something with the data
}

Answer 2

Tricky - this is how mobile OAuth solutions work - but it is a big job:

• Your Xamarin app would need to implement Mobile SSO to sign users in
• Users of your Xamarin app would be redirected to login via an Authorization Server / Identity Provider after which they will receive an OAuth access token
• After login your Xamarin App would then be able to call an API with the token and act on behalf of the user to get data
• The API would need to validate received access tokens

SOLUTION PARTS

API: ASMX is an old technology so if you are working on the Microsoft stack you would use something newer such as a .Net Core Web API

MOBILE APP: The harder part of the solution will be implementing Mobile SSO, if you have not done so already.

How much of this solution exists already?