OAuth 2.0

Web applications (ASP.NET Core 3)

Google APIs support OAuth 2.0 for Web Server Applications .

The Google.Apis.Auth.AspNetCore3 is the recommended library to use for most Google based OAuth 2.0 scenarios in ASP.NET Core 3 applications. It implements a Google-specific OpenIdConnect auth handler. It supports incremental auth, and defines an injectable IGoogleAuthProvider to supply Google credentials that can be used with Google APIs.

This section describes how to configure and use Google.Apis.Auth.AspNetCore3. The code shown here is based on Google.Apis.Auth.AspNetCore3.IntegrationTests which is a fully working, standard ASP.NET Core 3 application.

If you want to follow along this documentation as a tutorial, you will need your own ASP.NET Core 3 application and to complete these steps as a prerequisite.

Prerequisites

• Install the Google.Apis.Auth.AspNetCore3 package.
• We are using the Google Drive API so you'll also need to install the Google.Apis.Drive.v3 package.
• Create a Google Cloud project if you don't have one already. Follow these instructions to do so. This will be the project your app is identified with.
• Make sure to enable the Google Drive API. To enable APIs, follow these instructions .
• Create authorization credentials that will identify your app to Google. Follow these instructions to create authorization credentials and download the client_secrets.json file. Two highlights:
  • Notice that the credentials' type must be Web application .
  • For running this app, the only redirect URI you need to add is https://localhost:5001/signin-oidc .

Configure your application to use Google.Apis.Auth.AspNetCore3

Google.Apis.Auth.AspNetCore3 is configured in the Startup class or similar alternative you might be using. The following snippets are extracted from Startup.cs in the Google.Apis.Auth.AspNetCore3.IntegrationTests project.

• Add the following using directive to your Startup.cs file.

  using Google.Apis.Auth.AspNetCore3;

• In the Startup.ConfigureServices method add the following code, changin the Client ID and Client Secret placeholders with the values contained in the client_secrets.json file. You can load these values directly from the JSON file or you can store them in any other secure manner. Take a look at the ClientInfo.Load method in the Google.Apis.Auth.AspNetCore3.IntegrationTests project for an example on how to load these values directly from the JSON file.

  public void ConfigureServices(IServiceCollection services)
  {
      ...
  
      // This configures Google.Apis.Auth.AspNetCore3 for use in this app.
      services
          .AddAuthentication(o =>
          {
              // This forces challenge results to be handled by Google OpenID Handler, so there's no
              // need to add an AccountController that emits challenges for Login.
              o.DefaultChallengeScheme = GoogleOpenIdConnectDefaults.AuthenticationScheme;
              // This forces forbid results to be handled by Google OpenID Handler, which checks if
              // extra scopes are required and does automatic incremental auth.
              o.DefaultForbidScheme = GoogleOpenIdConnectDefaults.AuthenticationScheme;
              // Default scheme that will handle everything else.
              // Once a user is authenticated, the OAuth2 token info is stored in cookies.
              o.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
          })
          .AddCookie()
          .AddGoogleOpenIdConnect(options =>
          {
              options.ClientId = {YOUR_CLIENT_ID};
              options.ClientSecret = {YOUR_CLIENT_SECRET};
          });
  }

• In the Startup.Configure method make sure to add ASP.NET Core 3 authentication and authorization middleware components to the pipeline, as well as HTTPS redirections:

  public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
  {
      ...
      app.UseHttpsRedirection();
      ...
  
      app.UseAuthentication();
      app.UseAuthorization();
  
      ...
  }

Use the user credential to access Google APIs on their behalf

You are now ready to add action methods to your controllers that require the user credential to access Google APIs on their behalf. The following snippet shows how to list the files on the authenticated user's Google Drive account. Notice two things mostly:

• The user not only needs to be authenticated, but they also need to have granted the https://www.googleapis.com/auth/drive.readonly scope to your application, which you specify using the GoogleScopedAuthorize attribute.
• We are using ASP.NET Core 3's standard dependency injection mechanism to receive an IGoogleAuthProvider that we use to obtain the user's credentials.

The code:

• First add the following using directives to your controller.

  using Google.Apis.Auth.AspNetCore3;
  using Google.Apis.Auth.OAuth2;
  using Google.Apis.Drive.v3;
  using Google.Apis.Services;

• Add the controller action, as follows (and accompany it with a view that receives a IList<string> model):

   /// 
    
  < summary 
  > /// 
    
   Lists 
    
   the 
    
   authenticated 
    
   user 
   ' 
   s 
    
   Google 
    
   Drive 
    
   files 
   . 
   /// 
    
   Specifying 
    
   the 
    
  < see 
    
   cref 
   = 
   "GoogleScopedAuthorizeAttribute" 
  >  
   will 
    
   guarantee 
    
   that 
    
   the 
    
   code 
   /// 
    
   executes 
    
   only 
    
   if 
    
   the 
    
   user 
    
   is 
    
   authenticated 
    
   and 
    
   has 
    
   granted 
    
   the 
    
   scope 
    
   specified 
    
   in 
    
   the 
    
   attribute 
   /// 
    
   to 
    
   this 
    
   application 
   . 
   /// 
    
  < / 
   summary 
  > /// 
    
  < param 
    
   name 
   = 
   "auth" 
  > The 
    
   Google 
    
   authorization 
    
   provider 
   . 
   /// 
    
   This 
    
   can 
    
   also 
    
   be 
    
   injected 
    
   on 
    
   the 
    
   controller 
    
   constructor 
   . 
  < / 
   param 
  > [ 
   GoogleScopedAuthorize(DriveService.ScopeConstants.DriveReadonly) 
   ] 
   public 
    
   async 
    
   Task<IActionResult> 
    
   DriveFileList 
   ( 
   [ 
   FromServices 
   ] 
    
   IGoogleAuthProvider 
    
   auth 
   ) 
   { 
    
   GoogleCredential 
    
   cred 
    
   = 
    
   await 
    
   auth 
   . 
   GetCredentialAsync 
   (); 
    
   var 
    
   service 
    
   = 
    
   new 
    
   DriveService 
   ( 
   new 
    
   BaseClientService 
   . 
   Initializer 
    
   { 
    
   HttpClientInitializer 
    
   = 
    
   cred 
    
   } 
   ); 
    
   var 
    
   files 
    
   = 
    
   await 
    
   service 
   . 
   Files 
   . 
   List 
   (). 
   ExecuteAsync 
   (); 
    
   var 
    
   fileNames 
    
   = 
    
   files 
   . 
   Files 
   . 
   Select 
   ( 
   x 
    
   => 
    
   x 
   . 
   Name 
   ). 
   ToList 
   (); 
    
   return 
    
   View 
   ( 
   fileNames 
   ); 
   } 
    
  

And these are the basics. You can take a look at HomeController.cs from the Google.Apis.Auth.AspNetCore3.IntegrationTests project to find out how you can achieve:

• User authentication only, with no specific scopes
• User logout
• Incremental authorization with code. Notice that the sample shows incremental authorization with attributes.
• Examine granted scopes
• Examine access and refresh tokens
• Force refresh the access token. Notice that you don't have to do this yourself because Google.Apis.Auth.AspNetCore3 will detect if the access token is expired or close to expiring and will automatically refresh it.