AArnott/dotnetopenid — Issue #62: DotNetOpenAuth and AccessProtectedResourceRequest reject verb
Author: Paxcal
Created: 2012-01-30 09:37:01+00:00
State: open

Hi,

I'm integrating OAUTH2 with DotNetOpenAuth-4.0.0.11165 for rest api implemented with asp.net MVC3.

Oauth dance is OK. But, at the resource server stage, the request is refused due to the verb.

```
private static IPrincipal VerifyOAuth2(HttpRequestMessageProperty httpDetails, Uri requestUri) {
// for this sample where the auth server and resource server are the same site,
// we use the same public/private key.
using (var signing = Global.CreateAuthorizationServerSigningServiceProvider()) {
using (var encrypting = Global.CreateResourceServerEncryptionServiceProvider()) {
var resourceServer = new ResourceServer(new StandardAccessTokenAnalyzer(signing, encrypting));
IPrincipal result;
var error = resourceServer.VerifyAccess(new HttpRequestInfo(httpDetails, requestUri), out result);
// TODO: return the prepared error code.
return error != null ? null : result;
}
}
}
```

The error is :
```
{WWW-Authenticate: Bearer error="'AccessProtectedResourceRequest' messages cannot be received with HTTP verb 'PutRequest'."
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
}
```

The rest uri works fine with PUT verb when oauth2 is not involved.

I'cant figure out how to resolve this issue.

Pascal