Easy Steps to Integrate ASOS in ASP.NET Core API
Tags: security, dotnet, webdev
Published: 2020-01-20 06:57:22

---
title: Easy Steps to Integrate ASOS in ASP.NET Core API
published: true
date: 2020-01-15 12:00:57 UTC
tags: security, dotnet, webdev
canonical_url: https://www.syncfusion.com/blogs/post/asos-integration-in-asp-net-core-api.aspx
cover_image: https://www.syncfusion.com/blogs/wp-content/uploads/2019/12/ASOS-Integration-in-ASP.NET-Core-API-672x372.jpg
---

[ASOS](https://github.com/aspnet-contrib/AspNet.Security.OpenIdConnect.Server) (AspNet.Security.OpenIdConnect.Server) is an advanced [OAuth2](https://en.wikipedia.org/wiki/OAuth) for ASP.NET Core 1.x and 2.x. In this article, we explain the integration process of ASOS, corresponding to client\_credentials and password grant types, to enable:

- Token-based authentication
- User-based authentication

## Token-based authentication

Token-based authentication is the process of creating a token and attaching it with a HTTP request, which will be made to access an API. If a valid token is attached, then the request will be allowed. If an invalid token is attached, then the request will be rejected.

This is the type of authentication that will work while calling with client\_credentials grant type.

### Prerequisites

- Client ID for API
- Client secret ID for API

### Startup.cs configure services

```csharp
services.AddAuthentication().AddOpenIdConnectServer(options =>
{
    options.AllowInsecureHttp = true;
    options.AccessTokenLifetime = TimeSpan.FromMinutes(60); //Provide token expiry here.
    options.TokenEndpointPath = "/token"; //Provide token end point path here.
    options.Provider.OnValidateTokenRequest = context =>
    {
        //["ClientCredentials:ClientId"] denotes your API client id in the format of string.
        //["ClientCredentials:ClientSecret"] denotes your API client secret id in the format of string.
        if (context.ClientId == ["ClientCredentials:ClientId"] && context.ClientSecret == ["ClientCredentials:ClientSecret"])
        {
            context.Validate();
        }
        else
        {
            context.Reject(
                        error: OpenIdConnectConstants.Errors.InvalidClient,
                        description: "Invalid Client details");
        }
        return Task.CompletedTask;
    };
});
services.AddAuthentication(OAuthValidationDefaults.AuthenticationScheme).AddOAuthValidation();
```

## User-based authentication

This type of authentication will work while calling with a password of grant type.

### Prerequisites

You should have user login credentials to allow users to access a particular API request.

### Startup.cs configure services

```csharp
options.Provider.OnHandleTokenRequest = context =>
{
    if (!string.IsNullOrEmpty(context.Request.Username) && !string.IsNullOrEmpty(context.Request.Password) && context.Request.IsPasswordGrantType())
    {
        bool loginValidation = GetLoginvalidation(context.Request.Username, context.Request.Password);
        if (!loginValidation)
        {
            context.Reject(
            error: OpenIdConnectConstants.Errors.InvalidGrant,
            description: loginValidation);
 
            return Task.CompletedTask;
        }
        else
        {
            // If user information is correct, you can do customized changes like adding in claims in this block based on your requirement.
        }
    }
};
```

## Additional points to be considered

- Add UseAuthentication() to make the previous authentication work. Add this above app.UseMvc() in the configure method in startup.cs.
- The controller of each request should have the authorized filter to authorize each request.

```csharp
[Authorize]
public JsonResult Login()
{
  return;
}
```

## Conclusion

In this blog, we have seen the integration process of ASOS in ASP.NET Core API to enable token-based authentication and user-based authentication.

Syncfusion provides [70+ ASP.NET Core UI controls](https://www.syncfusion.com/aspnet-core-ui-controls) such as [DataGrid](https://www.syncfusion.com/aspnet-core-ui-controls/grid), [Charts](https://www.syncfusion.com/aspnet-core-ui-controls/charts), and [Scheduler](https://www.syncfusion.com/aspnet-core-ui-controls/scheduler). You can use them to speed up your application development.

If you have any questions, please let us know in the comments section below. You can contact us through our [support forum](https://www.syncfusion.com/forums), [Direct-Trac](https://www.syncfusion.com/account/login), or [Feedback Portal](https://www.syncfusion.com/feedback). We are waiting to hear your feedback!

The post [ASOS Integration in ASP.NET Core API](https://www.syncfusion.com/blogs/post/asos-integration-in-asp-net-core-api.aspx) appeared first on [Syncfusion Blogs](https://www.syncfusion.com/blogs).