oauth - Exchanging a google idToken for local openId token c# -

i using github project https://github.com/openiddict/openiddict-core great. stuck procedures should be, or how implement them, when user uses external identity provider, example, use google.

i have angular2 app running, aspnet core webapi. local logins work perfectly, call connect/token username , password, , accesstoken returned.

now need implement google external identity provider. have followed steps here implement google login button. opens popup when user logins in. code have created google button.

// angular hook allows interaction elements inserted // rendering of view. ngafterviewinit() {     // check if google client id in pages meta tags     if (document.queryselector("meta[name='google-signin-client_id']")) {         // converts google login button stub actual button.         gapi.signin2.render(             'google-login-button',             {                 "onsuccess": this.ongoogleloginsuccess,                 "scope": "profile",                 "theme": "dark"             });     } }  ongoogleloginsuccess(loggedinuser) {     let idtoken = loggedinuser.getauthresponse().id_token;      // here can pass idtoken server , validate } 

now have idtoken google. next step on google pages found here says need validate google accesstoken, can do, how exchange accesstoken have google, , create local accesstoken can used on application?

the next step on google pages found here says need validate google accesstoken, can do, how exchange accesstoken have google, , create local accesstoken can used on application?

the flow you're trying implement known assertion grant. can read this other post more information it.

openiddict supports custom grants, can implement in token endpoint action:

[httppost("~/connect/token")] [produces("application/json")] public iactionresult exchange(openidconnectrequest request) {     if (request.ispasswordgranttype())     {         // ...     }      else if (request.granttype == "urn:ietf:params:oauth:grant-type:google_identity_token")     {         // reject request if "assertion" parameter missing.         if (string.isnullorempty(request.assertion))         {             return badrequest(new openidconnectresponse             {                 error = openidconnectconstants.errors.invalidrequest,                 errordescription = "the mandatory 'assertion' parameter missing."             });         }          // create new claimsidentity containing claims         // used create id_token and/or access token.         var identity = new claimsidentity(openidconnectserverdefaults.authenticationscheme);          // manually validate identity token issued google,         // including issuer, signature , audience.         // then, copy claims need "identity" instance.          // create new authentication ticket holding user identity.         var ticket = new authenticationticket(             new claimsprincipal(identity),             new authenticationproperties(),             openidconnectserverdefaults.authenticationscheme);          ticket.setscopes(             openidconnectconstants.scopes.openid,             openidconnectconstants.scopes.offlineaccess);          return signin(ticket.principal, ticket.properties, ticket.authenticationscheme);     }      return badrequest(new openidconnectresponse     {         error = openidconnectconstants.errors.unsupportedgranttype,         errordescription = "the specified grant type not supported."     }); } 

note you'll have enable in openiddict options:

// register openiddict services, including default entity framework stores. services.addopeniddict()     // register entity framework stores.     .addentityframeworkcorestores<applicationdbcontext>()      // register asp.net core mvc binder used openiddict.     // note: if don't call method, won't able     // bind openidconnectrequest or openidconnectresponse parameters.     .addmvcbinders()      // enable token endpoint.     .enabletokenendpoint("/connect/token")      // enable password flow, refresh     // token flow , custom grant type.     .allowpasswordflow()     .allowrefreshtokenflow()     .allowcustomflow("urn:ietf:params:oauth:grant-type:google_identity_token")      // during development, can disable https requirement.     .disablehttpsrequirement(); 

when sending token request, make sure use right grant_type , send id_token assertion parameter, , should work. here's example postman (for facebook access tokens, works same way):

that said, have extremely careful when implementing token validation routine, step particularly error-prone. it's important validate everything, including audience (otherwise, your server vulnerable confused deputy attacks).