An overview on using OAuth2.0 for authentication:

• Overview
• Further Reading
• Registering
• Using OAuth2.0
• Sample: Tasks.SimpleOAuth2

Overview

While some services do not require authentication at all, or only use your developer key, most of the services require access to some of the users data. The authentication model used to access user data is OAuth2.0.

OAuth 2.0 is an emerging standard for accessing protected resources on the web. Google APIs and the google-api-dotnet-client library support OAuth 2.0.

Further Reading

• For details about how OAuth 2.0 works in the client library, read the Design Document.
• For general information about OAuth 2.0, see the OAuth 2.0 draft specification.
• For information about using OAuth 2.0 in various flows with Google APIs, see Using OAuth 2.0 to Access Google APIs.

Registering

Before you can use OAuth 2.0, you must register your application using the Google APIs Console. After you've registered, go to the API Access tab and copy the "Client ID" and "Client secret" values, which you'll need later.

If you're writing a web application, then make sure the Redirect URI matches the URI you will use in your application to handle the redirect. For example, the sample below uses the path /Result.aspx, so if the sample application were hosted at example.com, then you would set the Redirect URI in the APIs Console to be http://example.com/Result.aspx.

Using OAuth2.0

Lets say you want to see all the Tasks a user has created on his Google account. Before you can access that data, you have to ask the user for permission. This process is called "Obtaining an authorization code".

Once you get an authorization code, you can use this code to get a refresh-token and an access-token. An access token is usually valid for a maximum of one hour, and allows you to access the user's data. Every time you make a request to protected data, you have to authorize the request using an access token.

But what should you do once your short-lived access token expires? When using your authorization code to get an access token, you also received a refresh token. A refresh token can be used to request a new access token once the previous once expired.

There are two important things you should now about refresh tokens:

1. If you don't store the refresh token, the user will have to reauthorize the access to his data every time the access token expires.
2. Everyone who has access to your refresh token and your client id & secret has potential access to the data of your users. If you have no way of storing the refresh token securely, you should not store it at all.

Sample: Tasks.SimpleOAuth2

Fortunately you do not have to re-implement the whole authorization process (unless you want to). The GoogleApis.Authentication.OAuth2- and DotNetOpenAuth-library does most of the work for you. Have a look at the Tasks.SimpleOAuth2-sample:

/*
Copyright 2011 Google Inc

Licensed under the Apache License, Version 2.0(the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

using System;
using System.Diagnostics;
using DotNetOpenAuth.OAuth2;
using Google.Apis.Authentication.OAuth2;
using Google.Apis.Authentication.OAuth2.DotNetOpenAuth;
using Google.Apis.Samples.Helper;
using Google.Apis.Tasks.v1;
using Google.Apis.Tasks.v1.Data;
using Google.Apis.Util;

namespace Google.Apis.Samples.TasksOAuth2
{
    /// <summary>
    /// This sample demonstrates the simplest use case for an OAuth2 service. 
    /// The schema provided here can be applied to every request requiring authentication.
    /// </summary>
    public class Program
    {
        public static void Main(string[] args)
        {
            // Display the header and initialize the sample.
            CommandLine.EnableExceptionHandling();
            CommandLine.DisplayGoogleSampleHeader("Tasks API");

            // Register the authenticator.
            var provider = new NativeApplicationClient(GoogleAuthenticationServer.Description);
            provider.ClientIdentifier = "<client id>";
            provider.ClientSecret = "<client secret>";
            var auth = new OAuth2Authenticator<NativeApplicationClient>(provider, GetAuthorization);

            // Create the service.
            var service = new TasksService(auth);
            TaskLists results = service.Tasklists.List().Fetch();
            Console.WriteLine("Lists:");
            foreach (TaskList list in results.Items)
            {
                Console.WriteLine("- " + list.Title);
            }
            Console.ReadKey();
        }

        private static IAuthorizationState GetAuthorization(NativeApplicationClient arg)
        {
            // Get the auth URL:
            IAuthorizationState state = new AuthorizationState(new[] { TasksService.Scopes.Tasks.GetStringValue() });
            state.Callback = new Uri(NativeApplicationClient.OutOfBandCallbackUrl);
            Uri authUri = arg.RequestUserAuthorization(state);

            // Request authorization from the user (by opening a browser window):
            Process.Start(authUri.ToString());
            Console.Write("  Authorization Code: ");
            string authCode = Console.ReadLine();
            Console.WriteLine();

            // Retrieve the access token by using the authorization code:
            return arg.ProcessUserAuthorization(authCode, state);
        }
    }
}

What is important here?

• You have to add an delegate creating the Authenticator before creating the service.
• The Authenticator has to know your ClientID and ClientSecret.
• You have to provide an "GetAuthorization" method which will return the initial authentication. You could either use a stored refresh token to get an access token around here, or ask the user for an access code to request a new access token.
• There are several ways of getting the authorization code from the user. The most simple one is asking the user to enter it for you. More complex ones require you to capture the window title of the browser, or opening a local socket. Have a look at OAuth2 for more information about this.

What is next?