We Keep Coding

Google Calendar returning invalid grant

I have a customer that is trying to access their calendars from our web application. Everything works for all of our other customers, so I am not sure what is different here except this customer is in Australia and using a non gmail.com email address.
The customer is able to authorize our application and we do get a oauth token for the user. We request calendar access and the customer granted it. When we request a list of all of the calendars, we get the invalid grant message.
Below is the code that we use to access their calendars. The method being called is GetAllWritableCalendars.
public class GoogleCalendarAdapter : ICalendarAdapter {
#region attributes
private readonly ISiteAuthTokenQueryRepository _tokenRepo;
private readonly GoogleCalendarSettings _settings;
private const string APPNAME = "SomeAppName";
private const string ACL_OWNER = "owner";
private const string ACL_WRITER = "writer";
#endregion
#region ctor
public GoogleCalendarAdapter(ISiteAuthTokenQueryRepository tokenRepo,
GoogleCalendarSettings settings) {
_tokenRepo = tokenRepo;
_settings = settings;
}
#endregion
#region methods
private GoogleAuthorizationCodeFlow BuildAuthorizationCodeFlow() {
return new GoogleAuthorizationCodeFlow(new GoogleAuthorizationCodeFlow.Initializer() {
ClientSecrets = BuildClientSecrets(),
Scopes = BuildScopeList()
});
}
private CalendarService BuildCalendarService(SiteAuthToken token) {
return new CalendarService(new BaseClientService.Initializer() {
ApplicationName = APPNAME,
HttpClientInitializer = BuildUserCredential(token)
});
}
private ClientSecrets BuildClientSecrets() {
return new ClientSecrets() {
ClientId = _settings.ClientId,
ClientSecret = _settings.ClientSecret
};
}
private string[] BuildScopeList() {
return new [] { CalendarService.Scope.Calendar };
}
private UserCredential BuildUserCredential(SiteAuthToken token) {
TokenResponse responseToken = new TokenResponse() {
AccessToken = token.AccessToken,
RefreshToken = token.RefreshToken
};
return new UserCredential(BuildAuthorizationCodeFlow(), APPNAME, responseToken);
}
public async Task<List<Cal>> GetAllWritableCalendars(Guid siteGuid) {
SiteAuthToken token = await GetToken(siteGuid);
CalendarService svc = BuildCalendarService(token);
IList<CalendarListEntry> calendars = svc.CalendarList
.List()
.Execute()
.Items;
return calendars.Where(c => c.AccessRole.Equals(ACL_OWNER, StringComparison.CurrentCultureIgnoreCase) ||
c.AccessRole.Equals(ACL_WRITER, StringComparison.CurrentCultureIgnoreCase))
.Select(c => new Cal() {
Id = c.Id,
Name = c.Summary
})
.OrderBy(o => o.Name)
.ToList();
}
private async Task<SiteAuthToken> GetToken(Guid siteGuid) {
SiteAuthToken retVal = await _tokenRepo.GetSiteAuthToken(siteGuid);
if (retVal == null) {
throw new ApplicationException($"Could not find a SiteAuthToken for specified site (SiteGuid: {siteGuid})");
}
return retVal;
}
#endregion

The credentials are the authorization from Google to Your Application to use the scopes you have set-up, this is okay to have it in a database if you update it every time you add new scopes to your app.
The Access Token is the authorization from the user to your application to get it's Google Data (calendar in this case). It has a limited lifetime so this is not okay to save in a database.
The Refresh Token is the token that allows your application to get more tokens for a client. It has a limited lifetime as well.
For more info see: Using OAuth 2.0 to Access Google APIs
Every time you change your scopes or add more scopes you have to re-generate the credentials. You have 50 refresh tokens per user account per client, see Token expiration. So having the tokens in a database makes no sense since they are going to get deprecated at some point, if you have 51 clients the 1st token will get deprecated.
Check:
How do you have it set-up on your database
If you renew properly the tokens
If you are using the correct tokens for the users
You can delete all the tokens (NOT the CREDENTIALS) and your current users will only have to go through the consent screen and allow it again, they will not lose the connection.

I asked the question later in a different way. Maybe it was a little more relevant. Perhaps there was a little more information available. What ever the case may be, I discovered how to test things properly.
Look at this question

Facebook OAuth issue MVC4

Annoyingly I have been trying to solve this issue for many hours, every answer is no direct solution:
{
"error": {
"message": "Error validating verification code. Please make sure your redirect_uri is identical to the one you used in the OAuth dialog request",
"type": "OAuthException",
"code": 100
}
}
I have been banging my head against the wall!. I am using the facebook soap client for this http://pastebin.com/G7ysgbdX
This will allow us to integrate (with the user's permission) their timeline. Facebook is saying the URL's do not match. How do I test this?
This works locally but not on the server with the exact same code except http://free-rsvp.com/ instead of localhost:53111/
This is the below URL. I cannot see anything wrong!
Any advice would be appreciated.
provider_%3dFacebookPro%26_sid_%3da80359b555c54b8f8d2f4f8e803f9125&client_secret=212360b3ea6478fd0a0491e736b54256&code=AQCyTDStiB5gsQpKMx4uI1yFesVnLnWfE3u70VsB02-4HSyUCTbcf_3oHMo7QQI2as_pw1tpFONs8tClq4FxCr4AzuCMzLBsRnyOM3dcattTATdU-ahq5cjr4lPJNp2gkTrpgWUmqDEVQ8PBvYFB1LdWJpojxRIC24lv0GkQSSqdrct41UGHfDjhnPfI1mV945NgVJSfebhJP7O0GWxP9o9g_4svDCKa2LtCRbo7nDfWLeiE9fGULhmuJDjefAFZ5VMiYj8SrA4QtZXIu8jUQSQT89VYEP8PuG2hS_wMr0TL_GmcvEhNzQ8psPpPWFYhmSo">https://graph.facebook.com/oauth/access_token?client_id=523007704381837&redirect_uri=http%3a%2f%2ffree-rsvp.com%3a80%2fAccount%2fExternalLoginCallback%3fReturnUrl%3d%252FDashboard%26_provider_%3dFacebookPro%26_sid_%3da80359b555c54b8f8d2f4f8e803f9125&client_secret=212360b3ea6478fd0a0491e736b54256&code=AQCyTDStiB5gsQpKMx4uI1yFesVnLnWfE3u70VsB02-4HSyUCTbcf_3oHMo7QQI2as_pw1tpFONs8tClq4FxCr4AzuCMzLBsRnyOM3dcattTATdU-ahq5cjr4lPJNp2gkTrpgWUmqDEVQ8PBvYFB1LdWJpojxRIC24lv0GkQSSqdrct41UGHfDjhnPfI1mV945NgVJSfebhJP7O0GWxP9o9g_4svDCKa2LtCRbo7nDfWLeiE9fGULhmuJDjefAFZ5VMiYj8SrA4QtZXIu8jUQSQT89VYEP8PuG2hS_wMr0TL_GmcvEhNzQ8psPpPWFYhmSo
EDIT
The url that takes me to facebook is:
provider_%253DFacebookPro%2526_sid_%253Dbfe82f104ab34d1aa0f44c477c4d7819%26scope%3Demail%252Cuser_likes%252Cfriends_likes%252Cuser_birthday%252Cpublish_checkins%252Cpublish_stream%26client_id%3D523007704381837%26ret%3Dlogin&cancel_uri=http%3A%2F%2Ffree-rsvp.com%2FAccount%2FExternalLoginCallback%3FReturnUrl%3D%252FDashboard%26_provider_%3DFacebookPro%26_sid_%3Dbfe82f104ab34d1aa0f44c477c4d7819%26error%3Daccess_denied%26error_code%3D200%26error_description%3DPermissions%2Berror%26error_reason%3Duser_denied%23_%3D_&display=page">https://www.facebook.com/login.php?skip_api_login=1&api_key=523007704381837&signed_next=1&next=https%3A%2F%2Fwww.facebook.com%2Fdialog%2Foauth%3Fredirect_uri%3Dhttp%253A%252F%252Ffree-rsvp.com%252FAccount%252FExternalLoginCallback%253FReturnUrl%253D%252FDashboard%2526_provider_%253DFacebookPro%2526_sid_%253Dbfe82f104ab34d1aa0f44c477c4d7819%26scope%3Demail%252Cuser_likes%252Cfriends_likes%252Cuser_birthday%252Cpublish_checkins%252Cpublish_stream%26client_id%3D523007704381837%26ret%3Dlogin&cancel_uri=http%3A%2F%2Ffree-rsvp.com%2FAccount%2FExternalLoginCallback%3FReturnUrl%3D%252FDashboard%26_provider_%3DFacebookPro%26_sid_%3Dbfe82f104ab34d1aa0f44c477c4d7819%26error%3Daccess_denied%26error_code%3D200%26error_description%3DPermissions%2Berror%26error_reason%3Duser_denied%23_%3D_&display=page

here is a piece of my server-side authentication code (MVC4 project). The part you should look at is how redirect URL is generated - identically - in both "Authorize" and "AuthorizeCallback" functions - and passed to facebook client:
[HttpPost]
public ActionResult Authorize(Guid eventId)
{
var #event = this.eventRepository.Find(eventId);
var redirectUri = ConfigurationProvider.HostingEndpoint + this.Url.Action("AuthorizeCallback", new { eventCode = #event.Code });
var service = new FacebookClient();
var loginUrl = service.GetLoginUrl(new {
client_id = ConfigurationProvider.FacebookAppId,
client_secret = ConfigurationProvider.FacebookAppSecret,
redirect_uri = redirectUri,
response_type = "code",
scope = "manage_pages, publish_actions, user_photos, publish_stream" // Add other permissions as needed
});
return new RedirectResult(loginUrl.AbsoluteUri, permanent: false);
}
public ActionResult AuthorizeCallback(string code, string eventCode, UserProfile userProfile)
{
var #event = this.eventRepository.Find(eventCode);
if (string.IsNullOrWhiteSpace(code) == true)
{
// means user clicked "cancel" when he was prompted to authorize the app
// todo: show some error message? or just redirect back?
return this.RedirectToAction("Event", "Dashboard", new { eventCode = #event.Code, feature = FeatureType.Update });
}
var redirectUri = ConfigurationProvider.HostingEndpoint + this.Url.Action("AuthorizeCallback", new { eventCode = #event.Code });
var fb = new FacebookClient();
dynamic result = fb.Post("oauth/access_token", new
{
client_id = ConfigurationProvider.FacebookAppId,
client_secret = ConfigurationProvider.FacebookAppSecret,
redirect_uri = redirectUri,
code = code
});
var accessToken = result.access_token;
// update the facebook client with the access token so
// we can make requests on behalf of the user
fb.AccessToken = accessToken;
// Get the user's information
dynamic me = fb.Get("me");
return this.RedirectToAction("Event", "Dashboard", new { eventCode = #event.Code, feature = FeatureType.Update });
}

Linq to Twitter status update

This is my code
For some reason i am unable to update the status i am getting this error .
Your credentials do not allow access to this resource at
var tweet = twitterCtx.UpdateStatus("Hello world");
var auth = new ApplicationOnlyAuthorizer
{
Credentials = new InMemoryCredentials
{
ConsumerKey = "",
ConsumerSecret = ""
}
};
auth.Authorize();
//auth.Invalidate();
var twitterCtx = new TwitterContext(auth);
var tweet = twitterCtx.UpdateStatus("Hello world");
i checked my ConsumerKey and Secret are correct and also i gave my app read write acccess. I am able to get the previous status , User Name but i am just unable to tweet a new status

Application Only authorization can only perform operations that are application-level. This differs from other authorizers that let you operate on behalf of a user. The logic is that a user has an account, but an application doesn't. Therefore, you can't tweet on behalf of an application because the tweet can't be assigned anywhere. However, if you tweet on behalf of a user, the tweet goes into that user's list of statuses (their timeline).
LINQ to Twitter has various authorizers and you can see them in use by downloading samples specific to the technology you're using. The downloadable source code also has samples. Here's an example of how to use the PIN authorizer:
static ITwitterAuthorizer DoPinOAuth()
{
// validate that credentials are present
if (ConfigurationManager.AppSettings["twitterConsumerKey"].IsNullOrWhiteSpace() ||
ConfigurationManager.AppSettings["twitterConsumerSecret"].IsNullOrWhiteSpace())
{
Console.WriteLine("You need to set twitterConsumerKey and twitterConsumerSecret in App.config/appSettings. Visit http://dev.twitter.com/apps for more info.\n");
Console.Write("Press any key to exit...");
Console.ReadKey();
return null;
}
// configure the OAuth object
var auth = new PinAuthorizer
{
Credentials = new InMemoryCredentials
{
ConsumerKey = ConfigurationManager.AppSettings["twitterConsumerKey"],
ConsumerSecret = ConfigurationManager.AppSettings["twitterConsumerSecret"]
},
AuthAccessType = AuthAccessType.NoChange,
UseCompression = true,
GoToTwitterAuthorization = pageLink => Process.Start(pageLink),
GetPin = () =>
{
// this executes after user authorizes, which begins with the call to auth.Authorize() below.
Console.WriteLine("\nAfter authorizing this application, Twitter will give you a 7-digit PIN Number.\n");
Console.Write("Enter the PIN number here: ");
return Console.ReadLine();
}
};
// start the authorization process (launches Twitter authorization page).
auth.Authorize();
return auth;
}
This method returns an instance of PinAuthorizer, auth, and you can use it something like this:
PinAuthorizer auth = DoPinAuth();
var ctx = new TwitterContext(auth);
ctx.UpdateStatus("Hello LINQ to Twitter!");
* Update *
The preceding code was from the old version of LINQ to Twitter. Here's an example of how to do it with the newer async version:
static IAuthorizer DoPinOAuth()
{
var auth = new PinAuthorizer()
{
CredentialStore = new InMemoryCredentialStore
{
ConsumerKey = ConfigurationManager.AppSettings["consumerKey"],
ConsumerSecret = ConfigurationManager.AppSettings["consumerSecret"]
},
GoToTwitterAuthorization = pageLink => Process.Start(pageLink),
GetPin = () =>
{
Console.WriteLine(
"\nAfter authorizing this application, Twitter " +
"will give you a 7-digit PIN Number.\n");
Console.Write("Enter the PIN number here: ");
return Console.ReadLine();
}
};
return auth;
}
And then you can use it like this:
var auth = DoPinOAuth();
await auth.AuthorizeAsync();
var twitterCtx = new TwitterContext(auth);
await twitterCtx.TweetAsync("Hello LINQ to Twitter!");
For more information, you can find Documentation and Source code. The source code has demos in the New\Demos folder.

There's a method on the TwitterContext named UpdateStatus, which you would use like this:
twitterCtx.UpdateStatus(" Your text goes here ");
You'll need to authorize with OAuth for this to work, so take the PIN option in the demo. After you're authorized, you can call UpdateStatus.

Custom Authentication on Asp.Net 4.5 with WIF

I have an application set up with Azure ACS and .net 4.5 using claims. My application uses dropbox also. I was wondering if i could let users identify them self with dropbox alone.
I get a token from dropbox when the user logs in with dropbox and a unique id. Where in the .net pipe do i tell it that i have authenticated a user, such the principals are set on the next request also.
To make the example simple, lets say i have a form with two inputs. name,pass. If the name is 1234 and pass is 1234. then i would like to tell the asp.net pipeline that the user is authenticated. Is this possible? or do i need to create custom token handlers an such to integrate it into WIF?
Update
I found this: I would like comments on the solution, if there are security concerns i should be aware off.
var sam = FederatedAuthentication.SessionAuthenticationModule;
if (sam != null)
{
var cp = new ClaimsPrincipal(new ClaimsIdentity(new List<Claim> {new Claim("Provider","Dropbox")}, "OAuth"));
var transformer = FederatedAuthentication.FederationConfiguration.IdentityConfiguration.ClaimsAuthenticationManager;
if (transformer != null)
{
cp = transformer.Authenticate(String.Empty, cp);
}
var token = new SessionSecurityToken(cp);
sam.WriteSessionTokenToCookie(token);
}
All code:
public HttpResponseMessage get_reply_from_dropbox(string reply_from)
{
var response = this.Request.CreateResponse(HttpStatusCode.Redirect);
var q = this.Request.GetQueryNameValuePairs();
var uid = q.FirstOrDefault(k => k.Key == "uid");
if (!string.IsNullOrEmpty(uid.Value))
{
var sam = FederatedAuthentication.SessionAuthenticationModule;
if (sam != null)
{
var cp = new ClaimsPrincipal(new ClaimsIdentity(new List<Claim> {new Claim("Provider","Dropbox")}, "OAuth"));
var transformer = FederatedAuthentication.FederationConfiguration.IdentityConfiguration.ClaimsAuthenticationManager;
if (transformer != null)
{
cp = transformer.Authenticate(String.Empty, cp);
}
var token = new SessionSecurityToken(cp);
sam.WriteSessionTokenToCookie(token);
}
}
response.Headers.Location = new Uri(reply_from);
return response;
}
public async Task<string> get_request_token_url(string reply_to)
{
var client = new HttpClient();
client.DefaultRequestHeaders.Authorization =
new AuthenticationHeaderValue("OAuth",
string.Format("oauth_version=\"1.0\", oauth_signature_method=\"PLAINTEXT\", oauth_consumer_key=\"{0}\", oauth_signature=\"{1}&\"",
"<dropboxkey>","<dropboxsecret>"));
var data = await client.GetStringAsync("https://api.dropbox.com/1/oauth/request_token");
var pars = data.Split('&').ToDictionary(k=>k.Substring(0,k.IndexOf('=')),v=>v.Substring(v.IndexOf('=')+1));
return "https://www.dropbox.com/1/oauth/authorize?oauth_token=" + pars["oauth_token"]
+ "&oauth_callback=<MYSITE>/api/dropbox/get_reply_from_dropbox?reply_from=" + reply_to;
}
It works by the user request the authentication url, when the user authenticates my app it returns to get_reply_from_dropbox and logs in the user.
I offcause needs to handle some other stuff also, like what if the request do not come from dropbox.

I did this for my site using WIF 3.5 (not exactly the same) but it did use ACS+forms auth+OAuth all together, basically it uses form auth (which you can control completely) or use ACS/OAuth and link the accounts together or just use ACS/OAuth by itself.
You will have to handle logging off differently though.
http://garvincasimir.wordpress.com/2012/04/05/tutorial-mvc-application-using-azure-acs-and-forms-authentication-part-1/
DropBox uses OAuth, so I would go that route and then if you want to "link the accounts" create a user/password for forms auth linked to the DropBox Oauth account. The user doesn't necessarily have to know what auth conventions are being used. ASP.NET MVC 4 has the OAuth/forms auth built in the default project.

Google Authentication Process

I am trying to write a native app to access a users google calendar. I am trying to use the example that google has provided to get authentication but it never seems to fire the authentication function
private void Window_Initialized(object sender, EventArgs e)
{
var provider = new NativeApplicationClient(
GoogleAuthenticationServer.Description);
provider.ClientIdentifier = "<My Client Id here>";
provider.ClientSecret = "<My Client Secret here";
var auth = new OAuth2Authenticator<NativeApplicationClient>(
provider, (p) => GetAuthorization(provider));
CalendarService service = new CalendarService();
CalendarsResource.GetRequest cr = service.Calendars.Get("{primary}");
if (cr.CalendarId != null)
{
Console.WriteLine("Fetching calendar");
//Google.Apis.Calendar.v3.Data.Calendar c =
service.Calendars.Get("{primary}").Fetch();
}
else
{
Console.WriteLine("Service not found");
}
}
Here is the code that I am using for Authentication. I never see the console writeline get published.
private static IAuthorizationState GetAuthorization(NativeApplicationClient arg)
{
Console.WriteLine("Authorization Requested");
IAuthorizationState state = new AuthorizationState(
new[] { CalendarService.Scopes.Calendar.GetStringValue() });
state.Callback = new Uri(NativeApplicationClient.OutOfBandCallbackUrl);
Uri authUri = arg.RequestUserAuthorization(state);
Process.Start(authUri.ToString());
// Request authorization from the user and get the code
string authCode = Console.ReadLine();
// Retrieve the access token by using the authorization code:
return arg.ProcessUserAuthorization(authCode, state);
}
Are there any better tutorials available or am I doing something wrong?

The example code is broken. To make the service use your authenticator, you need to connect it. In the example there is no association between the service and the authenticator. Create the service like this:
var service = new CalendarService(new BaseClientService.Initializer()
{
Authenticator = auth
};
Look at https://code.google.com/p/google-api-dotnet-client/ for better documentation/working code.

Check out the new docs. You'll need to replace
var auth = new OAuth2Authenticator<NativeApplicationClient>(
provider, (p) => GetAuthorization(provider));
with
AuthenticatorFactory.GetInstance().RegisterAuthenticator(
() => new OAuth2Authenticator(provider, GetAuthentication));
As the comment says, when you call var service = new CalendarService(), the previously registered authenticator will automatically be called.

I think the above ways are related to old version of Google calendar DLL. Does any one know about the documentation of new version of Google calendar i.e. V 1.8.1.82. Google never provides the good documentation for .NET developer.s