title: Consume WebAPI2 site from Android client with Google Authentication
body: <p>I've been wracking my brain these past two days to try and understand how to use the authentication built into ASP.NET's WebAPI 2 using Google as an external authentication, and not being familiar with OAuth 2, I'm quite lost. I have followed <a href="https://developers.google.com/identity/sign-in/android/backend-auth" rel="nofollow noreferrer">this tutorial</a> to set up the sign-in button on my Android client and send the "idToken" to the Web API. I've also followed this (now out of date) <a href="http://www.asp.net/web-api/overview/security/external-authentication-services" rel="nofollow noreferrer">tutorial</a> on setting up Google as an external login. </p>
  
  <p>The problem happens when I try to send it I get <code>{"error":"unsupported_grant_type"}</code> as a response. Some other tutorials lead me to believe that the POST to mysite.com/token does not contain the correct data. This means I'm either building the request incorrectlyon the client, I'm somehow handling it incorrectly on the backend, I'm sending it to the wrong url, or I'm doing something entirely else wrong. </p>
  
  <p>I found this <a href="https://stackoverflow.com/a/21358918/1385870">SO answer</a> which says to get a URL from /api/Accounts/ExternalLogins, but the sign-in button already gives me the access token that would supply to me (if I understand that correctly).</p>
  
  <p>If someone could help me out here on what the exact process should be from start to finish, that would be amazing. </p>
  
  <p><strong>UPDATE:</strong> Okay, so here are some things that I've learned since I asked this question. </p>
  
  <ol>
  <li><p>website.com/token URI is the redirect for the built in OAuth server in the WebAPI2 template. This is not useful for this particular problem.</p></li>
  <li><p>The id_token is an encoded <a href="http://jwt.io/" rel="nofollow noreferrer">JWT</a> token.</p></li>
  <li><p>The website.com/signin-google URI is the redirect for normal Google login, but does not accept these tokens.</p></li>
  <li><p>I may have to write my own <a href="http://www.pluralsight.com/training/player?author=dominick-baier&amp;name=webapi-v2-security-m3-architecture&amp;mode=live&amp;clip=0&amp;course=webapi-v2-security" rel="nofollow noreferrer">AuthenticationFilter</a> that uses the <a href="https://developers.google.com/identity/sign-in/android/backend-auth#using-a-google-api-client-library" rel="nofollow noreferrer">Google Client library</a> to authorize through the Google API.</p></li>
  </ol>
  
  <p><strong>UPDATE 2:</strong> I'm still working on getting this AuthenticationFilter Implementation. Things seem to be going well at this point, but I'm getting stuck on some things. I've been using <a href="https://github.com/googleplus/gplus-verifytoken-csharp/blob/master/verifytoken.ashx.cs" rel="nofollow noreferrer">this example</a> to get the token verification code, and <a href="https://www.asp.net/web-api/overview/security/authentication-filters" rel="nofollow noreferrer">this tutorial</a> to get the AuthenticationFilter code. The result is a mix of both of them. I'll post it here as an answer once it's complete.</p>
  
  <p>Here are my current problems:</p>
  
  <ol>
  <li><p>Producing an IPrincipal as output. The verification example makes a ClaimPrincipal, but the AuthenticationFilter example code uses a UserManager to match the username to an existing user and returns that principal. The ClaimsPrincipal as created in the verification example directly does not auto-associate with the existing user, so I need to attempt to match some element of the claims to an existing user. So how do I do that?</p></li>
  <li><p>I still have an incomplete idea of what a proper flow for this is. I'm currently using the Authentication header to pass my id_token string using a custom scheme: "goog_id_token". The client must send their id_token for every method called on the API with this custom AuthenticationFilter. I have no idea how this would usually be done in a professional environment. It seems like a common enough use case that there would be tons of information about it, but I haven't seen it. I have seen the normal OAuth2 flow, and since I'm only using an ID Token, and not an Access Token I'm a bit lost on what an ID Token is supposed to be used for, where it falls in a flow, and where it's supposed to live in an HTTP packet. And because I didn't know these things, I've kind of been making it up as I go along. </p></li>
  </ol>