title: Google authentication from web api: access_denied error
body: <p>I am trying to implement OAuth authentication to WebApi, i have created controller (directly from example) with method:</p>
  
  <pre><code>    [OverrideAuthentication]
      [HostAuthentication(DefaultAuthenticationTypes.ExternalCookie)]
      [AllowAnonymous]
      [Route("ExternalLogin", Name = "ExternalLogin")]
      public IHttpActionResult GetExternalLogin(string provider, string error = null)
      {
          string redirectUri = string.Empty;
  
          if (error != null)
          {
              // However google api returns 'access_denied' as error.
              return BadRequest(Uri.EscapeDataString(error));
          }
  
          if (!User.Identity.IsAuthenticated)
          {
              // This is runned on first execution.
              return new ChallengeResult(provider, this);
          }
  
          // Here we should continue with google api callback.
          ... Rest doesnt matter here.
  </code></pre>
  
  <p>ChallengeResult:</p>
  
  <pre><code>public class ChallengeResult : IHttpActionResult
  {
      public string LoginProvider { get; set; }
      public HttpRequestMessage Request { get; set; }
  
      public ChallengeResult(string loginProvider, ApiController controller)
      {
          LoginProvider = loginProvider;
          Request = controller.Request;
      }
  
      public Task&lt;HttpResponseMessage&gt; ExecuteAsync(CancellationToken cancellationToken)
      {
          Request.GetOwinContext().Authentication.Challenge(LoginProvider);
  
          var response = new HttpResponseMessage(HttpStatusCode.Unauthorized);
          response.RequestMessage = Request;
          return Task.FromResult(response);
      }
  }
  </code></pre>
  
  <p>GetExternalLogin method is called twice, first is from me, after that api send ChallengeResult to google. I am redirected to google site and asked questions for valid scope (can i access. eg to email, profile information and so on), i press yes yes everything is okay for me. However after that google callback returns 'access_denied' error string to this method.</p>
  
  <p>Any idea what may be wrong? Call i used was:</p>
  
  <pre><code>http://localhost:8080/api/Account/ExternalLogin?provider=Google&amp;response_type=token&amp;client_id=49235566333-78t8252p46lo75j5e52vda3o1t8fskgc.apps.googleusercontent.com&amp;redirect_uri=http://localhost:8080
  </code></pre>
  
  <p>Client_id is replaced with dummy account.</p>
  
  <p>redirect_uri is defined correctly to google console, error is different if its is incorrect.</p>
  
  <p>Tried:
  <a href="https://stackoverflow.com/questions/19876123/listing-circles-with-google-for-domains-api-fails-in-access-denied">Listing Circles with Google+ for Domains API fails in access_denied</a> but id:s are identical.</p>
  
  <p>Edit:
  After hours of debugging have figured out that problem between my solution and example is Microsoft.Owing.Security.Google package. In example version used is 2.1.0 and if i update it to 3.0.0 this problem appear.</p>
  
  <p>No idea of root reason yet through.</p>