Add a new resource owner password flow sample

[shaunluttin]

This is an additional sample that uses the resource owner password flow.

It will be relevant, for instance, to applications built with AngularJS, which would like to offer authentication/authorization, without needing to rely entirely on external providers.

[kevinchalet]

Wooo, thank you very much! 😄

I'll start bombing you with (cool) remarks as soon as possible.

[kevinchalet]

Is Context. now necessary?

[shaunluttin]

Did I change that? Hmm. I wonder when and why.

[kevinchalet]

That's not something I changed recently: https://github.com/aspnet-contrib/AspNet.Security.OpenIdConnect.Server/blob/dev/samples/Mvc/Mvc.Client/Views/Shared/Home.cshtml 😄

[shaunluttin]

I undid it. I'm not sure why I changed it in the first place.

[kevinchalet]

Please remove this ugly thing 😄

[shaunluttin]

Will do :) I may have some time for this in the near future, because we've just delivered the two proposals that were taking up all my time.

[kevinchalet]

Note: you can remove this file and set these options directly in project.json. See the Mvc sample for more info 👍

[sunsided]

In the samples/ResourceOwnerPasswordFlow/DeveloperNotes folder there's the Mvc_Client_Server_Sample_Notes.txt file with the following note in step 4, Authorization Server obtains End-User Consent/Authorization:

    Something odd happens here, because there's a 200 response,
    that doesn't show up in the web browser,
    and that seems to immediately redirect to the next page.

Indeed the /connect/authorize/accept responds with a 200 and serves an HTML document containing a form with a Click here to finish the authorization process button, that seems to completely go under the radar - it doesn't show up in the browser.

I was a bit puzzled by this as well, however the served document contains the inline script

    <script>document.form.submit();</script>

which solves this mystery.

[shaunluttin]

Thank you @sunsided. 👍 I added that to the notes. https://github.com/bigfont/AspNet.Security.OpenIdConnect.Server/commit/894ff6c24b755ebd77ccc5a420baaa10675fe699

[kevinchalet]

@shaunluttin should I close this PR as discarded?

[shaunluttin]

Hi Kevin,

You can if you like. I may pick it up again in 2016 when work slows down.
That's the way I operate. When work is light, I contribute to community
projects. When it's heavy, I tend to vanish. So, it's up to you. If I had
my preference, though, I would have you keep it open, so that I can pick it
up where it left off.

Best,
Shaun

On Tue, Nov 24, 2015 at 9:12 AM, Kévin Chalet notifications@github.com
wrote:

@shaunluttin https://github.com/shaunluttin should I close this PR as
discarded?

—
Reply to this email directly or view it on GitHub
#98 (comment)
.

[kevinchalet]

Closing this PR, as it's targeting the vNext branch, that will be deleted soon.