5 Authorization

Most APIs require authorization to call them. This can be achieved by implementing a IAuthorizationProvider. Again you can assign a default IAuthorizationProvider to an API client, or provide one to specific IApiRequests. There are 2 mechanisms provided out-the-box for authorization.

I make the assumption here that the reader knows what type of authorization is needed for their API.

Basic Authentication

For Basic Authentication, a username and password is sent in the authorization header. To use basic authentication, add this to your startup:

services
     .AddApiAbstractions(context.Configuration)
     .AddHttp()
     .AddBasicAuthorization()

And add to your configuration:

"ApiOptions": {
    "Http": {
      "BasicAuthorization": {
        "<ApiIdentifier Here>": {
          "Username": "test",
          "Password": "test"
        }
      }
    }
}

Then in your IApiClient implementation:

DefaultAuthorizationProvider = serviceProvider.GetRequiredService<HttpBasicAuthorizationProvider>()

OpenID

For OpenID, your client needs to get tokens from an identity provider before sending them along with the API request. To use OpenID, add the following to your startup:

services
      .AddApiAbstractions(context.Configuration)
      .AddHttp()
      .AddOpenIdAuthorization();

And to your configuration:

"ApiOptions": {
    "Http": {
      "OpenIdAuthorization": {
        "<ApiIdentifier Here>": {
          "TokenUri": "<URL to your token endpoint>",
          "ClientId": "test",
          "ClientSecret": "test",
          "Scope": "openid",
          "TokenCacheKey": "openid-token"
        }
      }
    }
  }

Note the TokenCacheKey - this is used to cache access tokens in memory. If you have multiple ApiIdentifiers in one project remember to make these different.

Then in your IApiClient implementation:

DefaultAuthorizationProvider = serviceProvider.GetRequiredService<HttpOpenIdAuthorizationProvider>(),
DefaultRetryPolicies = new []
{
    serviceProvider.GetRequiredService<OpenIdRetryPolicy>()
}

Retry policies will be covered in the following pages, but this one essentially retries once if an Unauthorized response is received.

User flows

That setup was for a client_credentials flow. If you want to use a user based flow, such as code or hybrid, you will need to change the config to

"<ApiIdentifier Here>": {
          "TokenUri": "<URL to your token endpoint>",
          "ClientId": "test",
          "ClientSecret": "test",
          "Scope": "openid",
          "TokenCacheKey": "openid-token",
          "Flow": "User"
        }

The default IApiUserProvider for OpenID assumes that the HttpContext has the following keys stored in the Items dictionary for the signed in user:

• OpenIdAccessToken
• OpenIdRefreshToken
• OpenIdExpiry

If you have a different mechanism for storing user access tokens, you will need to implement and register your own IApiUserProvider.

Custom Authorization

Of course, if your authorization needs are different, you are welcome to implement your own IAuthorizationProvider.