How to develop user-authenticated REST service with Azure ACS

Question

I'm developing a REST service that uses MS Azure Access Control Service for authentication. If the examples are any indication, the typical way to secure a REST service this way would be to provide a global username and pw, private key, or X.509 cert for the protected service. However, I want to use the passive user login mechanism on a mobile device with a flow more like the following:

1. Unauthenticated user attempts to access protected service from app
2. Mobile app redirects to browser app (or embedded browser)
3. User selects identity provider to use for login (facebook, google, etc.) from ACS login page
4. User enters credentials for identity provider
5. Browser redirects back to app
6. App somehow gets the SWT token to use with subsequent REST requests.

I'm stuck at about step 5--getting the SWT token, and the existing examples I've found don't seem to address this scenario. In addition, I'm actually trying to build a proof of concept with a desktop client in WPF, which may complicate things. Can anyone suggest a specific tutorial or a path to pursue that uses the per-user authentication vs. per-service? Thanks.

EDIT: As I'm digging into this deeper, I've realized that the examples posted below (and most others) are based on OAuth WRAP, which has been deprecated in favor of OAuth 2.0. Can anyone suggest a more up to date reference? Googling has turned up http://blogs.msdn.com/b/adventurousidentity/archive/2011/09/18/acs-v2-oauth-2-0-delegation-support-explained.aspx and http://connect.microsoft.com/site1168/Downloads/DownloadDetails.aspx?DownloadID=32719 but they're not the most intuitive.

Answer 1

You should look into the ACS Windows Phone sample:

http://msdn.microsoft.com/en-us/library/gg983271.aspx

Here instead of using Silverlight you will be using WPF. Most of the code should be re-usable. Note that since you are using WPF you will need to register your own object for scripting e.g:

[ComVisibleAttribute(true)]
public class NotifyHandler
{
    public void Notify(string notifyString)
    {
        // Here I have the token.
    }
}

this.webBrowser1.ObjectForScripting = new NotifyHandler();

Update:

The sample above uses OAuth Wrap to contact the secured service. If you would like to use OAuth2 you should change the way the "Authorization" header set:

OAuth WRAP case:

 WebClient client = new WebClient();
 client.Headers["Authorization"] = "OAuth " + _rstrStore.SecurityToken;

OAuth2 case:

 WebClient client = new WebClient();
 client.Headers["Authorization"] = string.Format("OAuth2 access_token=\"{0}\"", token);

You can use the "Simple Service" sample as a guide to implement your token validation in your REST service:

http://msdn.microsoft.com/en-us/library/gg185911.aspx

Yet if you would like to implement a more complete sample you can look at how CustomerInformationService is protected in the CTP version 1.4:

https://connect.microsoft.com/site1168/Downloads/DownloadDetails.aspx?DownloadID=35417

Answer 2

Take a look at this one:

WPF Application With Live ID, Facebook, Google, Yahoo!, Open ID http://social.technet.microsoft.com/wiki/contents/articles/4656.aspx