How do you install katana-project to allow json tokens?

Question

When I install the OAuth authorization server in asp.net webapi 2, how can I set the token endpoint to accept json and not write the form?

Using the sample http://www.asp.net/web-api/overview/security/individual-accounts-in-web-api

I tried to send the / json application with

{ "grant_type":"password", "username":"Alice", "password":"password123" } 

I get a 400 Bad Request response

 { "error" : "unsupported_grant_type" } 

where as the application content type / x -www-form-urlencoded and the body grant_type=password&username=Alice&password=password123 works as expected.

200 OK

 { "access_token" : "08cQ33ZG728AqBcj1PBsRSs4iBPc02lLCZfpaRRWLx2mH_wpQzMwGDKS7r7VgJiKUjUFaq6Xv0uguINoiB_evVbVOtvyWaqAYvc0HRjlgrbj12uQqFbUB7bgH-jiyfhumkwuTSTVHfKUhBjCuD_pbyxEbu2K5WSJpUVge_SGxnb-htm4ZNf1qKDmpEnP9IpZVeJa-KnV0m0gEmP04slMW_JrO390LzCNvXZwVk1yMNuvDakk8tWX7Y6WkFoh7vtW6xfhw3QMbmnvS6px70yMWcTksRNG2bdmi4SenhuRTJx8IsCMnz-4Co7KiCNJGF7KLeU4WzE-LSqXv3mQ30CIQ7faXoMn53p83wZ1NoXYyhsNrQD4POUns_Isb_Pax5gvpZEdyo8zr1r7wb0dS7UXvJb0PWzLHc57Pg3u0kmcizQ", "token_type" : "bearer", "expires_in" : 1209599, "userName" : "Alice", ".issued" : "Wed, 30 Oct 2013 15:16:33 GMT", ".expires" : "Wed, 13 Nov 2013 15:16:33 GMT" } -htm4ZNf1qKDmpEnP9IpZVeJa-KnV0m0gEmP04slMW_JrO390LzCNvXZwVk1yMNuvDakk8tWX7Y6WkFoh7vtW6xfhw3QMbmnvS6px70yMWcTksRNG2bdmi4SenhuRTJx8IsCMnz-4Co7KiCNJGF7KLeU4WzE-LSqXv3mQ30CIQ7faXoMn53p83wZ1NoXYyhsNrQD4POUns_Isb_Pax5gvpZEdyo8zr1r7wb0dS7UXvJb0PWzLHc57Pg3u0kmcizQ", { "access_token" : "08cQ33ZG728AqBcj1PBsRSs4iBPc02lLCZfpaRRWLx2mH_wpQzMwGDKS7r7VgJiKUjUFaq6Xv0uguINoiB_evVbVOtvyWaqAYvc0HRjlgrbj12uQqFbUB7bgH-jiyfhumkwuTSTVHfKUhBjCuD_pbyxEbu2K5WSJpUVge_SGxnb-htm4ZNf1qKDmpEnP9IpZVeJa-KnV0m0gEmP04slMW_JrO390LzCNvXZwVk1yMNuvDakk8tWX7Y6WkFoh7vtW6xfhw3QMbmnvS6px70yMWcTksRNG2bdmi4SenhuRTJx8IsCMnz-4Co7KiCNJGF7KLeU4WzE-LSqXv3mQ30CIQ7faXoMn53p83wZ1NoXYyhsNrQD4POUns_Isb_Pax5gvpZEdyo8zr1r7wb0dS7UXvJb0PWzLHc57Pg3u0kmcizQ", "token_type" : "bearer", "expires_in" : 1209599, "userName" : "Alice", ".issued" : "Wed, 30 Oct 2013 15:16:33 GMT", ".expires" : "Wed, 13 Nov 2013 15:16:33 GMT" } 

Answer 1

Based on the current implementation of OAuthAuthorizationServerHandler you cannot.

 private async Task InvokeTokenEndpointAsync() { DateTimeOffset currentUtc = Options.SystemClock.UtcNow; // remove milliseconds in case they don't round-trip currentUtc = currentUtc.Subtract(TimeSpan.FromMilliseconds(currentUtc.Millisecond)); IFormCollection form = await Request.ReadFormAsync(); var clientContext = new OAuthValidateClientAuthenticationContext( Context, Options, form); await Options.Provider.ValidateClientAuthentication(clientContext); if (!clientContext.IsValidated) { _logger.WriteError("clientID is not valid."); if (!clientContext.HasError) { clientContext.SetError(Constants.Errors.InvalidClient); } await SendErrorAsJsonAsync(clientContext); return; } var tokenEndpointRequest = new TokenEndpointRequest(form); } 

So, in order to try to do this, you need to provide your own OAuthAuthorizationServerMiddleware implementation that overloads CreateHandler so that you can provide your own AuthenticationHandler<OAuthAuthorizationServerOptions> implementation