title: ASP.NET WEB API 2 OWIN Authentication unsuported grant_Type
body: <p>Hi I am trying to set up OAuth bearrer token authentication in my ASP.NET Web API 2 project.
  I have two project one will be the WEB API Project and the other a SPA project.</p>
  
  <p>Here is what I have done so far:</p>
  
  <p>I have created the OWIN Startup class:</p>
  
  <pre><code>[assembly: OwinStartup(typeof(CodeArt.WebApi.App_Start.Startup))]
  
  namespace CodeArt.WebApi.App_Start
  
  {
      public class Startup
      {
          static Startup()
          {
              PublicClientId = "self";
  
          UserManagerFactory = () =&gt; new UserManager&lt;UserModel&gt;(new UserStore&lt;UserModel&gt;());
  
          OAuthOptions = new OAuthAuthorizationServerOptions {
              TokenEndpointPath = new PathString("/Token"),
              Provider = new OAuthAuthorizatonServer(PublicClientId, UserManagerFactory),
              AuthorizeEndpointPath = new PathString("/api/Account/ExternalLogin"),
              AccessTokenExpireTimeSpan = TimeSpan.FromDays(14),
              AllowInsecureHttp = true
          };
      }
  
      public static OAuthAuthorizationServerOptions OAuthOptions { get; private set; }
  
      public static Func&lt;UserManager&lt;UserModel&gt;&gt; UserManagerFactory { get; set; }
  
      public static string PublicClientId { get; private set; }
      public void Configuration(IAppBuilder app)
      {
          ConfigureAuth(app);
      }
  
      public void ConfigureAuth(IAppBuilder app)
      {
          app.UseCookieAuthentication(new CookieAuthenticationOptions());
          app.UseExternalSignInCookie(DefaultAuthenticationTypes.ExternalBearer);
          app.UseOAuthBearerTokens(OAuthOptions);
      }
  }
  </code></pre>
  
  <p>I have configured Web API to use only bearer token authentication:</p>
  
  <pre><code>    private static void ConfigureBearerTokenAuthentication(HttpConfiguration config)
      {
          config.SuppressDefaultHostAuthentication();
          config.Filters.Add(new HostAuthenticationFilter(Startup.OAuthOptions.AuthenticationType));
  
      }
  </code></pre>
  
  <p>I have configured WEB API to support CORS:</p>
  
  <pre><code>    private static void ConfigureCrossOriginResourseSharing(HttpConfiguration config)
      {
          var cors = new EnableCorsAttribute("*", "*", "*");
          config.EnableCors(cors);
      }
  </code></pre>
  
  <p>I have created the OAuthAuthorizationServerProvider class.From this class I only managed to make my code call this method:</p>
  
  <pre><code>   public override Task ValidateClientAuthentication(OAuthValidateClientAuthenticationContext context)
      {
          if(context.ClientId == null)
          {
              context.Validated();
          }
  
          return Task.FromResult&lt;object&gt;(null);
      }
  </code></pre>
  
  <p>The if condition inside of it always gets executed.</p>
  
  <p>On my spa project I have the following:</p>
  
  <p>This is my viewModel:</p>
  
  <pre><code> var vm = {
          grant_type: "password",
          userName: ko.observable(),
          password: ko.observable()
  };
  </code></pre>
  
  <p>When the login button gets clicked I call this function:</p>
  
  <pre><code>     var http = {
            post:function(url, data) {
               return $.ajax({
                  url: url,
                  data: data,
                  type: 'POST',
                  contentType: 'application/json',
                  dataType: 'jsonp'
              });
          }
       }
  
  function loginClick() {
          var model = ko.mapping.toJS(vm.loginModel);
          var rez = $.param(model);
  
          http.post("http://localhost:3439/Token", rez)
              .done(function (data) {
                  console.log(data);
              })
              .fail(function(eror, stuff, otherstuff) {
                  console.log(eror);
                  console.log(stuff);
                  console.log(otherstuff);
              });
      }
  </code></pre>
  
  <p>My first attempt I have set the post calls dataType to json and I got this errors:</p>
  
  <blockquote>
    <p>OPTIONS ...:3439/Token 400 (Bad Request) jquery.js:7845</p>
    
    <p>OPTIONS ...:3439/Token No 'Access-Control-Allow-Origin'
    header is present on the requested resource. Origin
    '...:3304' is therefore not allowed access.
    jquery.js:7845</p>
    
    <p>XMLHttpRequest cannot load ...3439/Token. No
    'Access-Control-Allow-Origin' header is present on the requested
    resource. Origin '...3304' is therefore not allowed
    access.</p>
  </blockquote>
  
  <p>The 3 dots represent <code>http://localhost</code>.</p>
  
  <p>The second time arround I set it datatype to jsonp and I got back an error that stated unsupported "unsupported_grant_type".</p>
  
  <p>Both calls make it to ValidateClientAuthentication that I mentioned above but they are both sent back as a failed request.</p>
  
  <p>Now I am guessing that the problem is more related to how I am sending data instead of the grand_type because the SPA template in Visual Studion set's the grant type to grant_type: "password" like I did.</p>
  
  <p>Also I have read that I have to serialize the data not send it in json in order for this to work here is the exact json serialized data that get's sent:
    "grant_type=password&amp;userName=aleczandru&amp;password=happynewYear&amp;<strong>moduleId</strong>=models%2FappPostModels%2FloginModel"</p>
  
  <p>The model id property get's set to all my object in my SPA template by Durandal Framework.</p>
  
  <p>Can anyone tell me what I am doing wrong I have been trying to figure this out for the last two days?</p>