title: .Net Core 3.1 MVC OAuth Server
body: <p>I am trying to migrate OAuth server code written for <code>.Net Framework 4.5</code> to <code>.Net Core 3.1</code>. The original code pretty much looks like <a href="https://www.skylinetechnologies.com/Blog/Skyline-Blog/August-2014/Building-an-OAuth2-Authorization-Server-with-DotNe" rel="nofollow noreferrer">this</a>. It implements the <code>IAuthorizationServerHost</code> interface. It makes sense to me that it has some functions that the server should implement (like <code>CreateAccessToken</code> that generates and returns a token).</p>
  <p>But for <code>.Net Core 3.1</code>, <code>DotNetOpenAuth</code> is not available. So I searched around and found apparently the best solution <a href="https://identityserver4.readthedocs.io/en/latest/topics/resources.html" rel="nofollow noreferrer">IdentityServer4</a> along with many other tutorials (<a href="https://feras.blog/how-to-use-asp-net-identity-and-identityserver4-in-your-solution/" rel="nofollow noreferrer">Tut1</a> <a href="https://www.codeproject.com/Articles/1185880/ASP-NET-Core-WebAPI-secured-using-OAuth-Client-Cre" rel="nofollow noreferrer">Tut2</a> etc.). But all those looked to me as if they have just implemented the Identity Server (basically just login, logout and register). I don't see how is the token been issued.</p>
  <p>My controller class in <code>.Net Framework 4.5</code> looks like this. A successful login is usually followed by <code>oauth/authorize</code> route that provisions the token and redirects back to the third party.</p>
  <pre><code>public class OAuthController : Controller
  {
      // OAuth2AuthorizationServer is an implementation if IAuthorizationServerHost
      private readonly AuthorizationServer authorizationServer = new AuthorizationServer(new OAuth2AuthorizationServer());
  
      public ActionResult Token()
      {
          var result = this.authorizationServer.HandleTokenRequest(this.Request).AsActionResult();
          return result;
      }
  
      [Authorize, AcceptVerbs(HttpVerbs.Get | HttpVerbs.Post)]
      public ActionResult Authorize()
      {
          var request = this.authorizationServer.ReadAuthorizationRequest(this.Request);
          if (request == null)
          {
              throw new HttpException((int)HttpStatusCode.BadRequest, &quot;Bad request&quot;);
          }
          var response = authorizationServer.PrepareApproveAuthorizationRequest(request, User.Identity.Name);
          return authorizationServer.Channel.PrepareResponse(response).AsActionResult();
      }
  }
  </code></pre>
  <p>I am new to this authentication stuff - have a quite hollow understanding of the concepts. I am struggling to understand the OAuth server related code flow in these tutorials.</p>
  <p>So how can I use those packages to create an OAuth server in <code>.Net Core 3.1</code>?</p>