title: Implementation of two legged OAuth 2.0 for WebApi
body: <p>I created a mvc4 webapi project using VS2012RC. I tried to implement two legged Oauth 2 in my project. I followed the tutorial  "http://community.codesmithtools.com/CodeSmith_Community/b/tdupont/archive/2011/03/18/oauth-2-0-for-mvc-two-legged-implementation.aspx", even though it is for mvc i am implementing it for web api. But isn't working </p>
  
  <p>I created a html page for my client side. When the html page load it executes an ajax function which is intended to return "access Token".</p>
  
  <pre><code>       &lt;script type="text/javascript"&gt;
          $(document).ready(function () {
          var url = 'http://localhost:9792/api/Login';
              $.get(url, function(data) {
  
              alert(data);
              }, "jsonp");
          });
          &lt;/script&gt;
  </code></pre>
  
  <p><strong>The server side code is,</strong></p>
  
  <pre><code>[NoCache]
  public class LoginController : ApiController
  {
  
      public LoginModelOAuth GetLogin()
      {
  
          var response = OAuthServiceBase.Instance.RequestToken();
  
          LoginModelOAuth lmo = new LoginModelOAuth();
           lmo.RequestToken = response.RequestToken;
  
          return lmo;
      }
  </code></pre>
  
  <p>}</p>
  
  <p><strong>RequestToken()</strong> method look like,</p>
  
  <pre><code>    public override OAuthResponse RequestToken()
      {
          var token = Guid.NewGuid().ToString("N");
          var expire = DateTime.Now.AddMinutes(5);
          RequestTokens.Add(token, expire);
  
          return new OAuthResponse
          {
              Expires = (int)expire.Subtract(DateTime.Now).TotalSeconds,
              RequestToken = token,
              RequireSsl = false,
              Success = true
          };
      }
  </code></pre>
  
  <p><strong>LoginModelOAuth</strong> model look like,</p>
  
  <pre><code>public class LoginModelOAuth
  {
  
      public string RequestToken { get; set; }      
  
  
      public string ErrorMessage { get; set; }
  
      public string ReturnUrl { get; set; }
  }
  </code></pre>
  
  <p>When i execute the client side code i receive following error </p>
  
  <pre><code>"500 Internal Server Error"
  </code></pre>
  
  <p>So i debugged server side code and in server side I got an error corresponding to this code </p>
  
  <p>"var response = OAuthServiceBase.Instance.RequestToken();" , and the error is</p>
  
  <pre><code>  NullReferenceException was unhandled by user code
  
    "Object reference not set to an instance of an object."
  </code></pre>
  
  <p>My webconfig file look like,</p>
  
  <pre><code>  &lt;configuration&gt;
    &lt;configSections&gt;
  &lt;section name="entityFramework" type="System.Data.Entity.Internal.ConfigFile.EntityFrameworkSection, EntityFramework, Version=4.4.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" requirePermission="false" /&gt;
  &lt;section name="oauth" type="OAuth2.Mvc.Configuration.OAuthSection, OAuth2.Mvc, Version=1.0.0.0, Culture=neutral"/&gt;
  &lt;sectionGroup name="dotNetOpenAuth" type="DotNetOpenAuth.Configuration.DotNetOpenAuthSection, DotNetOpenAuth.Core"&gt;
    &lt;section name="messaging" type="DotNetOpenAuth.Configuration.MessagingElement, DotNetOpenAuth.Core" requirePermission="false" allowLocation="true" /&gt;
    &lt;section name="reporting" type="DotNetOpenAuth.Configuration.ReportingElement, DotNetOpenAuth.Core" requirePermission="false" allowLocation="true" /&gt;
  &lt;/sectionGroup&gt;
   &lt;/configSections&gt;
     &lt;oauth defaultProvider="DemoProvider" defaultService="DemoService"&gt;
      &lt;providers&gt;
        &lt;add name="DemoProvider" type="MillionNodesApi.OAuth.DemoProvider, MillionNodesApi" /&gt;
      &lt;/providers&gt;
  &lt;services&gt;
    &lt;add name="DemoService" type="MillionNodesApi.OAuth.DemoService, MillionNodesApi" /&gt;
  &lt;/services&gt;
    &lt;/oauth&gt;
      &lt;system.web&gt;
      &lt;httpModules&gt;
        &lt;add name="OAuthAuthentication"     type="OAuth2.Mvc.Module.OAuthAuthenticationModule, OAuth2.Mvc, Version=1.0.0.0, Culture=neutral"/&gt;
      &lt;/httpModules&gt;
      &lt;compilation debug="true" targetFramework="4.0" /&gt;
      &lt;authentication mode="Forms"&gt;
        &lt;forms loginUrl="~/Account/Login" timeout="2880" /&gt;
      &lt;/authentication&gt;
       &lt;pages&gt;
       &lt;namespaces&gt;
      &lt;add namespace="System.Web.Helpers" /&gt;
      &lt;add namespace="System.Web.Mvc" /&gt;
      &lt;add namespace="System.Web.Mvc.Ajax" /&gt;
      &lt;add namespace="System.Web.Mvc.Html" /&gt;
      &lt;add namespace="System.Web.Optimization" /&gt;
      &lt;add namespace="System.Web.Routing" /&gt;
      &lt;add namespace="System.Web.WebPages" /&gt;
    &lt;/namespaces&gt;
  &lt;/pages&gt;
  &lt;/system.web&gt;
   &lt;dotNetOpenAuth&gt;
      &lt;messaging&gt;
        &lt;untrustedWebRequest&gt;
      &lt;whitelistHosts&gt;
        &lt;!-- Uncomment to enable communication with localhost (should generally not activate in production!) --&gt;
        &lt;!--&lt;add name="localhost" /&gt;--&gt;
      &lt;/whitelistHosts&gt;
    &lt;/untrustedWebRequest&gt;
  &lt;/messaging&gt;
  &lt;!-- Allow DotNetOpenAuth to publish usage statistics to library authors to improve the library. --&gt;
  &lt;reporting enabled="true" /&gt;
  </code></pre>
  
  <p>
  </p>
  
  <p>Will it work for web api?</p>
  
  <p>If not, please suggest me any tutorial that would help.</p>
  
  <p>Thanks.</p>