Hy everyone,
I'm making an API for Exact Online for a website with a form. The visitor will fill in his information and after that the visitor sends it, it need to be send to the Exact online account from my client. But before that I need a accesstoken. The problem is that I don't want to give the user the login page that Exact will send me. I'm searching already days for a way to skip that login or to enter the login information by backend (there is always 1 login, and that is the login from my client).
Now this authorization thing is something new for me. So far I know I can call my authorization settings from the startup with this:
HttpContext.Authentication.GetAuthenticateInfoAsync("ExactOnline");
But then I get that loginscreen that I don't want. The only thing that Exact is telling me to do:
Create an app registration that supports an automated connection wizard (your provisioning process).
Is there a way to send them the information and the visitor doesn't see a loginpage.
In my Startup.cs
var s = new OAuthOptions { AuthenticationScheme = "ExactOnline", ClientId = "CLIENTID", ClientSecret = "CLIENTSECRET", CallbackPath = new PathString("/callback"), AutomaticAuthenticate = true, AutomaticChallenge = true, AuthorizationEndpoint = new Uri(string.Format("{0}/api/oauth2/auth", "https://start.exactonline.nl")).ToString(), TokenEndpoint = new Uri(string.Format("{0}/api/oauth2/token", "https://start.exactonline.nl")).ToString(), //Scope = { "identity", "roles" }, Events = new OAuthEvents { OnCreatingTicket = context => { context.Identity.AddClaim(new Claim("urn:token:exactonline", context.AccessToken)); return Task.FromResult(true); } } }; app.UseOAuthAuthentication(s);
Also another question: What is the best place to store the accesstoken and refreshtoken.