I'm doing a website in asp that uses Identity (v2.0) and also an Android app connected to the web site through Web API.
I've configured Identity to use Google OAuth signins and works quite well. Right now I'm trying to make a Web API for the app and I also need to authenticate mobile users.
I've reached to the point to configure Identity to manage bearer tokens for the api. But to perform a signin, the only way I've found is through user and password as documentation says:
Ok, somehow I've found how to do it.
In Android, get an ID token using scope audience:server: as in Google "Accounts Authentication and Authorization" docs.
Send Web API token endpoin as user the email and as password the token.
In my extendend class from OAuthAuthorizationServerProvider in the server, I added token verification as from github repo googleplus/gplus-verifytoken-csharp to the method GrantResourceOwnerCredentials
If token is valid, I can populate a UserLoginInfo and find the user with UserManager.
Then normal authentication goes on and user is authenticated in identity as normal.
Anyway, I think there has to be a more elegant way to do it.