OAuth 2.0 for Universal Windows apps

The idea is to demonstrate a UWP application which can access an account at Gmail.com (Google provider) or Outlook.com, Hotmail.com or Live.com (Microsoft provider) via IMAP and SMTP without knowing the password of that account.

The basic idea
Register Microsoft project
Register Google project
Create application in Visual Studio
Run application in Visual Studio

The basic idea

Unlike .NET Core version, we cannot use HttpListener to intercept the authorization code from the browser (UWP apps are not allowed to do that, at least not in production). Instead, we're using URL schema registration. The process is as follows:

We launch the system browser to open OAuth provider web site where ther user gives the consent to our application.
The provider web site then redirects to a page with certain URI protocol previously registered to our app. The system lets our app to process that page and grab the authorization code. The rest of the process is similar to other implementations (like for .NET Core, legacy .NET Framework and so on). In this guide, we use pw.oauth2 value for this protocol.

The advantage of the approach in this article is that it does not require you to keep OAuth ClientSecret in your app, storing ClientID is enough.

Register Microsoft project

This is needed only if you want to support Microsoft provider in your application.

Create an application in Application Registration Portal. You may need to create an account there first.

For OAuth 2.0, create a Live SDK application. Click Add an app in Live SDK applications section.

On the next screen, click Add Platform and select Native application, then save changes. If you already have an app (for instance, with Web platform added), you can add a platform to the existing app.

Application ID (Client ID) and is there, you'll need it in the UWP app later. Note that ClientSecret is not required.

Then add a pw.oauth2://oauth2redirect in Custom Redirect URIs section and save changes. pw.oauth2 must match the value from Package Manifest / Declarations / Protocol / Name of your UWP app. You can choose another name, just make sure it matches the name you selcted when adding a protocol in Package Manifest / Declarations. The protocol name must start with a letter and have a dot inside. oauth2redirect part is not important, can be anything, actually.

Make sure to add the required permissions (scopes) as well:

Microsoft is changing things there often. Sometimes, Live SDK app simply doesn't work and you may try creating a Converged application. Also, you may be asked to use Azure portal instead of apps.dev.microsoft.com site. At the moment of writing, Azure portal was not stable enough for that.

Register Google project

This is needed only if you want to support Google (Gmail.com) provider in your application.

First, you need to register a project in your Google Developer Console. See OAuth 2.0 for Google Regular Accounts (installed applications) how. The only difference is that you need to select iOS, not Other in Application type dialog. There is no UWP option but iOS option seems to work well.

Put a pw.oauth2 in Bundle ID field and click Create. pw.oauth2 must match the value from Package Manifest / Declarations / Protocol / Name of your UWP app. It's the protocol part of a redirectUri where the login provider will redirect upon the successful authorization.

You'll also need to set permissions to work with e-mail via IMAP/SMTP and access your e-mail address. See OAuth 2.0 for Google Regular Accounts (installed applications) how.

Configure application in Visual Studio

Open My Documents\MailBee.NET Objects\Samples\WinForms\.NET Core 2.0\C#\OAuthUniversalApp sample project.

In MainPage.xaml.cs, set MicrosoftClientID and/or GoogleClientID to the values you obtained from the respective providers. Set MailBeeLicenseKey field too.

If you changed the redirect URI protocol from pw.oauth2 value to something else, adjust RedirectUriProtocol constant as well.

Change _provider field from Google to Microsoft or vice versa, depending on which provider you want to test.

Run application in Visual Studio

Now build and run the application. How it works:

When the user clicks a button, we check if OAuth token data exists in ApplicationData.Current.LocalSettings the current folder. If yes, we read the stored OAuth token from there.
If no token available, we start the system browser which displays the consent screen on the OAuth login provider (Google or Microsoft) web site.
The user gives the consent and then the OAuth login provider's web site redirects the browser to pw.oauth2://oauth2redirect?code=somecode&some_other_params URI. Because pw.oauth2 URI protocol scheme is associated with our UWP app, the browser asks the user to let our app open this URI.
We then extract the authorization code from the URI. We also check some other parameters (state and code_verifier) to make sure the response from the login provider actually matches the original request from the UWP app.
We then use the authorization code to get the access and refresh tokens from the OAuth login provider, and store them in ApplicationData.Current.LocalSettings.
If the token is available, we check if the access token is not expired.
If the access token is expired, we refresh it using the refresh token. There is expiresAtUtc = expiresAtUtc.AddMinutes(-59); line which you can uncomment to test access token expiration without the need to wait for an hour (for debugging purposes).
Then, we get the profile of the user (e-mail address and display name). In production app, you should cache this info in the database to avoid getting the profile each time you're accessing the mailbox of the user (for performance sake).
We build XOAUTH2 key and use it to authenticate on the IMAP or SMTP server of the login provider, and display the number of e-mail in the inbox or send an e-mail from the user to themselves. useImap bool variable in the code controls whether the action to perform will be "checking mail" or "sending mail".

In case of Google, the redirect URI is pw.oauth2:/oauth2redirect, not pw.oauth2://oauth2redirect (single slash instead of double slash).

Miscellaneous:

This UWP app does not use any OAuth libraries from Microsoft or Google.
It targets .NETStandard 2.0 which (for UWP apps) requires Windows 10 Fall Creators Update or newer.
The app was tested on x86 and x64 platforms.

Send feedback to AfterLogic