Amazon Alexa skill account linking using IdentityServer4

It took a lot of reading and quite some time to wade though exactly what was required to get Amazon Alexa account linking working with our Identity Server 4 oauth server. Most of the stuff out there was to perform account linking with Amazon's own OAUTH server, and not IdentityServer4.

Well, I finally got to the bottom of it all, and to save you devs valuable time and frustrations, I've laid it all out below:

  1. Create your Asp.Net Core API
  2. Configure Identity Server 4 for account linking
  3. Create your Alexa Skill
  4. Account link your Alexa skill to Identity Server 4. Amazon will take care to call your Identity Server 4 to obtain a token and manage refresh tokens for you.
  5. Call your API from Alexa.

Alexa voice command → Amazon Lambda function → [Hidden Identity Server 4 call] → Asp.Net Core API → Return Speech back to Alexa to say aloud.

Asp.Net Core API

The controller for your Alexa API should look something like this:

The IDataService is used solely for accessing the database and creating a return dto class.
The ISpeechServer takes the dto class and creates speech from it. For example:

Notice that the Controller is protected with
[Authorize(Policy = AuthSecrets.CadAlexaApi)]
That policy is declared in the Startup.cs



Configure Identity Server 4 for account linking

I've separated the identity server 4 from the API and is in a separate solution.
Nothing special in the Program.cs:

Startup.cs:

AuthConfig.cs

AuthSecrets.cs

Clone the IdentityServer4 samples source code from GitHub and copy the Quickstarts, Views and wwwroot folders to your identity server implementation. I previously tried other Quickstarts from other IdentityServer repos, and found this one to be the best. Your mileage may vary...

Nothing special in SeedData.cs

Account link your Alexa skill to Identity Server 4

In https://developer.amazon.com/alexa/console/ask/
Click on Build, and the ACCOUNT LINKING tab on the left




Select the "Auth Code Grant" with the following options:
Authorization URI: https://url-to-your-identity-server/connect/authorize
Access Token URI: https://url-to-your-identity-server/connect/token
Client ID: ALEXA
Client Secret: take the raw unencrypted string from AuthSecrets[CadAlexaApi].Secret
Client Authentication Scheme: HTTP Basic (Recommended)
Scopes:
  • email
  • openid
  • AlexaApi
  • offline_access
Domain List: is empty
Default Access Token Expiration Time: 31536000 Not sure if you can leave this blank or not.
The Redirect URLs shown on your screen are what you need to for Client configuration above.

Call your API from Alexa

I've kept the lambda function as Node.JS.
Install the NPM package node-fetch

Zip the folder up, and upload it to the amazon lambda associated with your skill.

Popular posts from this blog

Execution of user code in the .NET Framework is disabled

I was testing our new SQL Server 2008 enterprise cluster today and managed to get the following SqlException running a C# application: "Execution of user code in the .NET Framework is disabled. Enable "clr enabled" configuration option. The statement has been terminated." The solution is to run the following: EXEC sp_configure 'show advanced options' , '1' ; go RECONFIGURE ; go EXEC sp_configure 'clr enabled' , '1' go RECONFIGURE ; -- Turn advanced options back off -- EXEC sp_configure 'show advanced options' , '0'; GO
Read more

Service Broker sys.transmission_queue clean up

If you’re developing a Service Broker application and you misspell your services, forget to create a master key, or do any of the many things that result in your messages not being delivered, then your transmission queue will fill up. Due to the nature of service broker, errors don't occur at the client but rather your messages go in to Service Brokers sys.transmission_queue and are then subsequently processed. If they fail, they stay in the queue. Some errors can be resolved, i.e. missing services. However, others can't, or are just plain difficult. I.e. You've misspelt something, or not used the correct security. To clear your transmission queue you need to end the conversations, this is a handy little script for doing this. Be aware this ends ALL conversations in the queue and so should NEVER be used on a production system. To see how many messages are in your transmission queue, use this SELECT   COUNT ( 1 )   FROM   sys . transmission_queue On my system i7, D...
Read more

What do I use to write software?

I started off with Dbase III, then Borland Turbo C for about 5 years, then when Microsoft Visual Studio v1.0 came out, I moved to that. I've been using Visual Studio ever since. Coding in C++ and have since moved to C# when that came into existance. Do I use component? Yes. Which ones then? Telerik http://www.telerik.com/ Dundas http://www.dundas.com/ Rebex http://www.rebex.net/ I've also used DevExpress reports, but they peg the CPU to 100% on the webservers when exporting an excel spreadsheet with a lot of data in them, and more often than not, cause a timeout on the ASPX page. So I don't like to use them anymore. My essential toolkit consists of: SVN - Subversion source control http://subversion.tigris.org/ Winrar http://www.rarlab.com/ Colour Schemer (web design) http://www.colorschemer.com/online.html SQL Prompt http://www.red-gate.com/ ANTS Profiler http://www.red-gate.com/ NUnit http://www.nunit.org/ Microsoft Visual Studio http://msdn2.microsoft.com/en-gb/vstudio/de...
Read more