4

We currently have a typical forms authentication setup in our organisation; with a login page located at something like account/login. We want to retain this but also want to start securing some of our APIs with OAUTH2 ; essentially we are the provider.

From reading a fair bit about the subject Microsoft's OWIN OAUTH implementation moving forward isn't supported (e.g. vNext) and doesnt support all the flows with OAUTH2. Thinktecture's identityserver3 seems to be the "standard" and most complete solution there is currently.

I cant seem to find an example of using identityserver3 with an existing app that requires forms authentication.

We would be looking at using it in two different ways; one using the implicit flow using javascript where we allow a third party site to call our API once the user has logged in to us (using the forms auth) and the user has allowed the client to access specific scopes.

The other use case, I think , would use the authorisation code flow ; the client would be requesting this so it can auto login (much like a login with Facebook - but login with X company) or be already logged in if logged in our site.

Any help with these scenarios would be most appreciated.

Barry King
  • 683
  • 1
  • 6
  • 21
  • Have you already implemented and started working with Identity Server? I'm trying to do the same thing as you except I want Identity Server to provide the forms authentication for a mobile app. – cr1pto May 05 '16 at 21:49

1 Answers1

1

I think it will not be possible to switch your app to OAuth without changing your existing login. I would suggest you use Identity server with custom user store(https://identityserver.github.io/Documentation/docsv2/advanced/userService.html) to use your current user database. That way your existing login accounts will be used by the identity server.

You can then secure your APIs with OAuth using the Identity server. You might need to change the way your current app call the APIs too. This means users of the current app will be redirected to identity server's login page. You can brand your login pages using custom views to make it appear similar to the curent login page (https://identityserver.github.io/Documentation/docsv2/advanced/customizingViews.html)

rawel
  • 2,923
  • 21
  • 33