7

I have Asp.Net MVC project that have users (I used Asp.Net Identity 2 for this) and i have another Asp.Net WebApi service.

I want to secure authenticate the WebApi to give access for only the Asp.Net MVC users to hit the end points and i don't want to use IdentityServer3 for this purpose.

Asp.Net MVC Startup.Auth.cs:

public void ConfigureAuth(IAppBuilder app)
{
    // Configure the db context, user manager and signin manager to use a single instance per request
    app.CreatePerOwinContext(ApplicationDbContext.Create);
    app.CreatePerOwinContext<ApplicationUserManager>(ApplicationUserManager.Create);
    app.CreatePerOwinContext<ApplicationSignInManager>(ApplicationSignInManager.Create);


    // Enable the application to use a cookie to store information for the signed in user
    // and to use a cookie to temporarily store information about a user logging in with a third party login provider
    // Configure the sign in cookie
    app.UseCookieAuthentication(new CookieAuthenticationOptions
    {
        AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
        LoginPath = new PathString("/Account/Login"),
        Provider = new CookieAuthenticationProvider
        {
            // Enables the application to validate the security stamp when the user logs in.
            // This is a security feature which is used when you change a password or add an external login to your account.  
            OnValidateIdentity = SecurityStampValidator.OnValidateIdentity<ApplicationUserManager, ApplicationUser>(
                validateInterval: TimeSpan.FromMinutes(30),
                regenerateIdentity: (manager, user) => user.GenerateUserIdentityAsync(manager))
        }
    });     

}

I think i should use bearar token and JWT token and i can use Thinketure Identity Model in the WebApi side for this but i searched to find a clear way that describe how to do that but i didn't find?

For example i think that there are many options like SAML, JWT or OAuth 2 authorization code flow but what is the implementation steps?

Marzouk
  • 2,650
  • 3
  • 25
  • 56
  • 2
    Regarding configuring bearer tokens in web api I think this article is one of the best http://bitoftech.net/2014/06/01/token-based-authentication-asp-net-web-api-2-owin-asp-net-identity/ – Marcus Höglund Mar 27 '17 at 11:50
  • 1
    @MarcusH It explain letting the asp.net have the authentication role which is understood but now i want to authenticate the Asp.Net WebApi with another backend which contains the users i think i should using OAuth2/openId Authorization Code Flow – Marzouk Mar 27 '17 at 12:02
  • 1
    I didn't get your question completely but if both applications are frontended by same load balancer then technically they have same domain name and so you just have to write a filter which checks for a cookie (session cookie) and if cookie is present (and is still valid) grant access otherwise deny access.. – dvsakgec Mar 27 '17 at 18:16
  • 1
    If both applications reside on different domains then it is federation scenario and here using either SAML or OAuth tokens makes sense. – dvsakgec Mar 27 '17 at 18:17

0 Answers0