Search code examples
asp.netasp.net-mvc-4authenticationasp.net-web-api2asp.net-identity-2

What is the recomended method for adding Authorization/Authentication to an MVC application that uses Web API


In most cases, I have used AD to lock down applications through IIS. In this case, I need to create an MVC Application that will have some Web API controllers and authentication/and authorization (roles). I was looking to try to use a stack overflow suggestion that I have found to several other posts.

https://identityserver.github.io/Documentation/docs/overview/mvcGettingStarted.html

Most of the answers that I have seen in Stack Overflow reference the above link

ex). Implementing Authentication and role based authorization in ASP.NET MVC web API service and MVC client architecture

The question that I have for the community that has experience with adding Authentication/Authorization to a combined Web Api/MVC project is if the identity server approach listed above is the best solution for this scenario and if there are other resources that I should look at also?


Solution

  • From your requirements (authenticate to use an MVC site and then be authorized to use a Web API) you'll need an OpenID Connect Provider such as Identity Server 3 (aka a Security Token Service (STS), an Authorization Server, etc). Basically something trusted by both the MVC site and the Web API.

    The basic flow of things here is that your users will authenticate using OpenID Connect on your MVC site, after which they can get an access token to authorize access to the Web API using OAuth.

    The mentioned tutorial is the best way to start. Near the end it takes you through how to access the API on behalf of the user.

    ASP.NET Identity is a user/identity store. It is not add authentication or authorization to your application.