Thinktecture Identity Server: Securing Web APIs (Authorization Best Approach)

Question

When protecting APIs using bearer token authorization:Is there a need to validate that the token was issued from my identity server or its already happening in the background and how do I do that?

What role do scopes play when it comes to bearer tokens?

Answer 1

In short, yes you need to validate that bearer tokens are issued by a issuer you trust. That means either by validating that it's signed by a trusted issuer, or making a API call to the isser you trust to ask it if it indeed is issued by the issuer you trust.

In practice: when talking about Katana, this is done by using a combination of [Authorize] filters/attributes and Owin middleware:

Option 1

The middleware from Microsoft:

app.UseOAuthBearerAuthentication(opts)

https://msdn.microsoft.com/en-us/library/owin.oauthbearerauthenticationextensions.useoauthbearerauthentication(v=vs.113).aspx

https://www.nuget.org/packages/Microsoft.Owin.Security.OAuth

Or, optionally, the middleware from Brock Allen og Dominic Baier:

Option 2

using the following abstraction that builts on top if Microsofts middleware (IF you need the extra features it provides):

app.UseIdentityServerBearerTokenAuthentication(opts)

Source: https://github.com/IdentityServer/IdentityServer3.AccessTokenValidation

NuGet: https://www.nuget.org/packages/IdentityServer3.AccessTokenValidation/

Scopes

When it comes to scopes & API access, scopes are something that represents the resources you want to protect. When a client asks for a access token, it can ask for a token to include a given scope. Your identityprovider then validates that this client is indeed allowed to receive a token with this scope. If successful, the end result is a token allowing the client to call a API using this token.

Since the API trusts token issued by this identityprovider (or token provider), all it has to do is to

1. Validate that that the token is issued by someone that API trusts
2. Check that the token contains the scope that represents it's resource