CODEWITHSUNDEEP
asp.netasp.net-mvc-3rest
cangerer
cangerer

Reputation: 135

Looking for authentication/impersonation strategies for a RESTful API

I've got a requirement to allow impersonation ("act as") in my API. So a user with the appropriate permission can exercise the API as another user. I'm wondering if there are some specific strategies employed in this space?

I can create an endpoint to begin and end the impersonation. Beginning the impersonation might involve getting a user and their permissions and loading them into memory for the current request, easy enough. What about subsequent requests? Is it bad practice to add an HTTP header indicating a "Impersonated-User"? If that header exists, use it to do auth on subsequent requests? What about using a cookie with that UserId? Or additional information?

Is there added benefit (assuming a .NET impl) to assigning the impersonated users to the Thread.CurrentPrincipal? The current permission and role implementation is custom, essentially using a bit array (although this is on the table for change in the future).

Upvotes: 6

Views: 1799

Answers (1)

Brian Kelly
Brian Kelly

Reputation: 19305

HTTP doesn't include any native support for delegate credentials / impersonation, so a combination of HTTP Basic Authentication with a custom header indicating which other user the client is trying to act as would be fine.

I would avoid polluting your API with the idea of "beginning and ending the impersonation", however. That implies stateful session knowledge that must be maintained between API calls, and it will make it more difficult to manage on the server side.

I would just have the client pass all the required information (their creds and the impersonation principal) with each call, and validate them each time against the resource being invoked.

Upvotes: 7

Related Questions