Advice on OpenID/OAuth on ASP.NET Web API RESTful Services

Question

I've been reading a lot about OpenID and OAuth but having trouble making just a few connections about how they would work in a service-based architecture.

Here's my scenario:

• I'm writing new ASP.NET Web API services (RESTful/JSON)
• These services will be used by client applications (current desktop website, new mobile website, and possibly a PHP website or JavaScript-only client in the future)
• Our desktop website currently uses ASP.NET Membership Provider (webforms)

The new set of API services we are creating should handle everything, including Authentication and Authorization.

My questions are:

• Since we have explicit control over the client applications accessing our API (i.e. this isn't a public API but rather one for integrating approved partners) do we necessarily need OAuth?
• Would OpenID replace our .NET Membership functionality, or complement it?
• Given that we would need to authenticate users with the legacy system using Membership Provider, do we need to use some sort of .NET Membership OpenID Provider, or do we just authenticate as usual and grant the user a Membership Token like we currently do?

I guess, in summary:

• I'm writing some new services
• They should be usable by ANY approved client application, for users of that client application
• We need to continue to support our .NET Membership data

Sorry these are basic questions but I'm sure they're easily answered. Thank you!

Answer 1

Look at ThinkTecture's Identity Server

https://github.com/thinktecture/Thinktecture.IdentityServer.v2

It uses repository patterns for user stores, and uses the default membership provider as the user store - you would be able to easily plug-in your legacy membership provider.

OpenID connect would work on top of your membership provider, and you'd enable the option to only allow registered relying parties - meaning that only your approved clients (applications) would have access.

This seems like a perfect fit - hope this helps.

Matt