CODEWITHSUNDEEP
c#asp.net-mvc-4asp.net-web-apiowin
OzB
OzB

Reputation: 2221

OWIN WebAPI 2 Bearer authentication custom identity

I want to allow two types of authentication on my site : * Forms authentication: The user login using his/her details in the form. The authentication should be made using cookies. * Bearer: When calling WebAPI's (for mobile), the authentication should be made only by using bearer tokens.

I've relayed on the SPA template and some questions in SO and did successful made it available. The only problem I'm facing is the ClaimsIdentity: I wish to use custom identity class. However, I'm being able to do so only in forms authentication, not in bearer WebAPI requests.

My custom identity:

public class MyIdentity : ClaimsIdentity, IMyIdentity
{
    #region IMyIdentity

    private Account _account = null;

    public Account Account
    {
        get
        {
            if (_account == null)
            {
                if (this.IsAuthenticated)
                {
                    Guid claimedAccountId = Guid.Parse(this.FindFirst(ClaimTypes.NameIdentifier).Value);

                    var accountService = ServiceLocator.SharedInstance.GetInstance<IAccountService>();

                    _account = accountService.Where(
                        a => a.Id == claimedAccountId
                        ).FirstOrDefault();
                }

                _account = _account ?? Membership.Account.GuestAccount;
            }

            return _account;
        }
    }

    #endregion
}

In Global.asax, I've overridden the Application_OnPostAuthenticateRequest method in order to set the custom identity, and it does working good - but only in forms, not in WebAPI.

In addition, I do set in WebApiConfig.cs

        config.SuppressDefaultHostAuthentication();

so it does make sense that MyIdentity being nulled and User.Identity resets back to ClaimsIdentity.

So to sum up my question - is there a way to define which Identity class will be used, so I can set MyIdentity instead of ClaimsIdentity?

Upvotes: 0

Views: 1988

Answers (1)

adner1
adner1

Reputation: 186

For Web API, you could try hooking into the OWIN authentication pipeline, and implement your own Authentication Filter, and use it to change the current principal to your own:

public class MyAuthenticationFilter : ActionFilterAttribute, IAuthenticationFilter
 {

        public Task AuthenticateAsync(HttpAuthenticationContext context, System.Threading.CancellationToken cancellationToken)
        {
                 if (context.Principal != null && context.Principal.Identity.IsAuthenticated)
                 {
                       CustomPrincipal myPrincipal = new CustomPrincipal();

                       // Do work to setup custom principal

                       context.Principal = myPrincipal;
                 }

               return Task.FromResult(0);
 }

And register the filter:

public static class WebApiConfig
{
        public static void Register(HttpConfiguration config)
        {

            config.Filters.Add(new MyAuthenticationFilter());
            ...

Upvotes: 2

Related Questions