CODEWITHSUNDEEP
apiauthenticationoauth-2.0asp.net-web-api2
mattnaik
mattnaik

Reputation: 43

web api 2 client and user two part authentication

I am currently being tasked with writing an RESTful API that we are going to release to our clients. I plan to use Web API 2 with OWIN middleware. The applications that will be accessing this can range anywhere from a Console app with no additional user authentication to full blow web applications that will involve user login and authentication.

One other requirement is that we need not only provide user authentication to control what data we will return, we also need to authenticate that the application accessing our API is allowed by our organization. So this requires us to not only validate the application invoking our API's but also the many users logging in via that application.

The goal is to use a bearer token technology like OAuth 2. I am not very familiar with OAuth 2 but after looking it over I don't see a way to facilitate a two part authentication like this. Ideally we would like to issue a clientId and a clientPassword and they would pass this in along with the userid and userpassword and we would then pass a token back.

Is this something that anyone has tackled before using OAuth2 or is this a job for a custom auth solution?

Upvotes: 0

Views: 122

Answers (1)

iandayman
iandayman

Reputation: 4467

What you describe sounds like fairly standard Oauth2.0 scenarios so you shouldn't need anything custom.

For the web apps you could use the Resource Owners Password Credentials Grant. Which is a standard flow.

This allows your Oauth client to pass in its client Id and client secret along with a user's Id and password to your Auth Server which can then validate both the user and the client before issuing a token in response.

But I would recommend using the Authorization Code Grant which is probably the best option for web applications and it involves both the client and the user being effectively authenticated.

For you console apps, or any apps which are not user specific, you can use the Client Credentials Grant. This allows the app to authenticate and to get a token without a user.

If you need your API to be aware of the client application, the only flow you can't really use is the Implicit Grant which doesn't authenticate the client.

Upvotes: 0

Related Questions