CODEWITHSUNDEEP
c#asp.netweb-servicesauthenticationasp.net-core
Lin Meyer
Lin Meyer

Reputation: 732

User authentication on website and web service in .NET ASP Core

I am developing a solution using .NET ASP Core. It's current version is monolithic, and I want to switch it to a service architecture consisting of an HTTP API which is used by the iOS/Android apps and web site. Here is a visual:

Architecture comparison

I am using .NET ASP Core on the website and service layers. I have almost finished implementing the changes, but I'm hung up on how to handle authentication on the area of the website that allows administrators to edit the content of the system. The monolithic version uses Identity Core (custom implementation, not using Entity) which works great. I could move the identity authentication code into the service, but I'm not sure how to then handle the authentication on the web site (the apps are public content only, no auth needed). How do I pass the username/password from the website to the service? How do I then track the session between the end user and service layer? Or is another option like OAUTH make more sense? I'd prefer a solution that doesn't require me to implement duplicate roles/policies on the website and service.

Any suggestions welcome, I have no experience with a setup like this so I'm not really even sure where to begin. Thanks!

Upvotes: 1

Views: 508

Answers (1)

mvermef
mvermef

Reputation: 3914

OpenID Connect or OAuth makes sense because all of the claims/roles you already have will be encapsulated into the token. I presently use IdentityServer4 and it works just fine for your exact situation.

Since you are already using Identity database implementation doesn't matter as long as you have a back end. In the end the calls to the site are till http in nature, all very well documented.

http://www.identityserver.io

Upvotes: 2

Related Questions