Quantcast
Channel: Security
Viewing all articles
Browse latest Browse all 4737

WebAPI consumption and transferring active user information (rights) to client applications (WebUI sites, Desktop apps whatever)

$
0
0

PREREQUISITES:

I have implemented WebApi site with OAuth authorization and authentication inside

            OAuthAuthorizationServerOptions OAuthServerOptions = new OAuthAuthorizationServerOptions()
            {                
                AllowInsecureHttp = true,
                TokenEndpointPath = new PathString("/token"),
                AccessTokenExpireTimeSpan = TimeSpan.FromMinutes(1),
                Provider = _unityConfiguration.Resolve<SimpleAuthorizationServerProvider>(),
                RefreshTokenProvider = _unityConfiguration.Resolve<SimpleRefreshTokenProvider>(),
                ApplicationCanDisplayErrors = true
            };            

            // Token Generation
            app.UseOAuthAuthorizationServer(OAuthServerOptions);
            app.UseOAuthBearerAuthentication(new OAuthBearerAuthenticationOptions());

TASK:
Lets say this WebApi located on http://mywebapi.com/
So now i may develop or allow any amount of WebUI sites to access this WebApi by requesting http://mywebapi.com/token with their uniue client_id and client_secret using user/password or refresh_token information.
Also there is implemented WebApi method like http://mywebapi.com/api/account/activeUser which return all needed information about active user
Based on this information WebSites / Desktop client / whatever may convert to ClaimsIdentity object.

MY CURRENT ACTIONS:

On WebUI site I have

            app.UseCookieAuthentication(new CookieAuthenticationOptions()
            {
                AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
                LoginPath = new PathString("/Account/Login"),   
            });

Site does not have access to the database. All actions is done through WebApi. All registered users, roles, allowed actions and claims should be / will be given by WebApi also.

For sure I may develop (and already developing) logic on one of such sites which will call http://mywebapi.com/token on login using HttpClient, which will call refresh token on received 401 error (ActionFilterAttribute) or redirect to account/login page to enter user credential again if refresh token method returns 400 error.
But this is my own implementation and i this to think about other business cases like register user, cookie expiration and so on.

QUESTION:

Is there is simpler standard way to automatically call http://mywebapi.com/token whenewer it needed (login, refresh token), expire website cookie when bearer access token / refresh token expired and so on?
If possible please provide code pieces :) Thanks.


Viewing all articles
Browse latest Browse all 4737

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>