Windows authentication in MVC app calling WebAPI

Question

We're building a Windows-authenticated ASP.NET MVC app. This will then call into an ASP.NET WebAPI layer sat on a different server.

We don't have Kerberos enabled so assume authentication with this will be via some form of Basic auth. We're also looking to use ASP.NET Membership/Identity for role management. All communication with the Membership database will be via the WebAPI.

Can anyone give guidance on how best to handle issuing authentication tokens for communication between the MVC and WebAPI apps, and how Authorize attributes may be used across both layers?

Taiseer Joudeh · Accepted Answer · 2014-10-27 14:18:41Z

3

I've blogged detailed series of posts about Token based authentication in Web API using ASP.NET Identity, it should answer part of your questions, check it here

answered Oct 27, 2014 at 14:18

Taiseer Joudeh

9,0731 gold badge44 silver badges45 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Rob Bell Over a year ago

Thanks, @Taiseer. This was helpful but the part I'm struggling with is how to take a Windows username on the MVC side and use that as something verifiable to call to the API. The MVC app recognises the Windows user but there is no password or similar to pass to the API to then link to an ASP.NET Identity. Just passing the username doesn't strike me as secure. Anyone could call the API directly with a username and impersonate calls.

Collectives™ on Stack Overflow

Windows authentication in MVC app calling WebAPI

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related