How to secure an ASP.NET Core MVC client with a separate Core API?

Question

Currently, I have two clients for the same API, a Xamarin Forms app and an ASP.NET Core MVC project. Instead of using Entity in the MVC project and have to rewrite much of what has already been written in the API, we've decided to use the same API for both (isolating the database in the process).

However, I've been having trouble trying to adapt Identity to this situation. Basically, we need to ask for login info in this MVC client, and then use the separate API to access the server and authenticate this info.

There seems to be a few different ways to go about this, though I haven't yet been able to decide upon one/make one work as there isn't much documentation covering this specific scenario.

Ideally, we'd like to be able to use the [Authorize] and other useful tags from Identity in this client MVC project, but haven't found a way to introduce our own API in this process. Any ideas?

please clarify:"...... and authenticate this info" Do yu mean authenticate the API call(request) or....? — DaniDev
– DaniDev, Commented Mar 25, 2019 at 19:45
@DaniDev Authenticate the user through his name (e-mail) and password in the API (accessing the database and returning the result to the client). — Gabriel Ferreira
– Gabriel Ferreira, Commented Mar 25, 2019 at 19:52
Typically when making API calls from a client app you autherize that call based on your APP credentials (token). see @chris Pratt answer to figure out what would work best for you. If you need to make a request for user specific information you can pass that information along as part of your API request provided you have unique identifying information for that system. This id just s brief explanation to complex although common problem. It is not meant to solve the issue, but rather help you think about it in the right way so that you can figure out what works best for you. — DaniDev
– DaniDev, Commented Mar 25, 2019 at 20:27

Chris Pratt · Accepted Answer · 2019-03-25 19:41:47Z

Identity, at its core, is a user-management framework. The functions of authentication/authorization are only tangentially related. When you start talking about needing to authorize many different applications, especially different types of applications such as mobile app and a website, then you need to start looking into a centralized identity provider. If you want to roll your own, IdentityServer is just about the only game in town. For a hosted solution, you might consider something like Auth0 or Azure Active Directory.

Whichever you choose, you'll need to utilize various flows for different situations. A mobile app will typically use an OAuth flow for user-centric actions, whereas generic non-user specific requests might utilize client credentials. For a website, you'll use cookie authentication and an OIDC flow. Your API(s) will utilize client credentials or perhaps a hybrid auth flow, if you need to support client-side authenticated requests via something like AJAX.

In short, there's no substitute for doing the research here. You'll need to dig in, figure out what you need to support and how you're going to support it. However, regardless of the individual flow, you'll need a centralized identity provider to pull it all off.

That said, the authentication and authorization middleware in ASP.NET Core is not tied to any particular provider. Depending on what you end up going with, you may or may not continue to use ASP.NET Identity (IdentityServer can integrate with that, but something like Auth0 will have it's own user management). However, that has no bearing at all on your ability to continue using things like the Authorize attribute.

Collectives™ on Stack Overflow

How to secure an ASP.NET Core MVC client with a separate Core API?

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related