使用WPF客户端对MVC 4 Web Api进行身份验证和授权

Question

I have created a MVC 4 Web Api using Entity Framework Code-First and a WPF-Application as a client in VS 2012.

The problem I'm struggling with at the moment is that I have to enable Authentication from the client and authorize users for access to the Api (for example: Every authenticated user can access GET methods but only admins can use POST or DELETE). I used MVC 4 Internet Application because of Forms Authentication already being included, which worked fine until I tried to login from my client application. After spending some time researching my problem about I realised that Forms Authentication is mainly supposed to work with webbrowsers. I even found some possible solutions to get it working with HttpClient using CookieContainers (eg: How do I set a cookie on HttpClient's HttpRequestMessage ), but nothing works for me.
After spending some hours researching ways to accomplish what I'm trying to do I feel completly stuck..
I've read about SimpleMembershipprovider, BasicAuthentication, OAuth and someone mentioned Thinktecture.Identitymodel, but wasn't really able to decide which would work best.
If there is really no way to use Forms Authentication when connecting with a client other than a webbrowser then what is the best Authentication/Authorization method to take?

I would be very happy if anyone could provide me with a hint on what works best in this case, because after researching for hours I only get more and more confused.

Thanks in advance for any help!

Answer 1

You should be able to do this easily enough, but you haven't said what your problem actually is. Are you

1. unable to get access to your web api actions because you aren't logged in; or
2. unable to make it enforce authorisation (ie you can get anonymous access to actions)

For the second scenario:

There is a very good overview of using Authentication and Authorization in ASP.NET Web API on the server side, and the various ways you can enforce different roles on Actions.

There is also another approach that is appropriate for machine-to-machine (ie where you don't have a user who will type their login details into an appliation dialog box) in Making your ASP.NET Web API's secure , but it doesn't focus on using SimpleMembershipProvider. Instead of using the framework auth&auth components it uses tokens (take care with this approach - rolling your own security is very very hard to get right).

For the first scenario:

From the client side, it sounds like you have some a C# application that user's interact with. If this is the case (rather than the machine-to-machine scenario) then your Forms-based approach is still suitable, and you are doing the right thing with your cookies. The approach would be:

• Ask the client to type their username and password in to your application
• Send a request to your LogIn action on your AccountsController, this will return your authentication cookie, session cookie etc.
• Store the cookies that are returned from this (successful) login (or notify the client if the response was "login failed"
• Then use those cookies in the request to the web api

As you are already talking about using HttpClient , I'm guessing you know what you are doing for this, so haven't provided code samples. I wouldn't use HttpClient , for what it's worth, but HttpWebRequest which allows you to keep a common CookieContainer through the HttpWebRequest.CookieContainer property.