不同接口的认证/授权

Question

I've got a Windows service where clients should be able to authenticate and authorize via different interfaces, but now I'm not sure what providers/classes/framework I should use.

Requirements on the security context:

• Users
• Groups
• Roles

Requirements on the authentication methods:

• Basic (username/password)
• Windows Login (current)
• Domain login
• Certificate

The interfaces my service provides:

• WCF host (WS-* conform)
• OWIN based Web API (for eg mobile devices)

Now Microsoft provides like a thousand ways to accomplish such a task with numerous classes, frameworks... from the new ASP.Net Identity Model to Forms Authentication to Security Context (WCF) or Principals (Windows) - what I'm looking for is a set of tools that can be used preferably everywhere (persisting in database, passing to WCF client proxies, using with view models in WPF..) What could I use so I don't have to spent the rest of my life mapping classes and data and doing heavy complex domain logic instead of taking advantage of a certain framework?

Answer 1

ThinkTecture's excellent IdentityServer is probably the way to go. More information and downloads are here . Both build on the concept of federated authentication as provided by the Windows Identity Foundation (WIF) and Active Directory Federation Services (AD FS).

For blog posts on IdentityServer check out Dominick Baier's blog at leastprivilege.com .

For more info on WIF and AD FS, Vittorio Bertocci has a great book . You can also download a copy of Microsoft's Guide to Claims-Based Identity and Access Control .