是否可以针对多个身份验证提供程序保护ASP.NET Web API 2应用程序？

Question

I just finished this excellent article about securing an ASP.NET Web API 2 application with OAuth2 against an ADFS/Windows Azure AD instance using ADAL and OWIN middleware components.

However, it seems that the whole authentication workflow described in this article is very much "hard-wired" into the HTTP request pipeline and doesn't leave any room for the implementation of authentication workflows against other authentication providers.

Why is this needed?

I have a mobile web client in which "internal" and "external" users are allowed to authenticate in order to issue requests for user relevant data against an API endpoint.

While the "internal" users are obtaining their authentication tokens from Azure AD/ADFS the "external" users have to authenticate against another system which issues another kind of authentication token.

Therefore I have to be able to distinguish between requests from "internal" and "external" users on the API endpoint level in order to kick off the correct evaluation workflow for their different authentication tokens.

Any indications on how to achieve this would be highly appreciated.

Regards, Matthias

Answer 1

After a little bit of digging I found the following answer which describes how to programmatically validate an JWT based authentication token issued by an ADFS OAuth 2.0 authentication flow using the JwtSecurityTokenHandler class . Code examples can be found in the linked answer.

This would allow me to create a custom authorization filter which I can then use as an attribute on controllers or controller methods. This filter would analyze the Authorization header in the client request, detect the type of authentication token contained in it and then kick off the respective program logic to validate/verify the authentication token.

Something along these lines maybe:

public enum AuthTokenType
{
    OAuth2Bearer,
    Custom
}

public class CustomAuthenticationAttribute : IAuthenticationFilter
{
    public bool AllowMultiple
    {
        get
        {
            throw new NotImplementedException();
        }
    }

    public Task AuthenticateAsync(HttpAuthenticationContext context, CancellationToken cancellationToken)
    {
            HttpRequestMessage incommingRequest = context.Request;
            HttpHeaders headers = incommingRequest.Headers;
            string authHeader = GetHeader(headers, "Authorization");
            AuthTokenType authTokenType = DetecteAuthTokenType(authHeader);

            if (authTokenType == AuthTokenType.OAuth2Bearer) 
            {
               // Validate auth token using the JwtSecurityTokenHandler class
            }
            else if (authTokenType == AuthTokenType.Custom)
            {
               // Validate auth token using whatever is necessary
            }
            else
            {
               // auth token doesn't correspond to a recognized type or hasn't been part of the client request - reject request
            }  
    }

    public AuthTokenType DetectAuthTokenType(string authHeader)
    {
       // Analyze the authorization header string and return its proper type
    }

    private string GetHeader(HttpHeaders headers, string key)
    {
        IEnumerable<string> keys = null;
        if (!headers.TryGetValues(key, out keys))
            return null;

        return keys.First();
    }
}