使用Owin示例的Asp.Net Web Api安全

Question

I am working to implement OWIN based authentication and authorization. Below is how i am planning to implement.

1) An front end based application with anonymous access with which users can register and it will be in our DB waiting for approval. An admin user will review the users and approve them providing the necessary roles. 2) Those users can consume our different apis by passing the credentials to get the response if authorized by the OWIN authorization server. 3) The owin authentication/authorization as a separate service so it can be used by multiple applications for authentication/authorization and generating the tokens.

My questions are

1) Am I in the right direction and will this approach work? 2) Is there a sample where these applications are constructed in separate solutions?

All the samples that I am seeing are all using the default template and the sample approach. Please help me with any such available sample.

Answer 1

Basically, i think you are on the right track. But i did not quite understood your workflow after the user registration. When the user is registered and his data is stored in the DB you already should provide him the ability to log in (authentication) - send him a token (bearer/refresh) with some basic claims. At the same time, if you need to limit authenticated user abilities to consume your APIs, than you could achieve this by implementing role management (authorization).

See this guide about decoupling authorization server from the resource server. This link may to seem a little bit old, but provides a working samples/ understanding of a workflow.

Also for authentication i would advise you to stick with Json Web Tokens, because they provide a decent way of transfer the state of authenticated user via claims. See this link. and this guide .