.Net web API 托管在 IIS 中（API 使用 Bearer Token 进行身份验证）

Question

I am developing one public-internet facing Angular application which call one .Net Proxy API (exposed to internet) which will internally call actual .net API (hosted on-premise). Angular app will get Bearer token from Okta and then call.Net Proxy API. I wanted to know in such scenario where Bearer token will be used for authentication, When I host .net proxy API and.Net actual API in IIS, what i should be selecting in IIS for authentication? Basic or windows or Anonymous or something else?

Flow is: Angular -> OKTA -> Token ->.Net Proxy API ->.Net API -> Database

Answer 1

If the user has to "login" after connecting to your.Net proxy API or.Net API then you will need to allow Anonymous Auth. If they will always definitely have credentials by the time they hit IIS, you will want Basic Authentication. You will likely not want Windows Authentication enabled unless you are going to use windows logins for auth.

This article is old, but should still explain what each auth method does.