Is this a good idea to use owin.security without identity?

Question

I have an app that uses my own membership system. It uses ASP.NET MVC 3 which I'm updating to ASP.NET MVC 5 . It's not possible to change the membership to use a new one like ASP.NET Identity . But, for the authentication side, do you think it is a good idea to replace my auth-ticket system with OWIN.Security ? Are there any traps that I should know about?

Answer 1

The Katana security middleware is independent from ASP.NET Identity. You can use them both or just one.

Answer 2

There are some cases where it makes very good sense to use just the Owin/Katana middleware, but not involve aspnet identity.

I just rolled up a prototype webforms application using OpenID Connect against an Azure Domain. My domain is Federated with an on-prem ADFS. By the time I got OpenID Connect and the GraphAPI working, I realized that I didn't really need much from aspnet identity.

I use the GraphAPI to grab extra info about the user and their group memberships, and I am adding that info as claims on the user principal... my site's code can operate against just the information in the claims.

Of course, if you want to do any custom profile or role stuff in your application, it probably makes sense to link it to aspnet identity too.. create an aspnet identity user when a new user authenticates, map that user's AD groups to roles, etc. Then you can manage application specific data for the user directly in the application via aspnet identity, while relying on Azure AD for the core authentication, basic profile, and group/role assignments.