mvc authentication against web api middle tier

Question

I currently have a web api 2 project acting as my applications middle tier. I need to secure this project as well as provide an authentication service for my MVC project and potentially iOS and Android applications.

The web api business logic requires the checking of the user permissions/roles to ensure security, the mvc project requires the same functionally to ensure the request to the controllers are valid. How do I do this using Asp.net Identity or some other means? Are there any reference projects for this sort of thing?

Answer 1

Some good info here: http://www.asp.net/web-api/overview/security/authentication-filters

Another way I've seen it done is have a separate API to generate access tokens for a 'transaction' using whatever credentials you want to use...but usually done via https! This token is then passed by the client to the business layer API as a parameter. Various checks can be carried out on the token eg Same client that requested token? Token expired? Token already used? Etc

Let me know how you got on.

Thanks.

UPDATE

Web API Security with local accounts: http://www.asp.net/web-api/overview/security/individual-accounts-in-web-api