Web API authentication and authorization

1. CHALERMPON AREEPONG
Microsoft MVP ASP.NET
MVCRocks.NET Community and https://fb.com/groups/mvcthaidev Founder
DevRock #01 Hello New Year 2015

2. DevRock #01 Hello New Year 2015
CHALERMPON AREEPONG
Microsoft MVP – ASP.NET 9 Years

3. DevRock #01 Hello New Year 2015
 ASP.NET Web APIs
 The ways to secure your Web APIs.
 Web Security Scenarios
 Explain each scenarios
 demo
 How to
 Summaries

4. Basic Understanding ASP.NET WEB APIs
DevRock #01 Hello New Year 2015

5. DevRock #01 Hello New Year 2015
 Support HTTP Content-Types
 json, xml, plain text, …, custom
 Client can use HTTP to access the APIs
 HTTP Verbs to access resources
 GET, POST, PUT, DELETE, etc….
 Response HTTP Status Code
 20x, 30x, 40x, 50x
 Multiple Host Types
 IIS, WAS, Windows Service, Console, ..
 Extensible and Customizable

6. DevRock #01 Hello New Year 2015
DEMO

7. DevRock #01 Hello New Year 2015
 Web
 Mobile
 Device
 Application
 Any Client send HTTP Request

8. Basic Understanding Web Security
DevRock #01 Hello New Year 2015

9. DevRock #01 Hello New Year 2015
 Transport Layer Security
 HTTPs Protocol Encryption
 Untrusted (Anonymous)
 Trusted

10. DevRock #01 Hello New Year 2015
 Application Layer Security (1)
 Authentication
 Token-Based
 Two-Factors
 Intranet (IIS Windows)
 LDAP (Active Directory, OpenLDAP)
 OAuth, OpenID
 Identity Services ( Azure AD Service)

11. DevRock #01 Hello New Year 2015
 Application Layer Security (2)
 Authorization
 Role Based
 Claims Based
 …..

12. DevRock #01 Hello New Year 2015
 Application Layer Security (3)
 Data Encryption
 Encryption Algorithms

13. ASP.NET Web APIs architecture
DevRock #01 Hello New Year 2015

14. DevRock #01 Hello New Year 2015
HOST
OWIN
Web API
MessageHandler
global/per-route
Authentication
Filter
Authorization
Filter
Host/Framework
Independent concerns,
e.g. authentication
Web API cross-cutting
concerns, e.g. CORS
Web API specific
Authentication
internal app level
Authorization

15. DevRock #01 Hello New Year 2015
Web API
with OWIN Adpater
OWIN
ASP.NET
with OWIN Bridge
IIS

16. DevRock #01 Hello New Year 2015
Web API
with OWIN Adpater
OWIN
Process/Host
+OWIN Bridge

17. DevRock #01 Hello New Year 2015
Scalability of servers:
 Stateless
 Centralize user info
Loosely coupling
 No dependency Service
Mobile Friendly
 Just keep token for reuse in Native Mobile
app.

18. DevRock #01 Hello New Year 2015
Username / Password
Get token

19. DevRock #01 Hello New Year 2015
ASP.NET WEB API 2.0
 Self Provider
 External Provider