Implementing internal own authentication

Question

Let me apologize first if this topic is too subjective, or not concrete enough.

I want to implement a login api for an internal web service at my company using asp web api 2. I know how to implement a owin bearer token system for a single user login scenario for a single website.

The issue here is that I want to provide a single login source for all of the different web applications we will be making in the future. A user will login to this source, it will save the token as a cookie(or something similar) and then continue to work from any number of different web apps afterwards.

So far it seems like all the external web tokens are oriented with Facebook or Google, so external login doesn't seem to be the way i want to go. I don't want to have to rewrite the authentication logic every time I make a new web application. How should I design my application so that I can login using a simple single web API for tokens, and easily integrate authentication into any new web application we make?

*Note: We have an internal Nuget repository that we can use to this effect.

Answer 1

It sounds like you're looking for something like what OAuth already provides, or something falling under the broader category of Single Sign-on, Federated Identity and / or a Credential Service Provider.

So the good news is that there is likely something that already exists and will meet your needs. The benefits here are that you're not rolling your own authentication system and therefore having to chase down implementation flaws that you inadvertently created. Another benefit is that those approaches are more common or recognized and more likely to be acceptable to other users.

The bad news is that you'll need to update the system at least a little bit each time you allow for another provider. Improvements have been made to make things more generic, but there is still a modest measure of coding required for each provider you wish to utilize.

If all of the authentication services you wish to use are internal, then you'll likely be able to setup the providers once and be done with if for a while.

---

As far as structuring your web applications, simply build a dedicated module to handle the authentication component at the web service layer. Each page / service call pulls the claimed user credentials from the client and then passes those credentials over to the authentication component. The authentication component can provide a simply boolean to allow the rest of the call to continue or to exit out.