1

Our team is looking to introduce Web API, MVC/ASP.NET implementation in our SOA. I am having a hard time trying to wrap my head around the identity and access control it has compared to WCF.

WCF has Windows, X.509, UserName, and WS-Trust (probably more, but this is what I am familiar with), MVC's Web API seems to only have web application based identity and access control built into it: Web Forms, Windows, and WS-Federation.

Has anyone made Web APIs using MVC that implements the protocols that WCF has? Should this even be done / am I trying to use Web API in a way it shouldn't be?

Improve this question

2 Answers 2

Reset to default
0

If you need WS-* use WCF, you will not get it in Web API. This is mainly when you need interop with other systems using it otherwise I personally will avoid it like a plague.

ASP.NET Web API supports federated security via OAuth and OAuth 2.0 which is lighter and much simpler to understand, implement and support. There are other options such as Hawk, etc. But in any case, if I can choose, I will choose OAuth 2.0

Dominick Baier already has an implementation which I believe will become standard security. You can find it here http://thinktecture.github.io/

Improve this answer
2
  • Now there is a good way to decide which to use. WS-* then WCF, no WS-* then Web API is an option with a lot of reasons supporting that choosing that route. Dominick Baier is the man, I am familiar with the thinktechture identityModel, it's great way to have a common ClaimsTransformation that transforms that initial claim into a common set of claims that is standard across both environments. It clicked, thanks!
    – mtleising
    Commented Aug 30, 2013 at 15:05
  • @mtleising pleased to help.
    – Aliostad
    Commented Aug 30, 2013 at 16:16
2

In short: WCF has way too much overhead for simple RESTful services. On the other hand, Web API was designed specifically for RESTful services with control over Http Request/Response.

The advantages of having Web API that i can tell straight ahead are:

  1. I like the control over Http Request/Response
  2. It's easy to follow (leveraging MVC patterns), with more tooling will come

I'm in agreement with Dave Ward on this. Check out his blog for more information.

I’ve long held out against pressure to move from ASMX to WCF in WebForms projects, because accepting WCF’s complexity primarily only rewarded me with less flexible JSON serialization. By contrast, I’ve begun converting some of my projects from ASMX to Web API, and have been pleased with how easily Web API replaces ASMX.

I believe Microsoft has finally found a good balance between ASMX’s simplicity and WCF’s power with Web API.

References on related posts:

Improve this answer
3
  • So what you and Dave are saying is don't use these complex security implementations basically? Web API is best used in simple situations?
    – mtleising
    Commented Aug 30, 2013 at 13:20
  • Yes I understand all of those related posts, I use claims in both WCF and in Web API, usually through some claims transformation process based on some initial credential(initial "claim" in the generic sense). My issue is with that initial credential, WCF supports more secure credential protocols and I'm not sure if Web API does. If it has, I have never seen it used.
    – mtleising
    Commented Aug 30, 2013 at 13:24
  • Yes, in another words, WCF is full set of features that requires a lot more configuration, while Web api offers much more trimmed version of its big brother WCF.
    – Yusubov
    Commented Aug 30, 2013 at 13:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.