What's the most straightforward way to integrate my company's custom authentication with ASP.NET SSO?

Question

My company has a series of WinForms applications that pretty crudely provides authentication by checking usernames and passwords directly against the database (with a little hashing).

I have a fair amount of experience with ASP.NET WebAPI projects, and the single-sign-on experience you get out of the box. By that I mean I can register, log in, use [Authorize] attributes on Controllers and Endpoints, as well as link Facebook, Google, and other providers with relative ease.

What I want to do is create another "provider", or another way to integrate my on-premises authentication scheme with the awesome SSO you get from the ASP.NET WebAPI template projects. Looking through examples, I get a bit lost with OAuth, claims/challenges, and all that stuff. I assume that when the rubber hits the road, I gotta check as username/password against my database, I just am looking for the most straightforward way to turn this into an OWIN app.Use<MyOnPremisesProvider>(), then have access to WebAPI, and also use the token to figure out which on-premises user is linked to the SSO user (kind of like a facebook user gets an SSO account).

Any guidance is greatly appreciated. Thanks!

Answer 1

If you want to roll your own password verification OWIN module, here is a post describing how to do it.

http://lbadri.wordpress.com/2013/08/03/owin-authentication-middleware-for-hawk-in-thinktecture-identitymodel-45/

If you don't want to go that far, this post shows how to rely on the built in authentication framework and simply override the password check

http://www.khalidabuhakmeh.com/asp-net-mvc-5-authentication-breakdown-part-deux