My company has a series of WinForms applications that pretty crudely provides authentication by checking usernames and passwords directly against the database (with a little hashing).

I have a fair amount of experience with ASP.NET WebAPI projects, and the single-sign-on experience you get out of the box. By that I mean I can register, log in, use [Authorize] attributes on Controllers and Endpoints, as well as link Facebook, Google, and other providers with relative ease.

What I want to do is create another "provider", or another way to integrate my on-premises authentication scheme with the awesome SSO you get from the ASP.NET WebAPI template projects. Looking through examples, I get a bit lost with OAuth, claims/challenges, and all that stuff. I assume that when the rubber hits the road, I gotta check as username/password against my database, I just am looking for the most straightforward way to turn this into an OWIN app.Use<MyOnPremisesProvider>(), then have access to WebAPI, and also use the token to figure out which on-premises user is linked to the SSO user (kind of like a facebook user gets an SSO account).

Any guidance is greatly appreciated. Thanks!


1 Answer 1


If you want to roll your own password verification OWIN module, here is a post describing how to do it.


If you don't want to go that far, this post shows how to rely on the built in authentication framework and simply override the password check



Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.