Note: I am no architect nor security expert, I will try my best to explain.
Currently I have been tasked to set up a new Web API2 asp.net, c#.
The layer is as follows...
Client >> New(public) Web API >> Current WCF >> MSSQL DB.
The current WCF will be replaced eventually with an internal web API. So it will be like ...
Client >> New(public) Web API >> New(Internal) Web API >> MSSQL DB.
Now currently I have to setup authentication, my original choice was to use identity2 + Oauth bearer tokens on the new web api.
However I have been told I cant, instead they want authentication to be handled in the WCF facade layer as my way isn't secure enough for enterprise.
Can secure a public Web API just using identity and Oauth on the web API? or should i go through the existing WCF layer (WCF is setup with some complex proxy) and use bearer token in the facade.
Should I use Oauth 2.0 and identity2 on the web api layer, or somehow do it on the wcf facade layer?