Note: I am no architect nor security expert, I will try my best to explain.

Currently I have been tasked to set up a new Web API2 asp.net, c#.

The layer is as follows...

Client >> New(public) Web API >> Current WCF >> MSSQL DB.

The current WCF will be replaced eventually with an internal web API. So it will be like ...

Client >> New(public) Web API >> New(Internal) Web API >> MSSQL DB.

Now currently I have to setup authentication, my original choice was to use identity2 + Oauth bearer tokens on the new web api.

However I have been told I cant, instead they want authentication to be handled in the WCF facade layer as my way isn't secure enough for enterprise.

Can secure a public Web API just using identity and Oauth on the web API? or should i go through the existing WCF layer (WCF is setup with some complex proxy) and use bearer token in the facade.

To Clarify

Should I use Oauth 2.0 and identity2 on the web api layer, or somehow do it on the wcf facade layer?

  • If the WCF is going to be eliminated, surely you should build suitably robust authentication into the new Web API rather than relying on the old system for that? That doesn't seem to make sense. I'm not an expert on the authentication technologies, though. – user82096 Apr 10 '17 at 11:11
  • was my argument! but i was told the new internal webapi (hasnt been signed off yet) will do it, the public api shouldn't be in charge of authentication. Im not sure if there being over paranoid but again im not a security expert – lemunk Apr 10 '17 at 11:12
  • 2
    If your public API can't do authentication, then most likely you can't do authorization either. This means that you can't keep unwanted traffic away from the internal service, except by restricting the API endpoints that exist. Your service would be not much more than a translating proxy server. – Bart van Ingen Schenau Apr 10 '17 at 14:49
  • thanks for that information, I've discussed this again with the director, think ive persuaded him to compromise, I can now do authentication on the public api, and then authorize maybe on the facade layer, not sure yet, currently looking at there current implementation of identity2 which seems heavily customized, thanks guys – lemunk Apr 10 '17 at 15:29
  • What about a dedicated auth server? So that neither internal nor external have to deal with the "concern" of authentication. – Laiv Apr 10 '17 at 17:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.