Mixing
What is the best way to allow 3rd-party client web applications (not users) as well as my own web client app...
I have been doing some research on the best way to perform the AuthN & AuthZ for a new project but haven't found anything that seems to work for this project's requirements.
I have a .net core API project which needs to be accessed initially only by my Razor Pages web application (separate project).
In the near future, I will need to make the API accessible to 3rd party applications as well (so if a user logs in to this 3rd party app, he automatically can access my API without having to enter UN/PW again - this will likely require some development from the 3rd party team).
I would like to have different roles as well for the users in my Razor Pages Web app & users in the 3rd-party app (for authorization purposes).
The API and Razor Pages app will be running in Azure.
I would like to know if there is one solution that can be used in the API side that will handle both a request from my Razor Pages (preferentially using the token retrieved from the B2C authentication process) and the requests from other 3rd party applications.
I have thought of generating unique JWTs sending that to the 3rd party applications as well as my Razor Pages web app and using the .net core jwtBearer authentication setting in the API side to allow the authentication/authorization (would likely have user role information sent as a claim).
This doesn't seem to be a good solution though since those JWT values would be hard-coded and wouldn't be updated.
Please, let me know what you think would be a good solution.
Thank you.
azure authentication authorization client asp.net-core-webapi asked Jan 2 at 23:29
aacgaacg
34
add a comment |
I have been doing some research on the best way to perform the AuthN & AuthZ for a new project but haven't found anything that seems to work for this project's requirements.
I have a .net core API project which needs to be accessed initially only by my Razor Pages web application (separate project).
In the near future, I will need to make the API accessible to 3rd party applications as well (so if a user logs in to this 3rd party app, he automatically can access my API without having to enter UN/PW again - this will likely require some development from the 3rd party team).
I would like to have different roles as well for the users in my Razor Pages Web app & users in the 3rd-party app (for authorization purposes).
The API and Razor Pages app will be running in Azure.
I would like to know if there is one solution that can be used in the API side that will handle both a request from my Razor Pages (preferentially using the token retrieved from the B2C authentication process) and the requests from other 3rd party applications.
I have thought of generating unique JWTs sending that to the 3rd party applications as well as my Razor Pages web app and using the .net core jwtBearer authentication setting in the API side to allow the authentication/authorization (would likely have user role information sent as a claim).
This doesn't seem to be a good solution though since those JWT values would be hard-coded and wouldn't be updated.
Please, let me know what you think would be a good solution.
Thank you.
azure authentication authorization client asp.net-core-webapi asked Jan 2 at 23:29
aacgaacg
34
add a comment |
I have been doing some research on the best way to perform the AuthN & AuthZ for a new project but haven't found anything that seems to work for this project's requirements.
I have a .net core API project which needs to be accessed initially only by my Razor Pages web application (separate project).
In the near future, I will need to make the API accessible to 3rd party applications as well (so if a user logs in to this 3rd party app, he automatically can access my API without having to enter UN/PW again - this will likely require some development from the 3rd party team).
I would like to have different roles as well for the users in my Razor Pages Web app & users in the 3rd-party app (for authorization purposes).
The API and Razor Pages app will be running in Azure.
I would like to know if there is one solution that can be used in the API side that will handle both a request from my Razor Pages (preferentially using the token retrieved from the B2C authentication process) and the requests from other 3rd party applications.
I have thought of generating unique JWTs sending that to the 3rd party applications as well as my Razor Pages web app and using the .net core jwtBearer authentication setting in the API side to allow the authentication/authorization (would likely have user role information sent as a claim).
This doesn't seem to be a good solution though since those JWT values would be hard-coded and wouldn't be updated.
Please, let me know what you think would be a good solution.
Thank you.
azure authentication authorization client asp.net-core-webapi asked Jan 2 at 23:29
aacgaacg
34
I have been doing some research on the best way to perform the AuthN & AuthZ for a new project but haven't found anything that seems to work for this project's requirements.
I have a .net core API project which needs to be accessed initially only by my Razor Pages web application (separate project).
In the near future, I will need to make the API accessible to 3rd party applications as well (so if a user logs in to this 3rd party app, he automatically can access my API without having to enter UN/PW again - this will likely require some development from the 3rd party team).
I would like to have different roles as well for the users in my Razor Pages Web app & users in the 3rd-party app (for authorization purposes).
The API and Razor Pages app will be running in Azure.
I would like to know if there is one solution that can be used in the API side that will handle both a request from my Razor Pages (preferentially using the token retrieved from the B2C authentication process) and the requests from other 3rd party applications.
I have thought of generating unique JWTs sending that to the 3rd party applications as well as my Razor Pages web app and using the .net core jwtBearer authentication setting in the API side to allow the authentication/authorization (would likely have user role information sent as a claim).
This doesn't seem to be a good solution though since those JWT values would be hard-coded and wouldn't be updated.
Please, let me know what you think would be a good solution.
Thank you.
azure authentication authorization client asp.net-core-webapi azure authentication authorization client asp.net-core-webapi asked Jan 2 at 23:29
aacgaacg
34
asked Jan 2 at 23:29
aacgaacg
34
asked Jan 2 at 23:29
aacgaacg
34
asked Jan 2 at 23:29
aacgaacg
34
asked Jan 2 at 23:29
aacgaacg
34
34
add a comment |
add a comment |
1 Answer
1
active
oldest
votes
You may need to consider Azure AD which provide out of box authentication. Azure AD can be used for end to end protection. You just need to secure your Web API by Azure AD and any client which require to access your API will have to get authenticated by Azure AD and will be issued a token to access your WebAPI. https://docs.microsoft.com/en-us/azure/app-service/app-service-web-tutorial-auth-aad . To manage Authorization you can consider roles https://github.com/Azure-Samples/active-directory-dotnet-webapp-roleclaims
answered Jan 3 at 2:24
Imran ArshadImran Arshad
1,134814
Thank you for your response. I ended up choosing IdentityServer for .NET Core though. Here is a nice video about it... mva.microsoft.com/en-US/training-courses/…
– aacg
Jan 7 at 19:08
Thanks for letting us know. I have used Identity server before and is reasonable choice. In case you are not aware auth0 is also good choice. you can find more about them here auth0.com
– Imran Arshad
Jan 7 at 21:32
add a comment |
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f54014536%2fwhat-is-the-best-way-to-allow-3rd-party-client-web-applications-not-users-as-w%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
You may need to consider Azure AD which provide out of box authentication. Azure AD can be used for end to end protection. You just need to secure your Web API by Azure AD and any client which require to access your API will have to get authenticated by Azure AD and will be issued a token to access your WebAPI. https://docs.microsoft.com/en-us/azure/app-service/app-service-web-tutorial-auth-aad . To manage Authorization you can consider roles https://github.com/Azure-Samples/active-directory-dotnet-webapp-roleclaims
answered Jan 3 at 2:24
Imran ArshadImran Arshad
1,134814
Thank you for your response. I ended up choosing IdentityServer for .NET Core though. Here is a nice video about it... mva.microsoft.com/en-US/training-courses/…
– aacg
Jan 7 at 19:08
Thanks for letting us know. I have used Identity server before and is reasonable choice. In case you are not aware auth0 is also good choice. you can find more about them here auth0.com
– Imran Arshad
Jan 7 at 21:32
add a comment |
You may need to consider Azure AD which provide out of box authentication. Azure AD can be used for end to end protection. You just need to secure your Web API by Azure AD and any client which require to access your API will have to get authenticated by Azure AD and will be issued a token to access your WebAPI. https://docs.microsoft.com/en-us/azure/app-service/app-service-web-tutorial-auth-aad . To manage Authorization you can consider roles https://github.com/Azure-Samples/active-directory-dotnet-webapp-roleclaims
answered Jan 3 at 2:24
Imran ArshadImran Arshad
1,134814
Thank you for your response. I ended up choosing IdentityServer for .NET Core though. Here is a nice video about it... mva.microsoft.com/en-US/training-courses/…
– aacg
Jan 7 at 19:08
Thanks for letting us know. I have used Identity server before and is reasonable choice. In case you are not aware auth0 is also good choice. you can find more about them here auth0.com
– Imran Arshad
Jan 7 at 21:32
add a comment |
You may need to consider Azure AD which provide out of box authentication. Azure AD can be used for end to end protection. You just need to secure your Web API by Azure AD and any client which require to access your API will have to get authenticated by Azure AD and will be issued a token to access your WebAPI. https://docs.microsoft.com/en-us/azure/app-service/app-service-web-tutorial-auth-aad . To manage Authorization you can consider roles https://github.com/Azure-Samples/active-directory-dotnet-webapp-roleclaims
answered Jan 3 at 2:24
Imran ArshadImran Arshad
1,134814
You may need to consider Azure AD which provide out of box authentication. Azure AD can be used for end to end protection. You just need to secure your Web API by Azure AD and any client which require to access your API will have to get authenticated by Azure AD and will be issued a token to access your WebAPI. https://docs.microsoft.com/en-us/azure/app-service/app-service-web-tutorial-auth-aad . To manage Authorization you can consider roles https://github.com/Azure-Samples/active-directory-dotnet-webapp-roleclaims
answered Jan 3 at 2:24
Imran ArshadImran Arshad
1,134814
answered Jan 3 at 2:24
Imran ArshadImran Arshad
1,134814
answered Jan 3 at 2:24
Imran ArshadImran Arshad
1,134814
answered Jan 3 at 2:24
Imran ArshadImran Arshad
1,134814
1,134814
Thank you for your response. I ended up choosing IdentityServer for .NET Core though. Here is a nice video about it... mva.microsoft.com/en-US/training-courses/…
– aacg
Jan 7 at 19:08
Thanks for letting us know. I have used Identity server before and is reasonable choice. In case you are not aware auth0 is also good choice. you can find more about them here auth0.com
– Imran Arshad
Jan 7 at 21:32
add a comment |
Thank you for your response. I ended up choosing IdentityServer for .NET Core though. Here is a nice video about it... mva.microsoft.com/en-US/training-courses/…
– aacg
Jan 7 at 19:08
Thanks for letting us know. I have used Identity server before and is reasonable choice. In case you are not aware auth0 is also good choice. you can find more about them here auth0.com
– Imran Arshad
Jan 7 at 21:32
Thank you for your response. I ended up choosing IdentityServer for .NET Core though. Here is a nice video about it... mva.microsoft.com/en-US/training-courses/…
– aacg
Jan 7 at 19:08
Thank you for your response. I ended up choosing IdentityServer for .NET Core though. Here is a nice video about it... mva.microsoft.com/en-US/training-courses/…
– aacg
Jan 7 at 19:08
Thanks for letting us know. I have used Identity server before and is reasonable choice. In case you are not aware auth0 is also good choice. you can find more about them here auth0.com
– Imran Arshad
Jan 7 at 21:32
Thanks for letting us know. I have used Identity server before and is reasonable choice. In case you are not aware auth0 is also good choice. you can find more about them here auth0.com
– Imran Arshad
Jan 7 at 21:32
add a comment |
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f54014536%2fwhat-is-the-best-way-to-allow-3rd-party-client-web-applications-not-users-as-w%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
