How to Authorize request from another WebApi project

user_3955513 0
Viewed 728

There are 2 WebApi Projects on different servers. One of these servers (WebApi-A) has OAuth2 authentication workflow setup with Authorization Server and all.

The another WebApi project (WebApi-B) has an end point that I would like to Authenticate through [Authorize] attribute. I don't want have a new authorization server but to utilize (WebApi-A's) authentication process just to validate the token.

From what I understand if the machine-key is same across these server. We can essentially replicate the authentication process from WebApi-A in WebApi-B without having to call WebApi-A at all.

How do I achieve this?

asp.net-identity oauth-2.0 asp.net-web-api c#
3 Answers

You could, in theory, pass through the JWT token and if your OAuth setup uses the same client secret and data store it should just work. You would have to ensure that you add the JTW token when requesting and to use some distributed cache to verify.

I would rather ask whether or not you should rather create a gateway that can handle and authenticate the requests and delegate them to the separate APIs? This feels like an identity server (http://docs.identityserver.io/en/latest/topics/apis.html) would solve your problem. Anything you do other than moving the authentication from web api A would just be a stopgap.

Duplicating the setup could work but that will mean that you have to now maintain it in two places. So I agree that doing that is less than ideal.

This is a great article that may aid you:

https://www.scottbrady91.com/OAuth/Delegation-Patterns-for-OAuth-20

user_14530280
user_26782180

you can use your token when login in web api and then you add the token to the header "Authorization" with bearer "your token"

user_104916030
Related