OAuth-as-a-service using ASP.NET Web API and Windows Azure Access Control

APRIL 7, 2023 | SLIDE 1


Maarten Balliauw@maartenballiauwTechnical Consultant Windows AzureRealDolmen

OAuth-as-a-service using ASP.NET Web API and Windows Azure Access Control


Who am I? Maarten Balliauw Antwerp, Belgium www.realdolmen.com Focus on web

ASP.NET MVC, Windows Azure, SignalR, ... MVP Windows Azure & ASPInsider

http://blog.maartenballiauw.be @maartenballiauw Author: Pro NuGet - http://amzn.to/pronuget


Agenda Why would I need an API? API characteristics ASP.NET MVC Web API Windows Azure ACS


WHY WOULD I NEED AN API?


Consuming the web 2000-2008: Desktop browser 2008-2012: Mobile browser 2008-2012: iPhone and Android apps 2010-2014: Tablets, tablets, tablets 2014-2016: Your fridge (Internet of Things)


http://www.tomsguide.com/us/slideshow/Samsung-Wi-Fi-Fridge,0101-297568-0-2-3-1-jpg-.html

http://www.tomsguide.com/us/slideshow/Samsung-Wi-Fi-Fridge-1,0101-297569-0-2-3-1-jpg-.html


Twitter & FacebookBy show of hands…


(as the French say)

Make everyone API


Expose services to 3rd parties

Valuable Flexible Managed Supported Have a plan


Reach More Clients


You’re not the only one

Source: http://blog.programmableweb.com/2012/04/16/open-apis-have-become-an-essential-piece-to-the-startup-model/


API CHARACTERISTICS


What is an API? Software-to-Software interface Contract between software and developers

Functionalities, constraints (technical / legal) Programming instructions and standards

Open services to other software developers (public or private)


Flavours Transport

HTTP Sockets

Message contract SOAP XML Binary JSON HTML …


Technical Most API’s use HTTP and REST extensively

Addressing HTTP Verbs Media types HTTP status codes


DemoThe Web is an API


HTTP Verbs

GET – return data HEAD – check if the data exists POST – create or update data PUT – put data MERGE – merge values with existing data DELETE – delete data


Status codes 200 OK – Everything is OK, your expected data is in

the response. 401 Unauthorized – You either have to log in or you

are not allowed to access the resource. 404 Not Found – The resource could not be found. 500 Internal Server Error – The server failed

processing your request. …


Be detailed!Think about RFC 2324 (HTCPCP)


ASP.NET WEB API


ASP.NET Web API Part of ASP.NET MVC 4 Framework to build HTTP Services (REST) Solid features

Modern HTTP programming model Content negotiation (e.g. xml, json, ...) Query composition (OData query support) Model binding and validation (conversion to .NET objects) Routes Filters (e.g. Validation, exception handling, ...) And more!


ASP.NET Web API is easy! HTTP Verb = action “Content-type” header = data format in “Accept” header = data format out Return meaningful status code


DemoCrafting an API using ASP.NET Web API


Securing your API No authentication Basic/Windows authentication [Authorize] attribute

They all require username/password to be known by the API consumer…


“your API user isn’t really your user, but an application acting on behalf of a user”

(or: API consumer != end user)


OAUTH2


Guest badges Your full-access badge Guest badge

Your name on it Limited scope (only 7th floor) Limited validity (only today)


On the web…


OAuth2 – Initial flow


OAuth2 – “Refresh”


What you have to implement OAuth authorization server Keep track of supported consumers Keep track of user consent OAuth token expiration & refresh Oh, and your API

AARGH!


ACCESS CONTROL SERVICEWindows Azure


ACS - Identity in Windows Azure

Active Directory federation Graph API Web SSO Link apps to identity providers using rules Support WS-Security, WS-Federation, SAML Little known feature: OAuth2 delegation


OAuth flow using ACS


Demo (the big one)ASP.NET Web API, OAuth2, Windows Azure ACS


OAuth2 delegation? You: OAuth authorization server ACS: Keep track of supported consumers ACS: Keep track of user consent ACS: OAuth token expiration & refresh You: Your API


CONCLUSION


Key takeaways API’s are the new apps Valuable HTTP ASP.NET Web API Windows Azure Access Control Service


THANK YOU!

http://blog.maartenballiauw.be@maartenballiauw

http://amzn.to/pronuget

OAuth-as-a-service using ASP.NET Web API and Windows Azure Access Control

Technology

Transcript of OAuth-as-a-service using ASP.NET Web API and Windows Azure Access Control