I do a short analysis on the “Claim-based-security for ASP.NET Web APIs using DotNetOpenAuth”
(http://zamd.net/2012/05/04/claim-based-security-for-asp-net-web-apis-using-dotnetopenauth/?goback=%2Egde_4477233_member_121979238).
Few things I tried to short out are listed below:
Why I like this approach:
- It’s easy to implements for any client authentication based API access, basically which (the client) will consume the API.
- Simple flow such as:
- The client request to the issuer for token, actually issuer is the OAuth.
- Using of OAuth AuthorizationServer class which is doing the token issuance request, producing and returning a token for valid & authenticated request.
- Easy to configure resource server to generate keys from the certificate.
- Single REST call base authentication.
- Overall process is short / effort less to integrate with RESTful api using WebAPI framework for client request authentication.
Why I am concern on the following scenario:
- Each and every client request will assume as a new client and apply fresh authentication process, that is:
- This example will simply verify a client has been registered to access the resource rather than the specific user.
- How can we make the request for refresh the token? (We need to implements database part)
- As per current sample with considering current flow than we have to use Microsoft Windows Identity Foundation.
Like this:
Like Loading...
About Md. Marufuzzaman
He is the founder & CEO of MNH Technologies and working for urban and rural sectors to improve people’s lifestyle, better medical facilities, education, social business etc,. The goal of this company is to bring the technology to their hand.He has over eight year of professional experiences in design and developing Client-Server, Multi-Tier, Database, Web based business software solutions, Enterprise Applications, API, Google Analytics implementation, Add-In, Documentation & Technical Writing etc for Windows / Mac using Microsoft SQL Server, Oracle, MySql, PS, C#, VB.NET, ASP.NET, PHP, RoR, Visual Basic etc. He has also more than two years experience in Mobile-VAS (Platform Development).
He was the co-founder & CEO of TadpoleTechnologies and work for various software development & technology consulting. His core focus on technologies to create dynamic data-driven systems that add value to your business and dynamic technology consulting that builds advanced solutions for the industries across the various vertices.
He also work as a Solution Architect at Dhrupadi Techno Consortium Limited (DTCL) and responsible for analyzing business requirements and offered optimum solutions (multiple options), which would address all current requirements, provide flexibility for future growth and allow smooth transition between old system and new system.
He graduated with honors from The University of Asia Pacific, in Computer Science and Engineering. He was awarded as “Most Valuable Professional” (MVP) at 2010 and 2011 by CodeProject.com and also selected as a Mentor of CodeProject.com
Specialties: Software Development Management, System Integration, Data Warehouse Architecture, Virtualization.
View all posts by Md. Marufuzzaman
December 11th, 2012 at 1:45 am
your articles are always awesome, and the design of your website helps to keep it beautiful.
January 5th, 2013 at 6:19 pm
You’ve made the point.
January 15th, 2013 at 4:06 pm
Thanks