Authorizing APIs

Let's learn how to implement Token Authorization code using OWIN context in multiple API architectures.

In modern time, we generally use Web APIs. These Web APIs are resource-specific and stateless. Thus, we have to implement security to secure the APIs.

 

In a real-life scenario, we use a microservice architecture. So, we generally create microservices based on the specific domain. For example - we have a microservice named Authorization Service. This will create a token for the API based on the username and password.

 

Content Service

 

This will show the content based on the user or authorization. I am going to demonstrate the authorization code in content service which is deployed on a different server. We will install the below NuGet Packages for implementing the Owin Security.

 

Packages

Microsoft.owin.cors
Microsoft.AspNet.Identity.Owin
Microsoft.Owin.Security.OAuth
Microsoft.Owin.Security
Microsoft.Owin.Host.SystemWeb
Owin
Microsoft.Owin

After adding the package, we will add the StartUp class. This class is the entry point of the request. The request will be received in StartUp, then Middleware, and then the instace of the controller is created.

 

StartUp Class

Public class StartUp {
    Public Static OAuthAutherizationserverOptions oAuth {
        get;
        private set;
    }
    static startup() {
        OAuth = new OAuthAutherizationserverOptions {
            TokenEndPointPath = new PathString("/Token"),
                Provider = new OAuthProvider(),
                AccessTokenExpireTimeSpan = Timespan.FromMInutes(20), // Expiration time of the token
                AllowInsecureHttp = True // for local, On production please do it false
        }
    }
    Public void Configuration(IAppBuilder app) {
        app.UseOAuthBearerTokens(OAuth); // middleware code to authenticate the Bearer token.
    }
}

The below code is for authorizing the context based on the bearer token.

 

Provider class code

Public class X: OAuthAuthorizationServerProvider {
    public override Task ValidateClientAuth(OAuthValidateClientAuthenticationContext c) {
        if (context.ClientId == null) {
            c.Validated();
        }
        return Task.FromResult < object > (null);
    }
}

In this example, we are not generating the token. We are just validating the token in other APIs. We are using the same token which is generated by Authorization service on a different server.

 

We have to use the machine key in the web.config. So, both the servers can share the session.