Category Archives: IdentityModel

My Web API Security Talk from Software Architect 2013

Posted on November 28, 2013 by Dominick Baier

https://vimeo.com/user22258446/review/79095048/9a4d62f61c

Posted in ASP.NET, AuthorizationServer, Conferences & Training, IdentityModel, IdentityServer, Katana, OAuth, OWIN | 5 Comments

Thinktecture.IdentityModel.Client v1.0

Posted on November 23, 2013 by Dominick Baier

As part of the restructuring work of IdentityModel, I separated the HTTP and OAuth2 client bits into a separate project. The nice side effect of this is that the client library is now portable and can be used in .NET … Continue reading →

Posted in IdentityModel, OAuth, WebAPI | 7 Comments

Adding Refresh Tokens to a Web API v2 Authorization Server

Posted on November 15, 2013 by Dominick Baier

In the last post I showed how to add a simple username/password (aka resource owner password credentials flow) authorization server to Web API v2. This has several advantages: The client does not need to hold on to the user credentials … Continue reading →

Posted in AuthorizationServer, IdentityModel, Katana, OAuth, OWIN, WebAPI | 38 Comments

Client Certificate Authentication Middleware for Katana

Posted on November 11, 2013 by Dominick Baier

Katana has no middleware to turn SSL client certificates into a ClaimsIdentity. And since I am currently collecting material for my upcoming Web API security course I used the opportunity to experiment with Katana authentication middleware. There’s a certain pattern … Continue reading →

Posted in IdentityModel, Katana, OWIN, WebAPI | 5 Comments

Thinktecture AuthenticationHandler for Web API v2

Posted on November 3, 2013 by Dominick Baier

Here I mentioned that there are some incompatibilities between AuthenticationHandler and Web API v2/OWIN hosting. As part of making Thinktecture.IdentityModel more modular – I updated the AuthenticationHandler code and did some cleanup. You can find the source code here and … Continue reading →

Posted in IdentityModel, Katana, OWIN, WebAPI | 2 Comments

Retrieving bearer tokens from alternative locations in Katana/OWIN

Posted on October 31, 2013 by Dominick Baier

The Katana bearer token authentication middleware tries to retrieve tokens from the HTTP Authorization header with a scheme of Bearer by default. You can customize this behavior by providing a so called Provider (this is a common pattern in Katana). … Continue reading →

Posted in IdentityModel, Katana, OWIN, WebAPI | 16 Comments

Adding SAML11 and SAML2 Support to Katana/OWIN

Posted on October 31, 2013 by Dominick Baier

Katana has pretty straightforward extensibility for adding support for token formats. It ships with built-in support for JWT (consuming) and their internal token format (consuming & producing). By implementing ISecureDataFormat, you can add your own. The following class is a … Continue reading →

Posted in IdentityModel, OWIN, WebAPI | Leave a comment

Thinktecture.IdentityModel v.Next

Posted on October 30, 2013 by Dominick Baier

Thinktecture.IdentityModel (github, nuget) is a popular library in the security community. But we have reached a point now where we realized that we have too many dependencies and too many legacy stuff in it. With the release of Web API … Continue reading →

Posted in .NET Security, ASP.NET, IdentityModel, Katana, OAuth, WCF, WebAPI | 3 Comments

OWIN Claims Transformation Middleware–Take 2

Posted on October 4, 2013 by Dominick Baier

Thanks to some good feedback from @grumpydev, @loudej and Chriss Ross – I changed my original claims transformation middleware (see here). What I learned is, that for better compatibility and discoverability, you should not expose the types of a specific … Continue reading →

Posted in IdentityModel, Katana, WebAPI | 2 Comments

Thinktecture IdentityModel and Web API v2 / Katana

Posted on October 3, 2013 by Dominick Baier

If you are using IdentityModel and the AuthenticationHandler to secure your Web APIs – we have some good and some bad news. The good news is, that IdentityModel continues to work in Web API v2 when using the “standard” hosting … Continue reading →

Posted in IdentityModel, Katana, WebAPI | Leave a comment