Category Archives: Katana

Retrieving bearer tokens from alternative locations in Katana/OWIN

Posted on October 31, 2013 by Dominick Baier

The Katana bearer token authentication middleware tries to retrieve tokens from the HTTP Authorization header with a scheme of Bearer by default. You can customize this behavior by providing a so called Provider (this is a common pattern in Katana). … Continue reading →

Posted in IdentityModel, Katana, OWIN, WebAPI | 16 Comments

Thinktecture.IdentityModel v.Next

Posted on October 30, 2013 by Dominick Baier

Thinktecture.IdentityModel (github, nuget) is a popular library in the security community. But we have reached a point now where we realized that we have too many dependencies and too many legacy stuff in it. With the release of Web API … Continue reading →

Posted in .NET Security, ASP.NET, IdentityModel, Katana, OAuth, WCF, WebAPI | 3 Comments

OWIN Claims Transformation Middleware–Take 2

Posted on October 4, 2013 by Dominick Baier

Thanks to some good feedback from @grumpydev, @loudej and Chriss Ross – I changed my original claims transformation middleware (see here). What I learned is, that for better compatibility and discoverability, you should not expose the types of a specific … Continue reading →

Posted in IdentityModel, Katana, WebAPI | 2 Comments

Thinktecture IdentityModel and Web API v2 / Katana

Posted on October 3, 2013 by Dominick Baier

If you are using IdentityModel and the AuthenticationHandler to secure your Web APIs – we have some good and some bad news. The good news is, that IdentityModel continues to work in Web API v2 when using the “standard” hosting … Continue reading →

Posted in IdentityModel, Katana, WebAPI | Leave a comment

Claims Transformation Middleware for Katana

Posted on September 18, 2013 by Dominick Baier

One missing piece in Katana security/authentication is claims transformation. Fortunately, this is easy to add: public class ClaimsTransformationMiddleware : OwinMiddleware {     ClaimsAuthenticationManager _claimsAuthenticationManager;       public ClaimsTransformationMiddleware(            OwinMiddleware next,             ClaimsAuthenticationManager claimsAuthenticationManager)        : base(next)     {         if (claimsAuthenticationManager == … Continue reading →

Posted in AuthorizationServer, IdentityModel, Katana, WebAPI | 10 Comments

Using AuthorizationServer with Web API v2/Katana–first look

Posted on September 15, 2013 by Dominick Baier

Traditionally we have used Thinktecture.IdentityModel to parse and validate incoming JWT tokens in Web API. The good news is, there is nothing you have to change when moving to Web API v2 – the delegating handler approach, and thus IdentityModel … Continue reading →

Posted in ASP.NET, AuthorizationServer, IdentityModel, Katana, OAuth, WebAPI | Leave a comment