Category Archives: WebAPI

Retrieving bearer tokens from alternative locations in Katana/OWIN

Posted on October 31, 2013 by Dominick Baier

The Katana bearer token authentication middleware tries to retrieve tokens from the HTTP Authorization header with a scheme of Bearer by default. You can customize this behavior by providing a so called Provider (this is a common pattern in Katana). … Continue reading →

Posted in IdentityModel, Katana, OWIN, WebAPI | 16 Comments

Adding SAML11 and SAML2 Support to Katana/OWIN

Posted on October 31, 2013 by Dominick Baier

Katana has pretty straightforward extensibility for adding support for token formats. It ships with built-in support for JWT (consuming) and their internal token format (consuming & producing). By implementing ISecureDataFormat, you can add your own. The following class is a … Continue reading →

Posted in IdentityModel, OWIN, WebAPI | Leave a comment

Thinktecture.IdentityModel v.Next

Posted on October 30, 2013 by Dominick Baier

Thinktecture.IdentityModel (github, nuget) is a popular library in the security community. But we have reached a point now where we realized that we have too many dependencies and too many legacy stuff in it. With the release of Web API … Continue reading →

Posted in .NET Security, ASP.NET, IdentityModel, Katana, OAuth, WCF, WebAPI | 3 Comments

Using AuthorizationServer with Nancy

Posted on October 25, 2013 by Dominick Baier

Yesterday I tried to find out what it takes to connect a Nancy application to AuthorizationServer. Given the OWIN promise, the “hard parts” like JWT validation should come for free now: public class Startup {     public void Configuration(IAppBuilder app) … Continue reading →

Posted in AuthorizationServer, WebAPI | Leave a comment

OWIN Claims Transformation Middleware–Take 2

Posted on October 4, 2013 by Dominick Baier

Thanks to some good feedback from @grumpydev, @loudej and Chriss Ross – I changed my original claims transformation middleware (see here). What I learned is, that for better compatibility and discoverability, you should not expose the types of a specific … Continue reading →

Posted in IdentityModel, Katana, WebAPI | 2 Comments

Thinktecture IdentityModel and Web API v2 / Katana

Posted on October 3, 2013 by Dominick Baier

If you are using IdentityModel and the AuthenticationHandler to secure your Web APIs – we have some good and some bad news. The good news is, that IdentityModel continues to work in Web API v2 when using the “standard” hosting … Continue reading →

Posted in IdentityModel, Katana, WebAPI | Leave a comment

Adding OAuth2 to ADFS (and thus bridging the gap between modern Applications and Enterprise Back ends)

Posted on September 19, 2013 by Dominick Baier

AuthorizationServer can be combined with arbitrary authentication methods, but the fact that it comes pre-configured as a WS-Federation relying party, makes it particularly easy to combine it with e.g. ADFS. This is a really interesting scenario, because it essentially allows … Continue reading →

Posted in AuthorizationServer, IdentityModel, IdentityServer, OAuth, WebAPI | 20 Comments

Claims Transformation Middleware for Katana

Posted on September 18, 2013 by Dominick Baier

One missing piece in Katana security/authentication is claims transformation. Fortunately, this is easy to add: public class ClaimsTransformationMiddleware : OwinMiddleware {     ClaimsAuthenticationManager _claimsAuthenticationManager;       public ClaimsTransformationMiddleware(            OwinMiddleware next,             ClaimsAuthenticationManager claimsAuthenticationManager)        : base(next)     {         if (claimsAuthenticationManager == … Continue reading →

Posted in AuthorizationServer, IdentityModel, Katana, WebAPI | 10 Comments

Using AuthorizationServer with Web API v2/Katana–first look

Posted on September 15, 2013 by Dominick Baier

Traditionally we have used Thinktecture.IdentityModel to parse and validate incoming JWT tokens in Web API. The good news is, there is nothing you have to change when moving to Web API v2 – the delegating handler approach, and thus IdentityModel … Continue reading →

Posted in ASP.NET, AuthorizationServer, IdentityModel, Katana, OAuth, WebAPI | Leave a comment

Two days of Claims-based Identity & Access Control Workshop in London

Posted on July 31, 2013 by Dominick Baier

Great news! The London edition of the NDC conference has pre-con workshops and Jakob invited us to hold our claims-based identity & access control workshop there. This is the first time Brock and I are teaching the workshop together, and … Continue reading →

Posted in .NET Security, ASP.NET, AuthorizationServer, Conferences & Training, IdentityModel, IdentityServer, OAuth, OpenID Connect, WCF, WebAPI | Leave a comment