I have a ASP.NET Core web application, having builtin authentication.
How can I authenticate Xamarin native mobile app with web app and use web services?
Is there any Xamarin library for authenticating Microsoft Identity Server?
I found an article describing creating web service backend in ASP.NET core, but it omitted authentication (why?) :
https://learn.microsoft.com/en-us/aspnet/core/mobile/native-mobile-backend
In the article they use Web API template, problem is that ASP.NET Core does support personal authentication from a box (at least for right now)
Take a look at this project OpenIddict. It's really easy to use and thay have a lot of examples how to build your own authentication service based on ASP.NET Core Web API. There is only one drawback of this project (by my opinion) - from the box OpenIddict supports only EF Core as data access library, but you can implement your own provider.
There´s no Xamarin client for Microsoft Identity Server per se, but you can use oAuth2. It´s pretty standard.
Implementing an oAuth2 server like OpenIddict, IdentityServer or AspNet.Security.OpenIdConnect.Server you can use any oAuth2 client to authenticate, either way from a javascript application or Xamarin.
For Xamarin/.NET clients, there is an awesome client (PCL) called IdentityModel.
Related
I am going to create an web app using Dot Net Core. In future, i will also create mobile application for the same application. Now, i am in thinking the architecture of the project. I want to use WEB API core using Asp.net Identity Core. Also, i will consume WEB API in MVC Core application. But the question i have in mind that how i can handle ASP.net identity with MVC and WEB API? Do i need to include in MVC as well or only in WEB API?
I tried to think hard but still confuse. Need suggestions.
You can use token based authentication .
In a resource owner flow scenario , your client app( mvc application/native application) will consume your web api by providing user's credential , web api will validate the credential(using ASP.NET Core Identity) in database , If the username and password are correct then a JWT authentication token and the user details are returned. Your client app could validate the token and sign in user :
ASP.NET Core 2.2 - JWT Authentication Tutorial with Example API
Tutorial built with
Token Authentication in ASP.NET Core 2.0 - A Complete Guide
In addition, IdentityServer4 is a good choice when you want to roll your own full-fledged OpenID Connect authorization server that can handle complex use cases like federation and single sign-on.
So your question is maybe a bit open-ended for Stackoverflow and you don't really show what you have tried so far.
I will try to answer though. First you just need to start out with a template for your project. Start an MVC project in which you can easily have API endpoints as well. I would suggest splitting those in two projects for clarity - but if it is just a small personal project then you probably are fine having them in the same project. Microsoft have a pretty good resource on MVC:
Microsoft MVC walkthrough
For the Identity part. You would need some kind of authority for it to work. I suggest you take a look at IdentityServer4. Which offers an excellent walk-through of how to set it up and how to integrate it with Asp.NET Core Identity:
IdentityServer4
I have to develop an ASP.NET MVC website. For authentication, we have decided to use OKTA as the authentication provider. We do not want to use Okta API, but we would like to use SAML implementation. Are there any articles/guidelines available on this? I also would like to know how can we extend this to a WCF service. All of these will be hosted in Azure.
Here are the SAML libraries that I suggest using to add SAML to an ASP.NET MVC website:
For .NET Framework 4.5 or above use Kentor Authentication Services.
For .NET Framework 4 or below use ComponentSpace SAML 2.0. (Paid software, licenses start at $299)
High level guidance on adding SAML support to an existing application is available here: http://developer.okta.com/docs/guides/saml_guidance.html
I am working in application have iOS native application as front end and c# .net as back-end.
Currently I am using WCF REST API for any communication between iOS client and server.
In my application there hare two types of user "Administrator" and "Simple User".
Application have some features those should enabled for admin user only and for "Simple User".
I just need help to create application structure so I can easily maintain features as per end user role.
Also, feature are dynamics and will be added new features in future.
If you are starting with a new service, try switching to Web Api instead of WCF REST API as it is no longer supported by Microsoft.
http://www.asp.net/web-api
You could start using authorization module provided by Asp .Net. This is similar to what you use in an Asp .Net MVC application.
I developed a web system using ASP.NET MVC 4 and I must perform an integration using .NET Web API and Windows Forms Application.
So far everything has been fine, but now I need to authenticate the users using Windows Forms Application and this application will be open on the internet.
My application already contains users that are registered in the database and currently are authenticated using the component 'Authorize' of ASP.NET MVC.
For data consumption through the client (Windows Forms Application) currently I use the library Microsoft ASP.NET Web Client API.
How can I accomplish this task safely?
Does anyone have any suggestions?
You can extend the HttpClient to add authentication. One example can be found here. It shows how to add a HttpMessageHandler into your pipeline for authentication using OAuth.
Here is the complete List of ASP.NET Web API and HttpClient Samples
Take a look at this Q&A which describes creating a custom AuthorizeAttribute for Web API that also authenticates the user using http basic security and grabbing the credentials from the HTTP header. Note that there is a different AuthorizeAttribute for ASP.NET Web API (System.Web.Http.AuthorizeAttribute) as opposed to the one for an MVC controller (System.Web.Mvc.AuthroizeAttribute). They have different behaviors. You do not want a call to a Web API being redirected to a logon page.
Scenario:
I have an ASP.NET MVC 2 site using ASP.NET Forms Authentication.
The site includes a Silverlight 4 application that needs to securely call internal web services.
The web services also need to be publically exposed for third party authenticated access.
Challenges:
Securely accessing webservices from Silverlight using the current users identity without requiring the user to re-login in in the Silverlight application.
Providing a secure way for third party applications to access the same webservices the same users credentials, ideally with out using ASP.NET Forms Authentication.
Additional details and limitations:
This application is hosted in Azure.
We would rather NOT use RIA Services if at all possible.
Solutions Under Consideration:
I think that if the webservices are part of the same MVC site that hosts the Silverlight application then forms authentication should probably "just work" from Silverlight based on the users forms auth cookies. But this seems to rule out the possibility of hosting the webservices seperately (which is desirable in our scenario).
For third-party access to the web services I'm guessing that seperate endpoints with a different authenication solution is probably the right answer, but I would rather only support one version of the services if possible...
Questions:
Can anybody point me towards any sample applications that implements something like this?
How would you recommend implementing this solution?
You can extend WCF to use Membership as authencation store and reuse the FormsAuth Cookie (send by the MVC site) to the browser by the Silverlight app.
I would recommend using an STS with Windows Identity Foundation so you can have your app use claims identity and then change authentication outside the app. For third party you can use Windows Azure Access Control Service (ACS). We are updating our guidance on this and you can look at the new code to show you how to do this at our codeplex site. The original book is available at Amazon. I would focus on the updated guide because it has ACS has websites and an active client talking to WCF. The client is WPF but it would similar for Silverlight.