.NET Core Windows authentication and OAuth2

2
votes

I'm designing a REST web service which will allow clients to authenticate with username/password and Windows authentication. The choice is .NET Core 2.x so we can deploy on Windows (Server 2008R2 to 2016) and Linux.

Flow:

  • client will authenticate to the web API auth service using either credentials or Windows auth
  • web API auth service validates Windows credentials using Active Directory and standard credentials looking up an internal DB
  • web API auth service generate token and refresh token (OAuth2) so the client can use the tokens for any GET/POST request

From my understanding the big nodes are Windows authentication and OAuth2: - Windows auth seems to be supported out of the box for the web API, but this is not what I want: REST requests should be handled using tokens, only a login request should be validateding effective credentials

  • even if Windows AD says it's a genuine user, I store the username (DOMAIN\user) in the DB. any cons/suggestion?
  • OAuth2 doesn't seem to be supported out of the box. Options?

thanks!

1
.netasp.net-coreoauth-2.0windows-authentication

1 Answers

1
votes

Based on your scenario, I'm sure that the OAuth2 authentication on Windows is more on on-premise Windows authentication, as you want to use Windows Active Directory with domain information.

You have to configure a Windows Server within your Active Directory domain that is joined to the domain and it must have ADFS configured. It is recommended to have at least Windows Server 2016 as the minimum version to provide ADFS, because Windows Server 2016 has full support for both OAuth2 and OpenIDConnect (OIDC) as part of the authentication.

This ADFS setup is important, because having OAuth2/OIDC for your web API means that you are recommended to use "code grant" authentication, therefore you have to provide OAuth consent login screen before the user can access the web API.

For more information, see these articles:

  1. MSDN article on ADFS on Windows Server
  2. OpenID Connect in Windows Server 2016 using ADFS

I highly recommend to use at least Windows Server 2016. because it has ADFS 4.0 to have full support of popular grants (code grant, code id token grant, implicit, resource owner) and also has full support clients of nativeclient (desktop), web API, and daemon service.