Our team is looking to introduce Web API, MVC/ASP.NET implementation in our SOA. I am having a hard time trying to wrap my head around the identity and access control it has compared to WCF.
WCF has Windows, X.509, UserName, and WS-Trust (probably more, but this is what I am familiar with), MVC's Web API seems to only have web application based identity and access control built into it: Web Forms, Windows, and WS-Federation.
Has anyone made Web APIs using MVC that implements the protocols that WCF has? Should this even be done / am I trying to use Web API in a way it shouldn't be?