The tag has no wiki summary.

learn more… | top users | synonyms

0
votes
0answers
30 views

Implementing internal own authentication

Let me apologize first if this topic is too subjective, or not concrete enough. I want to implement a login api for an internal web service at my company using asp web api 2. I know how to implement ...
0
votes
0answers
28 views

Add Claims/Roles on Resource server (From Token Authorization server)

I've coded up a Web API 2 Authorization server that I am using to get a token for a given user. I can use that token to send requests to my Resource servers that use [Authorize] attribute in the ...
0
votes
0answers
15 views

Using OAuth2 to grant 2 tokens at once

I have a scenario where a client wants to start a foreground session and a background session when a user logs in. The user may log out of the foreground session, ending it and expiring the token, but ...
2
votes
0answers
97 views

OAuth shared Authorization server for multiple apps

At my shop we have a couple .NET Web APIs that use OAuth tokens for authentication. Currently, each web API is both authorization and resource server. Users authenticate to all of these APIs using ...
0
votes
0answers
56 views

What should my redirect URL be for OAuth2.0 in Azure if my application is a local windows application?

I am setting up OAuth2.0 on Azure. I am at the stage where I have been allowed access to the application and a Code has been returned in my redirect URL. My application is a local windows application. ...
0
votes
0answers
15 views

Where you are both the Authorization Server and Resource Server does it make sense to use OAUTH2 for security?

I'm curious if there are any use cases where it makes sense to use OAUTH2 where you are both the protected resource and the authorization server. In this case you have the passwords already for ...
0
votes
0answers
42 views

Communication between resource and authorization server/identity manager?

Short Doing the design / for an api we're building we noticed there is little to nothing to be found on how your resource server can validate a token given by a client with the ...
5
votes
3answers
550 views

OAuth alternative for a 2 party system

I'm writing a RESTful service (Java EE, Jersey) and a client application that communicates with it, and I wish to secure it and store any usernames & passwords dedicated in my own database. I do ...
1
vote
0answers
177 views

How to bypass Oauth2 authentication when the client and resource owner is the same entity?

We are currently working on using an API provided by Mercado Libre which is a maket place for selling various goods. Their APIs use OAuth 2.0 for authentication. The problem is that OAuth 2.0 as ...
1
vote
0answers
84 views

Switching between Azure Mobile Services vs my own implementation. Will UIDs change?

I'm looking at Azure Mobile Services, particularly the Authentication part (which I believe relies exclusively on OAUTH 1 or 2). I want to make sure that my application isn't tightly coupled to the ...
1
vote
0answers
119 views

How to evaluate Secure Authorization for server to client

I have a customer that wants me to build a web portal (Asp.net 4.0) that will communicate with a desktop client, tablet and/or smart phone (e.g. iOS and/or Android). I was thinking of using oAuth ...
1
vote
1answer
404 views

Using oAuth as a complement to an existing authentication system?

I am hoping this is the correct stack exchange to be asking this, here goes. I am building a new website whereby it implements its own custom login system. You simply register your username, email ...
3
votes
2answers
354 views

What's the benefit of Azure ACS if ASP.NET 4.5 includes OAuth and OpenID providers?

Azure ACS offers OAuth and OpenID providers, and now that ASP.NET 4.5 offers the same thing, without the added cost, is there any reason for a .NET developer to consider ACS? (Disclaimer, I don't ...
4
votes
1answer
1k views

OAuth2 flow - does the server validate with the Auth server?

I've been reading a lot on OAuth2 trying to get my head around it, but I'm still confused about something. I understand that the client authorises with the OAuth provider (google for example) and ...