How to manage security of these self hosted web apis, to ensure that the request coming for accessing data is authenticated?

Question

Let's pretend I am going to work on an enterprise application. Say I have 11 modules in the application and I would have to develop Dashboards for every role in the organization for whom I are going to develop application.

We Decided to use Asp.Net Web Api and return json data from our apis.

We are going to include 11 Self hosted web apis projects in our application (one self hosted web api) for every module.

All 11 modules are connected to one Sql server 2012 Database.

Then once api is ready we would have to create Business Dashboards (Based upon roles in Organization).

So Now my web api client is Asp.Net Mvc application.Asp.Net mvc will consume those web apis.

Here is the part for whom all explanation is done.

How should I manage Security of all 11 self hosted web apis?

How should I only authenticated request is coming?

If I authenticate user by login and password and then redirect user to appropriate Dashboard designed for the role that user have and load data by consuming web apis. How should I ensure that the request coming for accessing data is authenticated?

Answer 1

You could use the same principle as Single Sign On (SSO). Your central authentication app can create a token (when authenticating successfully) that will be passed to the appropriate application where it will get re-checked for validity.

You could even integrate a SSO solution that already does all this logic for you.

Later Edit: Suppose you central authentication app is called Central Authentication. This will be the landing app for all users. This will display a basic login screen. The logic will be as follows:

1. Someone enters his/hers credentials in the Central Authentication app
2. Your backend Controller will check the user name and password against the known users (this depends on where you store your users: a table, Active Directory, remote web service call, etc)
3. If the authentication is successfull, your application will generate a token, let's call it AUTH_TOKEN based on some criteria. A simple example will be: a simple UUID generator, hash(user+pwd+timestamp+random stuff), etc.
4. As you have a common DB for all apps, you can save this token into the DB
5. You redirect to the intended application and also pass this AUTH_TOKEN in the url
6. Once you lend into the intended application, you first check if the token is valid
7. If the token is valid, you let the user access the app, otherwise you print a nice message.

Of course, this is just a basic example. You can add further functionality like token expiry, more secure generation of token, etc.