Possible scenario with Thinktecture Identity Server?

Question

I have an ASP.NET SPA which is data driven by Web Api. It's using default login mechanisms at the moment. A future scenario is to do all communication from the web server to the backend over a queue (RabbitMQ).

Then the simplified structure would looks like this:

User logs on, data exchange is routed over the queue to a backend service. My question is now how make the backend aware if the requst is comming from an authenticated user?

I found the Thinktecture STS and for what I know at the moment it looks very interesting. At least the web authentication should be no issue. but for now it looks to me as there is always a browser or a WCF service needed to do the authentication by the examples shown. There are no plans to use WCF or Azure on our site.

Is it possible to transfer tokens the STS issued over a queue and let the consuming windows service be aware of what to do with these token?

Answer 1

You could do poor man's delegation:

http://www.cloudidentity.com/blog/2013/01/09/using-the-jwt-handler-for-implementing-poor-man-s-delegation-actas/

The other thing you can do is use WS-Trust in IdentityServer to get a delegation token for the backend service.