3

I have a number of web services created using Microsoft MVC4 Web Api and protected using WIF and Windows Azure Active Directory (WAAD) using WS-Fed.

I also have a pure HTML5/Javascript single page application (SPA) client that needs to access these web api's.

Are there any known samples/libraries in Javascript for handling the interactions with WAAD to

  • Determine if the user is already logged in.
  • Log in the user and obtain a security token if required
  • Log out once interaction is finished.

If not, are there any recommended links to the documentation required to implement something like that.

rbrayb
  • 46,440
  • 34
  • 114
  • 174
Quintus Marais
  • 810
  • 9
  • 15
  • There is a javascript library for authentication using OAuth 2.0, nothing around ACS that I know of. – letsc May 13 '13 at 16:00

1 Answers1

3

Is the page (SPA) coming from the same server the API's are hosted? (same domain?) If that's the case, then everything should "just work".

WAAD is not involved in knowing whether the user is logged on or not. That should generally be up to your site. Token expiration does play a role though, if the supplied token is rejected by the API you would have to re-authenticate the user as usual.

If the APIs are on a different site, but same hi-level domain (app.yoursite.com and api.yoursite.com), you can still set cookies and use WIF underneath. Make sure you set the same machine key on both sites.

If the APIs are on a completely different domain, then you have to use a different approach. My recommendation in that case is usually to use Json Web Tokens (JWT) and CORS.

I think WAAD can give you a JWT if you configure an ACS namespace in your WAAD instance. Take a look at this document that describes the process for securing WebAPI with JWTs (it is not specific to WAAD, but the mechanics would be the same).

Eugenio Pace
  • 14,094
  • 1
  • 34
  • 43