Restful Service and User role authorization

Question

We are creating a Restful Web API for our client which would be consumed by their Native Mobile apps and Web apps only no third party access.

Each user has his own credentials and Role in Application, and role based access aka Authorization.

What is best way to authenticate and role authorization of user in web API without keeping session. I am using Asp.net web API 1.0 as i am on 4.0 framework.

Do i need to get Role information from DB on each call. any efficient way?

Have you considered using API gateways e.g. Apigee or Layer 7 that will handle AuthN and AuthZ for you? — David Brossard, Dec 02 '13 at 13:24

score 0 · Answer 1 · edited May 23 '17 at 10:31

If you are in a .NET-based environment, you can choose from multiple authentication schemes and independently choose multiple access control / authorization schemes.

For the authentication, the simplest way is to use the mechanisms supported by HTTP i.e. HTTP Basic authentication. You can also look at Kerberos-based authentication. All these are available OOTB in .NET.

You can also consider Open ID Connect or OAuth but that will require additional libraries.

As for the authorization, .NET gives you claims-based authorization which is a way to achieve role-based access control.

Have a look at this great answer on SO: Using Claim-Based Authorization

Can i use claim based authorization in api 1.0 & .net 4.0 – Techmaster Dec 03 '13 at 11:42 — Techmaster, Dec 03 '13 at 11:42

Restful Service and User role authorization

1 Answers1