Securing the .NET Framework 4.x web API with Identity 4 server in

I am working with Identity Server 4, and I know that it is now on the ASP.NET core, and that’s fine.

But I have a Web API application that is on .NET 4.6.2. I wonder how these APIs can be protected. Or is it even possible? Or should I change my web API to the ASP.NET core?

I searched everywhere but all samples with ASP.NET Core.

+6
source share
1 answer

Identity Server 4 does not care about what a client is. You can check ID4 using the console application, if you want, right?

You see, when it comes to everything, all ID4 is basically its own REST web interface with some well-known endpoints using the Open ID Connect / oAuth2 protocol over HTTP. Just look at the samples with console clients here to get more information about how you want to configure your client: https://github.com/IdentityServer/IdentityServer4.Samples/tree/dev/Clients .

Thus, your client turns out to be net462 web API does not matter. All you have to do is send requests to the URLs of the hosted ID4. May look at alternative software Katana Open ID Connect, to facilitate your work: https://leastprivilege.com/2014/06/12/using-discovery-and-katana-middleware-to-write-an-openid-connect- web-client / . This, by the way, is a link to blog 1 of the creators of Identity Server. I suggest you look through his blog to find more useful information.

Update Token Check

To check the token, you need the endpoint of the token: http://docs.identityserver.io/en/release/endpoints/token.html . I suggest reading JWT tokens because you can, for example, look at the Katana JWT middleware: http://odetocode.com/blogs/scott/archive/2015/01/15/using-json-web-tokens-with- katana-and-webapi.aspx .

+4
source

Source: https://habr.com/ru/post/1013574/


All Articles