1. ASP.NET Web API – Sigurnosna pitanja i odgovori Ivan Marković Cloud Solutions Program Manager/Technology Evangelist SPAN

2. ASP.NET Web API in Modern Architecture ASP.NET Web API

3. About me Ivan Marković SPAN Ivan.Markovic@span.eu Cloud Solutions Program Manager/Technology evangelist Student

4. Agenda 1. ASP.NET Web API Pipeline 2. OAuth 2.0

5. ASP.NET Web API Pipeline

6. Request Lifecylce Application Domain WebAPIApplication: HttpApplication RouteTable.Routes HttpWebRoute:Route HttpControllerRouteHa ndler:IRouteHandler HttpControllerHandleer: IHttpAsyncHandler::IHttp[ Handler HttpControllerDispatcher :DelegatingHandler HttpRoutingDispatcher: Delegating Handler AllRoutesHandler: Delegating Handler HttpServer: DelegatingHandler ActionFilters ApiController: IHttpController Http Context, Http Request, Http Response AuthorizationFilters PerRouteHandler: Delegating Handler

7. Request Lifecylce Application Domain WebAPIApplication: HttpApplication RouteTable.Routes HttpWebRoute:Route HttpControllerRouteHa ndler:IRouteHandler HttpControllerHandleer: IHttpAsyncHandler::IHttp[ Handler HttpControllerDispatcher :DelegatingHandler HttpRoutingDispatcher: Delegating Handler AllRoutesHandler: Delegating Handler HttpServer: DelegatingHandler ActionFilters ApiController: IHttpController Http Context, Http Request, Http Response AuthorizationFilters PerRouteHandler: Delegating Handler

8. Pipeline in Web API 2.0 HttpModuleMessageHandlerAuthentication Filter Authorization Filter Host/Framework independent concerns Web API cross- cutting concerns, eg. CORS Web API specific authentication Authorization

9. HTTP Module Allow security code to execute early as part of the IIS pipeline. The principal established from an HTTP module is available to all components The biggest drawback with HTTP modules is the lack of granularity.

10. Message Handler Runs before Authentication and Authorization filters Message handler runs only for Web API requests. A message handler can be configured to run as a global handler for all requests or for a specific route. The downside of using a message handler is the lack of finer control.

11. Action Filter Another extensibility option provided by ASP.NET Web API It runs after the authorization filters are run in the ASP.NET Web API pipeline.

12. Authentication vs Authorization AuthenticationAuthorization Authentication is knowing the identity of the user. Eg: Login() Authorization is deciding whether a user is allowed to perform an action. Eg: Read, Write, Delete

13. Authorization Filter Another extensibility option provided by ASP.NET Web API The order of execution of authorization filters isn’t guaranteed by ASP.NET Web API.

14. Authentication Filter Authentication filters run after message handlers but before all other filter types. Authentication filters run before authorization filters! Authentication filters offer a level of control or granularity that makes them particularly useful.

15. Authentication Filter + Authorization Filter Authentication Filter Authorization Filter Action Method No Action Taken Does Not Execute Rejects the Reqouest for the Lack of Authenticate Principal Request with no Credential Unathorized Response 401

16. Authentication Filter + Authorization Filter Authentication Filter Authorization Filter Action Method contex.ErrorResult Is Set to Unathorized Result Does Not Execute Request with Invalid Credential Unathorized Response Does Not Execute

17. Authentication Filter + Authorization Filter Authentication Filter Authorization Filter Action Method Contex.Principal Is Set to an Authenticated Princiapl Action Method Runs and Produces a Response Successfully Authorizes Because Identity is Authentic Request with Valid Credential Response Message No Action Taken

18. ASP.NET Web API Pipeline Demo

19. OAuth 2.0

20. Enterprise Security

21. Modern Applications UsersClientsWeb APIs

22. OAuth 2.0 User Client Application Authentication Server Resource Server

23. OAuth 2.0 User Client Application Authentication Server Resource Server

24. OAuth 2.0 User Client Application Authentication Server Resource Server Access token

25. OAuth 2.0 User Client Application Authentication Server Resource Server Access token { „iss”:”myAuthzServer”, „aud”:”application”, „exp”:”192990121”, „scope”:[„search”,”read”], „client_id”:”client1” }

26. Conclusion HttpModuleMessageHandlerAuthentication Filter Authorization Filter Host/Framework independent concerns Web API cross- cutting concerns, eg. CORS Web API specific authentication Authorization

27. Conclusion User Client Application Authentication Server Resource Server

28. Q & A ? ? ? ? ? ? ?