Supporting Multiple Authentication with Web API in the web hosted case

With the newly released Web API Beta bits ( https://www.asp.net/web-api), you can support multiple authentication from client. Say you want the client send both the username/password as well as Client Certificate for SSL.

For the web hosted scenario, you can register a custom HTTP module to do the authentication and convert those client credentials into some principal that your controller can later authorize. Here is some sample code. Dislaimer, the code is only for demoing purpose, and not for production.

Step 1: Write a HttpModule to authenticate and turn the client credential to some principal information.

Code Snippet

24. public void Init(HttpApplication context)
25. {
26.     context.AuthenticateRequest += (s, args) =>
27.     {
28.         var currentContext = HttpContext.Current;
29.  
30.         if (!currentContext.Request.IsSecureConnection)
31.         {
32.             throw new HttpException(403, "SSL required for Basic Authentication");
33.         }
34.  
35.         var authHeader = context.Request.Headers[HTTP_HEADER_AUTHORIZATION];
36.  
37.         if (String.IsNullOrEmpty(authHeader))
38.         {
39.             currentContext.Response.StatusCode = 401;
40.             currentContext.Response.End();
41.             return;
42.         }
43.  
44.         Tuple<string, string> credentials = GetCredentials(authHeader);
45.         IPrincipal principal;
46.  
47.         // you can manufacture princical based on client certificate
48.         if (context.Request.ClientCertificate.Subject == "some subject" &&
49.             credentials.Item1 == "username" && credentials.Item2 == "password")
50.         {
51.             // This is only for demoing purpose!!! Do not use this in production.
52.             var identity = new GenericIdentity("username with some subject from client certificate");
53.             principal = new GenericPrincipal(identity, new[] { "Administrators" });
54.         }
55.         else
56.         {
57.             // we failed to validate the username/password
58.             currentContext.Response.StatusCode = 401;
59.             currentContext.Response.End();
60.             return;
61.         }
62.  
63.         // otherwise, we are authenticated, set the current context
64.         currentContext.User = principal;
65.     };
66.  
67.     context.EndRequest += (s, args) =>
68.     {
69.         var currentContext = HttpContext.Current;
70.  
71.         if (currentContext.Response.StatusCode == 401)
72.         {
73.             currentContext.Response.StatusCode = 401;
74.             currentContext.Response.AddHeader(
75.                 "WWW-Authenticate", String.Format("Basic realm=\"{0}\"", "Home"));
76.         }
77.     };
78. }
79.  
80. // parse the authHeader into username and password
81. private static Tuple<string, string> GetCredentials(string authHeader)
82. {
83.     // strip out "basic"
84.     var encodedUsernameAndPwd = authHeader.Substring(6).Trim();
85.  
86.     var encoding = Encoding.GetEncoding("iso-8859-1");
87.     var usernameAndPwd = encoding.GetString(Convert.FromBase64String(encodedUsernameAndPwd));
88.     var usernameAndPwdElements = usernameAndPwd.Split(new[] { ':' });
89.  
90.     return new Tuple<string, string>(usernameAndPwdElements[0], usernameAndPwdElements[1]);
91. }

Step 2: Write a custom authorization filter to require certain principal.

Code Snippet

10. public class RequireAdminAttribute : AuthorizationFilterAttribute
11.     {
12.         public override void OnAuthorization(HttpActionContext context)
13.         {
14.             // do authorization based on the principle.
15.             IPrincipal principal = context.ControllerContext.Request.GetUserPrincipal();
16.             if (principal == null || !principal.IsInRole("Administrators"))
17.             {
18.                 context.Response = new HttpResponseMessage(HttpStatusCode.Unauthorized);
19.             }
20.         }
21.     }

Step 3: Add the authorization attribute to certain method that you want to secure in your controller.

Code Snippet

7. public class HomeController : ApiController
8.     {
9.         /// <summary>
10.         /// Anyone can get
11.         /// </summary>
12.         /// <returns></returns>
13.         public HttpResponseMessage Get()
14.         {
15.             return new HttpResponseMessage(HttpStatusCode.OK)
16.             {
17.                 Content = new StringContent("Default User")
18.             };
19.         }
20.  
21.         /// <summary>
22.         /// Only Admin can POST
23.         /// </summary>
24.         /// <returns></returns>
25.         [RequireAdmin]
26.         public HttpResponseMessage Post()
27.         {
28.             return new HttpResponseMessage(HttpStatusCode.OK)
29.             {
30.                 Content = new StringContent("User Posted")
31.             };
32.         }
33.     }

Via IIS, you can set the SSL setting to require SSL and require Client certificate.

Hope this helps. Self host cases work in a little bit different way that i will blog sometime later.