@bereachad I sent you a PM here with some information.
issue is that step where we have "login with provider" we also query for roles into a database that is specific to the application they loged into, but i feel as that needs to be decoupled
And when you say store users in the database, you are talking about the database for the actual client application I assume
sso we have say DataAccessAPI (WebAPI 2 C# backend) that several clients(applications) connect to
but I am trying to get the [Authorize] tags to not use just claims, but security for the application they logged into, the thing is we didn't specify the data structure for how they handle security , it was an old legacy system that we are trying to make fit
which is causing a headache
Right now we have our openID server authenticate the user, and then once authenticated, we look them up in a table for users on the API that will be using that openID server for authentication, and then return associated roles in teh claims for the user
one sec I'll put together some pseudo code
this is the basic structure to any api
// client code
actionThatRequiresAuthorization() {
// a function
token = getTokenFromOpenID(); // uses openId (via redirect) to get the token
makeRequestToAPI(token, otherData);
}
// server code
// the function for your API
doSomethingImportant(token, otherData) {
try {
userIdOrRole = getUserOrRoleFromOpenId(token);
if (isAllowed(userIdOrRole)) {
// do important stuff with otherData and return a value if necessary
} else {
// throw 403
}
} catch (error) {
// throw 401
}
}
that is going to run a query on every request
sure something to unique identify the user, say userName is unique instead of userId it provides the same general purpose
at my old company, I hacked into there client application when I started worked because they didn't check on every call
@Ryzilynt bummer! I'm taking ENG221! Who do you have for 162? Do you already have your book?
@Lilyheart yeah, does the at symbol make it private or just identify who I'm talking to ?
its just an example, we don't actually use name
Where do you guys take classes?
Montgomery County Community College