I'm creating a REST WCF service and want to use OAuth to authenticate each user's request. The user accounts are stored in Active Directory so I have access to their AD login name on the client application and can pass that information along with the request header.
I've used oauth with the FatSecret REST API before so I'm familiar with how the authentication works.
Basically I'm just not sure how to handle assigning and storing secret keys for the users and how to go about tying a user's secret key to their AD login name.
Would I just have another database that held a mapping table of user AD login names to secret keys and then just do a lookup for the secret key on that table when the request comes in?
How do I ensure that the incoming request is actually coming from the user whose login name is in the incoming request, couldn't anyone just open Fiddler and create a request with another user's AD login name?