1

I'm trying to create an API and a website client for it. Lately I've been reading a lot about OAuth2 as a security mechanism and companies that offers authentication as a service such as auth0.com or even Azure active Directory and I can see the advantages in using them

Because I'm used to always having the users in the same database and tables with relationships to the Users table in the form of One to Many such as below

public class User
    {
        public string subjectId { get; set; }

        public virtual List<Invoice> Invoices { get; set; }
        /*
        More properties in here
        */
    }

public class Invoice
    {
        public int InvoiceId { get; set; }
        public string PaymentNumber { get; set; }
        public DateTime Date { get; set; }
        public double Amount { get; set; }
        public string Description { get; set; }

        public virtual User User { get; set; }
    }

My questions is then.

If the users are stored in an external authentication service such as Auth0.com,

  • How the Invoice class will handle the relation to the user?
  • Would it be just adding a new property subjectId in the Invoice table and this will take the value of whatever id the authentication service assigned?

In the latter case, would the class Invoice be something like below?

public class Invoice
        {
            public int InvoiceId { get; set; }
            public string PaymentNumber { get; set; }
            public DateTime Date { get; set; }
            public double Amount { get; set; }
            public string Description { get; set; }

            public string SubjectId{get;set;}
        }

Also, if the users are stored someplace else, how do you make a query like,

Select * from Users u inner join Invoices i where Users.Name='John Doe' and i.Date>Somedate.
1

With OAuth (including OAuth2 or OpenID for that matter) you would still have a local user entity. Where you store information about this user is up to you. In the case of your example, you would create a user table in your database, just as you normally would.

What is different is that you do not store authentication information (such as passwords1) in your user table, because, with OAuth, you offload the authentication part to the OAuth provider and, as a result, don't need this information.

Any data you need in your local application will still be stored in locally.

1 There is some debate on whether or not 'remember me' information should be stored locally or that a round trip to the OAuth provider should be made instead.

  • hi Jacco, thanks for your answer, can you answer me this, If I secure my web app and my web api using an external Oauth provider, how am I going to be able to save the users in the API when the web app was the one that executed the auth mechanism to login the user? – General Electric May 1 '16 at 16:00
  • I'm not sure what you mean by 'save the user in the API'? – Jacco May 1 '16 at 16:22
  • My api is going to support a web application and a mobile app and I used an external authentication service. In my API is where I'm going to store everything related to my business, I though that the users gotta be in the API so I can pull their data from the web app or the mobile app, if the authentication process is triggered by the any of both then the API is not involved in this process at any time leaving me with no clue regarding how to store the user's information on the API. does it makes any sense? – General Electric May 1 '16 at 16:34
  • Sorry, but I'm not following. An API is an means of communicating with a service. If you build a service and build an API for it, you can have clients communicate with the service through your API. You store data in your database and request access to this data by making a request to the server, using on of the API methods available. – Jacco May 1 '16 at 17:00
  • Maybe also read: Aaron Parecki's OAuth 2 Simplified – Jacco May 1 '16 at 17:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.