6

I'm creating a REST WCF service and want to use OAuth to authenticate each user's request. The user accounts are stored in Active Directory so I have access to their AD login name on the client application and can pass that information along with the request header.

I've used oauth with the FatSecret REST API before so I'm familiar with how the authentication works.

Basically I'm just not sure how to handle assigning and storing secret keys for the users and how to go about tying a user's secret key to their AD login name.

Would I just have another database that held a mapping table of user AD login names to secret keys and then just do a lookup for the secret key on that table when the request comes in?

How do I ensure that the incoming request is actually coming from the user whose login name is in the incoming request, couldn't anyone just open Fiddler and create a request with another user's AD login name?

|improve this question
  • Hi KodeKreachor, welcome to Information Security. Something is not clear to me in your scenario... the clients are in the same network as your service? Since the clients have access to the AD login... If so, why are you bothering with OAuth? It seems to be unneeded complexity, it sounds like SSPI (aka Windows Integrated Authentication) would be a much better fit. – AviD♦ Mar 25 '12 at 19:22
  • Good question and actually you may be providing part of the answer I'm looking for. For intranet applications that already leverage AD, is there any point or benefit to adding a second layer of security such as OAuth? We're new to SOA and REST and are fairly unguided as to how to secure our services. – KodeKreachor Mar 25 '12 at 19:26
  • Ah, that sounds like a really good question, but its a different one - too long to discuss in comments. – AviD♦ Mar 25 '12 at 19:52
  • this would be GREAT as then any new apps internally could not write code to store the passwords that passthrough them as with oauth, you type your password into the one oauth website instead of every application...then you can asking vendors "are you oauth compatible"....you are assured then that there is no password logging going on in any application which does happen sometimes. – Dean Hiller Dec 28 '12 at 16:03
4

I'm not sure what OAuth gives you that can't be accomplished using other means. WCF + Rest works very well with claims based authentication bundled in WIF.

Since WCF implies you're using ASP.NET I recommend using Windows Identity Foundation (WIF) on the server side. Check out this ebook for more info.

Next you need a way to expose AD to your app. You can use ADFSv2 which is free on Windows 2008 R2. Take a look at the SQL installation that protects from session replay attacks.

Copying and pasting the credentials from Fiddler isn't something you can completely stop. HTTPS helps, but if you really want to investigate this issue look at this Q&A on Stackoverflow.

|improve this answer
1

OAuth may be a great choice if you are supporting mobile applications. This way the mobile app can store an access token without needing to carry around the user password on the device. The basic scenario is the application requests the token from a gateway that prompts the users for credentials (userid/pw) and then validates against the AD. Once AD validates, the gateway issues the access token (possibly via access code exchange) to the app. The app uses the token to request services. The application providing the services can check with the gateway to verify the token AND get the mapping from access token to user name. This way, the gateway holds the mappings but only for the duration that the access token is good for.

|improve this answer
  • 1
    Is this a product for which you are the author or on the development? You should make your disclosure more clear. security.stackexchange.com/faq#promotion – Eric G Mar 28 '13 at 1:32
  • Oleg - your final paragraph was blatant self promotion. We don't forbid that, as such, but you need to be very clear with your disclosure. Or just have links to your website in your profile. – Rory Alsop♦ Apr 9 '15 at 22:32
  • @Rory There's only one paragraph. What are you referring to? – Mukus Nov 14 '15 at 22:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.