6

I'm creating a REST WCF service and want to use OAuth to authenticate each user's request. The user accounts are stored in Active Directory so I have access to their AD login name on the client application and can pass that information along with the request header.

I've used oauth with the FatSecret REST API before so I'm familiar with how the authentication works.

Basically I'm just not sure how to handle assigning and storing secret keys for the users and how to go about tying a user's secret key to their AD login name.

Would I just have another database that held a mapping table of user AD login names to secret keys and then just do a lookup for the secret key on that table when the request comes in?

How do I ensure that the incoming request is actually coming from the user whose login name is in the incoming request, couldn't anyone just open Fiddler and create a request with another user's AD login name?

Improve this question
4
  • Hi KodeKreachor, welcome to Information Security. Something is not clear to me in your scenario... the clients are in the same network as your service? Since the clients have access to the AD login... If so, why are you bothering with OAuth? It seems to be unneeded complexity, it sounds like SSPI (aka Windows Integrated Authentication) would be a much better fit.
    – AviD ♦
    Mar 25, 2012 at 19:22
  • Good question and actually you may be providing part of the answer I'm looking for. For intranet applications that already leverage AD, is there any point or benefit to adding a second layer of security such as OAuth? We're new to SOA and REST and are fairly unguided as to how to secure our services.
    – KodeKreachor
    Mar 25, 2012 at 19:26
  • Ah, that sounds like a really good question, but its a different one - too long to discuss in comments.
    – AviD ♦
    Mar 25, 2012 at 19:52
  • this would be GREAT as then any new apps internally could not write code to store the passwords that passthrough them as with oauth, you type your password into the one oauth website instead of every application...then you can asking vendors "are you oauth compatible"....you are assured then that there is no password logging going on in any application which does happen sometimes.
    – Dean Hiller
    Dec 28, 2012 at 16:03

2 Answers 2

Reset to default
4

I'm not sure what OAuth gives you that can't be accomplished using other means. WCF + Rest works very well with claims based authentication bundled in WIF.

Since WCF implies you're using ASP.NET I recommend using Windows Identity Foundation (WIF) on the server side. Check out this ebook for more info.

Next you need a way to expose AD to your app. You can use ADFSv2 which is free on Windows 2008 R2. Take a look at the SQL installation that protects from session replay attacks.

Copying and pasting the credentials from Fiddler isn't something you can completely stop. HTTPS helps, but if you really want to investigate this issue look at this Q&A on Stack Overflow.

Improve this answer
1

OAuth may be a great choice if you are supporting mobile applications. This way the mobile app can store an access token without needing to carry around the user password on the device. The basic scenario is the application requests the token from a gateway that prompts the users for credentials (userid/pw) and then validates against the AD. Once AD validates, the gateway issues the access token (possibly via access code exchange) to the app. The app uses the token to request services. The application providing the services can check with the gateway to verify the token AND get the mapping from access token to user name. This way, the gateway holds the mappings but only for the duration that the access token is good for.

Improve this answer
3
  • 1
    Is this a product for which you are the author or on the development? You should make your disclosure more clear. security.stackexchange.com/faq#promotion
    – Eric G
    Mar 28, 2013 at 1:32
  • Oleg - your final paragraph was blatant self promotion. We don't forbid that, as such, but you need to be very clear with your disclosure. Or just have links to your website in your profile.
    – Rory Alsop ♦
    Apr 9, 2015 at 22:32
  • @Rory There's only one paragraph. What are you referring to?
    – Mukus
    Nov 14, 2015 at 22:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.