Scope
Currently we are developing a backend REST API which is consumed by handful of MVC applications. In this case we are talking only about server-server communication and the API won't be consumed by any user directly. The environment is purely on Windows Server and it's to mention that there are no plans at the moment to use active directory.
What is the best way to authenticate a server application (MVC) to the backend API?
Considering everything is done over https, at the moment we considering either client certificate or token based authentication (via Basic / Bearer).
With both of those approaches a lot of pros and cons emerge and I really would like your help to verify, correct and maybe complement them.
Token-Based Authentication
- Scales well in case we decide to use it for other parts aswell
- No client certificates (installation, renewal)
Client Certificate Authentication
- Wide spread in the enterprise environment
- Well established
- Manageable amount of clients
- Considered by many as one of the securest option
- No single point of failure (self hosted identity server)
Conclusion
I am pretty sure I've forgot some important ones and I appreciate any kind of input.
In addition, given the scope above which approach would you opt?