I have an intranet site, hosted locally within my organisation. The same site also exposes some data through various web services. It's written using ASP.NET MVC 5 and WebAPI 2.
At the moment users can login to the website using Windows Authentication, and once authenticated they can access the APIs. However, I need to also allow access to the APIs using tokens so that they can be interrogated by automated processes. The process I'm considering implementing is as follows:
- A User authorised to access the Intranet site logs in and goes to a new page I'll create where they can request a token. A token will be generated and displayed on the screen for them to note down.
- Calls to the API are made including the token in the HTTP header, which the server will verify before returning data.
- I need the ability to revoke tokens, so JWTs aren't really suitable.
- Using OAuth is not an option.
- The APIs are accessed using HTTPS (and I'm looking into encrypting the returned data too).
I think I'm tangling myself up in knots implementing this, though. Given that the ability to revoke the tokens means I'm going have to persist something in the database, and that I'm essentially using Personal Access Tokens which represent the User's credentials, rather than asking them to generate their own tokens using a shared private key, I'm struggling to justify to myself why I shouldn't just generate any old key (could even just be a GUID) store it in the database along with an expiry date and an associated username and maybe some sort of scope to restrict the APIs which can be accessed, and be done with it.
I've been writing code to create HMACs and such, but in the solution I've proposed there's no verification of the origin of the API call taking place, I'm just accepting that if the token matches one that's been issues and not revoked, it's good.
I think the model I'm suggesting is similar to those used by GitHub and Microsoft's Visual Studio Team Services PATs for accessing their APIs, but I can't help thinking my suggestion, has some fundamental flaws. Could anybody perhaps point out how my proposal could be improved and/or suggest a suitable model for my scenario?