2

I'm tasked with migrating a group of .Net WebForms applications from a current custom username/password login scheme to an oauth2/openid connect based authentication and authorization. This specific application is very mature and broad. As a result, the goal is to change as little of the underlying infrastructure as possible.

Currently, users log in with a username and password combination. Many people have more than one username/password combination. We want to change this to an email/password combination instead. I have an IdP set up to do authentication this way that can provide an id token. I think this part is relatively straightforward.

The wrinkle comes from the multiple accounts that each user currently has. Because of the nature of the applications, I need to support the multiple accounts, linked together through the email address.

Would it make sense to have a second IdP which can provide the list of accounts linked to the email address that can then provide a token based on the account chosen? If so, what is the best way to provide the email address to this second IdP?

Thanks for any insight.

Improve this question

1 Answer 1

Reset to default
1

The way you described your problem indicates, that oauth is not what you are looking for. Oauth is used to allow your users to use their credentials from a different entity (identity provider) to log in to your application and to access user data from the idp. The idp and the application that uses the idp are two different entities (e.g. two different companies). So for example: on honeypot.io i use my github username and password. Honeypot forwards me to the github idp. I log in and grant honeypot access to my user information (name email etc). The github idp forwards me to honeypot again with an access token und honeypot.io gets my user data along with the guarantee that i own that account. Honeypot will then create an account for me with my github data.

If there is only one party involved (your case) you dont need an idp and no oauth. Depwnsing on the concrete use cases you might just want to allow accounts to use multiple usernames, which would be a simple array / list.

Improve this answer
7
  • So maybe I didn't describe it fully. The IdP that we would use for authentication is a company-wide IdP that could potentially provide SSO for the entire company. But the multiple user account concept is something which is specific to this group of WebForms applications.
    – MichaelDotKnox
    Oct 25, 2018 at 18:29
  • Oauth is a web based authentication workflow, which requires users to login via the browser or an application. For general purpose identity management and access control have a look at kerberos and / or keycloak. These can also be wrapped by oauth idp. However, if im still getting you wrong and oauth is the way to go. The case is quite simple. The actual account management is not a part of oauth. For that reason you can do anything after oauth authentication, including granting access to multiple applications. Just add attributes that desvribe the users rights.
    – Malcolm X
    Oct 25, 2018 at 18:57
  • I will be using OpenId Connect for authentication. WebForms is a web-based technology. The question is how to do the authorization on a different IdP.
    – MichaelDotKnox
    Oct 25, 2018 at 19:01
  • You can add attributes to the account on the idp that describe the users rights or usernames. The idp could then share these attributes with your application. This works with a single idp. Are the multiple accounts all part of the single webforms app?
    – Malcolm X
    Oct 25, 2018 at 19:08
  • The multiple accounts are part of several applications and they change all of the time, with lots or specialized permissions. It's not claims-based and the code that handles all of the security runs deep into the application and ultimately uses a component that is used in other applications. That is one reason I need to tread lightly on the changes that I make to avoid impacting other systems or making deep changes. The authentication piece is easy to do, it's getting the multiple accounts piece working that is tough. I see it as a form of authorization.
    – MichaelDotKnox
    Oct 25, 2018 at 19:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .