The company I work for have a system with some data. This system's hosted in our private data centre. This system provides some ReST web services. We're looking to create a website, hosted in Windows Azure, which will call the above system's ReST services. Users of this website will be authenticated via ADFS (long term we may look to include other options for users outside of our company to be authenticated). We need to secure the communication between the Azure website and the locally (data centre) hosted system. Initially we'd like to keep this simple; e.g. allow a trusted IP from Azure to talk to our ReST service. Longer term we'd been keen to implement something more flexible, such as OAuth to allow other external applications to be plugged in with minimal effort.
Is securing services by IP sensible, or could this be a security risk (especially as we're hosting on Azure, where potentially others may host applications)? If anyone's done something similar before / can point me in the direction of useful articles, that would also be appreciated.