IT:AD:ASP.NET:WebAPI:HowTo:Using External Authentication Services
Summary
No app that's wants to call itself secure should be persisting user name/password in the app's database – use an external Authentication Service.
The social ones are important to resolve first. Or atleast know how to do offer them.
It's tough enough doing it in MVC app. Gets a little more tricky in an SPA.
And it's even more tricky – but essential – to sort it out so that the app will work just as well in a browser, as well as a mobile WebApp.
Process
Read this:
* http://www.azurefromthetrenches.com/?p=1071
* http://webcache.googleusercontent.com/search?q=cache:Yq_oo3MQgyIJ:www.azurefromthetrenches.com/%3Fp%3D1071+&cd=1&hl=en&ct=clnk&gl=nz
Resources
* http://blogs.msdn.com/b/webdev/archive/2012/08/15/oauth-openid-support-for-webforms-mvc-and-webpages.aspx * http://www.asp.net/web-api/overview/security/external-authentication-services * http://www.azurefromthetrenches.com/?p=471
* http://www.asp.net/aspnet/overview/owin-and-katana/owin-oauth-20-authorization-server
- THIS is the one to watch:
-