{"id":2501,"date":"2013-10-25T02:01:26","date_gmt":"2013-10-25T09:01:26","guid":{"rendered":"http:\/\/www.cloudidentity.com\/blog\/?p=2501"},"modified":"2013-10-25T02:03:03","modified_gmt":"2013-10-25T09:03:03","slug":"securing-a-web-api-with-adfs-on-ws2012-r2-got-even-easier","status":"publish","type":"post","link":"https:\/\/www.cloudidentity.com\/blog\/2013\/10\/25\/securing-a-web-api-with-adfs-on-ws2012-r2-got-even-easier\/","title":{"rendered":"Securing a Web API with ADFS on WS2012 R2 Got Even Easier"},"content":{"rendered":"

Few weeks ago I gave you a taste<\/a> of how you can use the modern ASP.NET OWIN stack for securing a Web API with tokens obtained from the latest ADFS version, the one in Windows Server 2012 R2. The flow I described<\/a> was definitely easier than the one you\u2019d have to implement should you choose to use the JWT handler directly, but it still required quite a lot of code.<\/p>\n

Well, good news! With the RTM of VS2013, we now have few new toys we can play with to make things easier. And that\u2019s what I am going to do here.<\/p>\n

Walkthrough<\/h2>\n

To make things more interesting, I am going to use the same sections structure I have used for the old tutorial<\/a> but I\u2019ll do few things differently, so that if you want to mix & match features you can take one section from here, and another from there<\/a>. <\/p>\n

The scenario I want to implement is practically the same, to the point that I can paste the old description (almost) verbatim:<\/p>\n

\n

The scenario we want to implement is pretty simple: we want to restrict access to an MVC5<\/font> Web API to the users of a given on-premises AD instance, which happens to be using Windows Server 2012 R2 ADFS (just \u201cADFS\u201d from now on). Furthermore, we want to expose the Web API to the user via a .NET application<\/font>.<\/p>\n<\/blockquote>\n

I have highlighted the differences in red:<\/font><\/p>\n