{"id":2565,"date":"2013-12-10T09:56:06","date_gmt":"2013-12-10T16:56:06","guid":{"rendered":"http:\/\/www.cloudidentity.com\/blog\/?p=2565"},"modified":"2013-12-10T09:57:25","modified_gmt":"2013-12-10T16:57:25","slug":"protecting-a-self-hosted-api-with-microsoft-owin-security-activedirectory","status":"publish","type":"post","link":"https:\/\/www.cloudidentity.com\/blog\/2013\/12\/10\/protecting-a-self-hosted-api-with-microsoft-owin-security-activedirectory\/","title":{"rendered":"Protecting a Self-Hosted API with Microsoft.Owin.Security.ActiveDirectory"},"content":{"rendered":"

As you might have sensed<\/a>, OWIN is slated to occupy a prominent role in our next wave of claims-based identity software (more details soon (I hope\"Smile\")).
One question I am getting with increasing frequency is \u201cjust how lightweight is this OWIN thing? Is it going to impose heavy requirements that will prevent me from doing anything with it unless I use the latest and greatest?\u201d.<\/p>\n

The ones among you already familiar with it are already smiling, I am sure\u2026 OWIN was designed exactly to decouple apps and frameworks from the underlying layers, and while the Microsoft OWIN Components do have some system requirements (e.g. you can\u2019t go lower that .NET 4.5) those are not more restrictive than other constraints we already have in place (the JWT handler<\/a> requires .NET 4.5 anyway).<\/p>\n

To give you a concrete feeling of the above, I am going to show you how you can set up a super simple Web API in a console app and how you can easily secure with with Windows Azure AD with the exact same code you use when programming against IIS Express\/full IIS. In fact, I could just reference existing tutorials (like this one<\/a> from the excellent Kanchan) and just add the authentication bits, but in my experience some denormalization often helps to understand the topic better. It will take a bit of extra work on my part, but it\u2019s all good \"Smile\"<\/p>\n

Here there\u2019s what we are going to do:<\/p>\n