Developing Authentication and Roles thinking about API

Hi all,

I'm developing an ASP.NET website and thinking about releasing the API
through webservices in a couple of months (like flickr.com let's say).

Most of the website functionality is restricted to authenticated users.
Users are classified in different roles, and different roles can take
different actions.

E.g. Guest can call a function to delete one of his articles, but
cannot call a function that can delete any article (which can be called
by an Administrator).

I would like to ask how would you handle user authentication and roles,
considering that I have to release the API?

The following is an example of the parameters I need to pass to a
"DeleteArticle" function called from a asp.net page that is accessible
only to authenticated users.

public bool DeleteArticle(articleID, UserID)
{
// delete article
}

The same function called from the API, could look like this if
authentication and roles are not planned with the webservices in mind.

public bool DeleteArticle(articleID, userID, userPassword)
{
// check username and password and authenticate
// check if user can delete article
// delete article
}

Thanks in advance,
Giammarco

.

Relevant Pages

  • Re: reading http request raw data as stream
    ... In my case I am implementing an API for my server side app. ... I also employ a Basic HTTP authentication as part of the API, meaning, ... that for every request I look for the authentication ...
    (php.general)
  • Re: Strange HttpContext issue
    ... One good place to start is with the API documentation. ... how it handles authentication in a server environment. ... Customer customer = new Customer; ... When I then debug the 3rd party web store API DLL, ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: How to determine the authentication domain of a user ?
    ... The log files should list which pam module someone used to. ... If there is a POSIX API or portable API or even OS ... NSS doesn't configure the order of authentication, ...
    (comp.protocols.kerberos)
  • RE: Developing Authentication and Roles thinking about API
    ... Read up on "code access security". ... > I'm developing an ASP.NET website and thinking about releasing the API ... > I would like to ask how would you handle user authentication and roles, ... > public bool DeleteArticle(articleID, UserID) ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Calling webservice using proxy authentication
    ... configuration to make sure that you didn't turn it off. ... > functionality in which allows authentication through a proxy. ...
    (microsoft.public.dotnet.framework.webservices)