Authentication in a multi layer architecture

Question

I am designing an N-Layer system in .NET that will consist of

• SQL Server 2008
• EF 4
• Repository Layer
• Service Layer(Business Logic)

On top of this I will have:

• ASP.NET MVC website
• external API to be consumed by other clients(built with WCF or ServceStack.NET)

I would like to implement the typical username/password auth within the MVC app as well as OpenID/twitter/facebook login options

The api will need similar forms of authentication.

Where in the architecture is the best place to implement the authentication and are any samples available of how to implement something like this with a .NET Stack?

Is a custom Membership provider an option for this?

I realize that there are libraries available to implement the openID portion so that is not a concern at the moment but I would like to leave things open to add this in the future.

Suggestions?

Answer 1

Authentication should be done at the user facing point: MVC website and the WCF service.

In each point, use the appropriate authentication/authorization mechanism.

MVC website: forms authentication (or windows authentication etc.)

WCF service: (what method will you be taking, API key, user/name password on every request, secure key, auth cookie etc.)

For each point, call the service layer with the credentials used by the requestor (user) and validate it against your database (in the service layer).

The service layer should return valid/invalid for the credentials given to it.

If it's invalid, have your website or webservice reject any further actions from the user and inform them that it's not valid.

If it's valid, have your MVC website create the auth cookie (FormsAuthentication.SetAuthCookie) and your WCF service do the appropriate action for the authentication mechanism you chose.

Keep your service layer agnostic of the authentication. It should only respond with whether or not a set of credentials is valid and your front-facing layers should take care of setting the authentication tickets.

For Open ID/Twitter/Facebook logins, all the information needed is on the web app (via the login source cookies), so use that to setup your website's auth cookie.