Using Identity Foundation with a WCF Web Api

I have a bunch of websites that are setup identically to use a WIF identity provider. I've recently moved the business logic out of the web applications and into a Web Ap开发者_如何学运维i service application. This runs in a different virtual directory to the other sites. The idea being that browser will put the data into the page AJAXy.

The issue I have is with securing the web API. It seems that WIF single sign-on works okay with traditional sites. The user can access one website, get redirected to the identity provider, login and get redirected back to the website they wanted. When they access another site they also get redirected back to the identity provider but needn't log in as a FEDAUTH cookie exists so they automatically get authenticated and redirected to the second site.

This doesn't work for the Web Api scenario because when the browser perhaps makes a GET to it, the Api will return a redirect to the calling javascript when it should be expecting JSON.

Is it even possible to secure Web Api with WIF?

---

Not sure whether I got you right, but it seems like the main problem is that javascript/ajax does not support http redirects. A possible solution could be to simulate the redirection with a sequence of seperate calls in ajax:

1. Check whether you are authenticated on your web api site (by a dummy ajax call).

If this is not the case:

1. Call your sts over ajax and grab the security token out of the "wresult" form field.
2. Call the login site on your web api site and pass the security token as "wresult" data.

Dominick Bayer wrote a few blog posts about securing rest services. For further reading have a look at http://www.leastprivilege.com/. (Especially http://leastprivilege.com/2009/09/11/adding-a-rest-endpoint-to-a-wif-token-service/ and http://leastprivilege.com/2010/05/05/thinktecture-identitymodel-wif-support-for-wcf-rest-services-and-odata/).

The following presentation from TechDays might also be interesting: http://www.microsoft.com/showcase/sv/se/details/ffc61019-9756-4175-adf4-7bdbc6dee400 (starting at about ~ 30 minutes).