Has anyone attempted to do token (JWT) based authentication OpenID connect or OAuth within DnnController implementations?
I read this article: http://www.dnnsoftware.com/community-...
where it says: WebFormsAuthMessageHandlerd always run last.
//authentication message handlers
GlobalConfiguration.Configuration.MessageHandlers.Add(new BasicAuthMessageHandler());
GlobalConfiguration.Configuration.MessageHandlers.Add(new DigestAuthMessageHandler());
GlobalConfiguration.Configuration.MessageHandlers.Add(new WebFormsAuthMessageHandler());
I can see some code like this:
public override HttpResponseMessage OnOutboundResponse(HttpResponseMessage response, CancellationToken cancellationToken) {
if (response.StatusCode == HttpStatusCode.Unauthorized && SupportsBasicAuth(response.RequestMessage))
{
response.Headers.WwwAuthenticate.Add(new AuthenticationHeaderValue(AuthScheme, "realm=\"DNNAPI\""));
}
and I am not sure how is authentication session established in DNN.
I believe it supports both ASP.Net forms cookie using .Dotnetnuke cookie and basic authentication (not sure - please clarify)???
Is this how DNN sets security principal to be used throughout request handling?
SetCurrentPrincipal(new GenericPrincipal(new GenericIdentity(credentials.UserName, AuthScheme), null), request);
How would one introduce OpenID connect id_token and how would we establish DNN context to be used in WebAPI implementations to
handle authorizaton?
Any way to introduce OWIN pipeline? There is e.g Microsoft OpenID connect middleware. Can we use it in DNN?
I know a lots of questions, but if Orchard can do it I hope DNN can do it as well.
Thans,