Layer application and token authentication

Question

Suppose we have an application with multiple layers in .Net:

• Domain layer (entities)
• Data access layer (entity framework)
• Business layer
• Web Services layer (Web Api)
• Presentation layer (MVC)

Now I want to add token authentication for web services layer. The usual recomendation is to use a standar login/authentication implementation (libs, frameworks) and don't code it, so I want to use ASP .Net Identity token authentication. How I should do it?

I should put Asp .Net Identity in a class library? Create the tokens in business layer?

Answer 1

Do not create tokens in the business layer unless your company's business is security. It can either be its own project or part of the web api. The web api is, after all, the trust border for the application, and the tokens are likely translated (by web api) into user objects for your other layers.

Ideally, you shouldn't handling this in your own code at all. But instead, use a separate token service (like IdentityServer3). However, that does create more integration work, CORS concerns, etc.