title: How to implement Authentication and Authorization for my Web API web service?
body: <p>I have a <strong>Web API Web service</strong> which is used by a number of client applications with different technologies like <strong>Java, .NET, etc.</strong> Therefore, my user credentials are stored in a separate <strong>database</strong>.</p>
  
  <p>My Web Service is hosted within <strong>IIS</strong> and I have configured and enabled <strong>SSL</strong> on the server side which makes sure that the Request/Response Messages are encrypted and signed.</p>
  
  <p>I've also configured IP Address Restriction feature of IIS to allow the requests from a handful of known IP Addresses.</p>
  
  <p>I don't like to use <strong>Basic Authentication</strong> since it sends the credentials in plain text with every single message although the message is encrypted using SSL.</p>
  
  <p>I can't use <strong>Integrated Windows Authentication</strong> obviously because my users are not on the same domain as my server.</p>
  
  <p>I can't use <strong>Forms authentication</strong> since my clients are not browser-based.</p>
  
  <p>So what's the best way to implement Authentication and Authorization for my web service?</p>
  
  <p>I was thinking one approach would be to provide an <strong>Authenticate(username, password) web method</strong> which behaves like an <strong>Identity Provider/Security-token-service</strong> and generates a token specific to that user which expire after certain time. Then the client must be sending the authentication token with each web method request and I make sure of it by creating a Custom Authorization Filter for my controller.</p>
  
  <p>The advantage of this approach is that the user doesn't have to send username/password with each request but just a temporary token. The disadvantage is obviously managing the token life; when should it expire? e.g. if no request was made within an hour.</p>
  
  <p>What's the best way to implement Authentication and Authorization for my web service?</p>