Getting started: Project Architecture and Authentication Choices

[nhwilly]

Finally gave up on VS2013 templates and started looking at IdentityServer. Really nice work, guys.

I am trying to determine the solution architecture and components to use and it'd be great to avoid wandering down the wrong path for too long (which I have done for weeks already). Any comment you can make would be greatly appreciated.

This is basically a LOB application using Windows Phone 8 in addition to browser based access. We are allowing authentication only from external providers and will be adding our own claims to act as permissions for certain activities. Multiple users will use the same device, so logging out automatically is a needed feature.

1. Would it be wise to start with the latest MVC / WebApi 2 template with no authentication and then add in idsrv3?
2. My original plan was to use the WebAuthenticationBroker and I see that's in your plans, so I'll continue with that approach.
3. It looks like setting up a hybrid flow will be the best approach since we'll use the refresh token to keep people logged in while they're actively using it without actually using SSO as we don't want to sign them in to any other apps on the phone while they're using it.
4. The sample code I've been playing with is the MVC Owin Client (Hybrid) and the WPF Hybrid Client.
5. I plan to incorporate the AspNet membership code from the AspIdentity example.

I am headed in the right direction or have I assembled incompatible parts?

TIA

Bill

[brockallen]

1. It's be best to start with our samples and understand which one is the closest match to what you need. Then do as you suggest -- start with empty project and map from parts of the sample to your project.

2. Perhaps. I don't know enough about your app.

For the rest, I guess it sounds like a good start. But there are so many variables it's hard to say exactly.

[nhwilly]

Thanks. I'll proceed as planned and see what happens.