Our team is looking to introduce Web API, MVC/ASP.NET implementation in our SOA. I am having a hard time trying to wrap my head around the identity and access control it has compared to WCF.
WCF has Windows, X.509, UserName, and WS-Trust (probably more, but this is what I am familiar with), MVC’s Web API seems to only have web application based identity and access control built into it: Web Forms, Windows, and WS-Federation.
Has anyone made Web APIs using MVC that implements the protocols that WCF has?
Should this even be done / am I trying to use Web API in a way it shouldn’t be?
If you need WS-* use WCF, you will not get it in Web API. This is mainly when you need interop with other systems using it otherwise I personally will avoid it like a plague.
ASP.NET Web API supports federated security via OAuth and OAuth 2.0 which is lighter and much simpler to understand, implement and support. There are other options such as Hawk, etc. But in any case, if I can choose, I will choose OAuth 2.0
Dominick Baier already has an implementation which I believe will become standard security. You can find it here http://thinktecture.github.io/
2
In short: WCF has way too much overhead for simple RESTful services. On the other hand, Web API was designed specifically for RESTful services with control over Http Request/Response.
The advantages of having Web API that i can tell straight ahead are:
- I like the control over Http Request/Response
- It’s easy to follow (leveraging MVC patterns), with more tooling will come
I’m in agreement with Dave Ward on this. Check out his blog for more information.
I’ve long held out against pressure to move from ASMX to WCF in
WebForms projects, because accepting WCF’s complexity primarily only
rewarded me with less flexible JSON serialization. By contrast, I’ve
begun converting some of my projects from ASMX to Web API, and have
been pleased with how easily Web API replaces ASMX.I believe Microsoft has finally found a good balance between ASMX’s
simplicity and WCF’s power with Web API.
References on related posts:
- WCF Web API: Role based access control with basic authentication
- WCF Web API RESTful is not allowed by Access-Control-Allow-Origin
- Claims Based Identity & Access Control Guide
- Web API or WCF – An Architectural Comparison
3