API Authentication – How to Authenticate Against an API

apiapi-designauthenticationdesign-patternsenterprise-architecture

In a enterprise distributed system, a user of a web portal can sign into one site, be redirected to a federation provider. Once they log in with, for example, a facebook account, that user is federated (single-sign-on) with each service that exists in the enterprise that trusts the same federation provider for authentication.

My question is this; How can API users of the same system benefit from the same luxury (single sign on) ? As far as I understand it, API calls should be stateless, thus each request should require separate authentication.

If each of the distributed API's, when called by a client, need to make a call to the federation provider, get authenticated, pass claims back to the API, then process the clients request, it seems a little network chatty to me.

To clarify, an example scenario for an API client might be :

  1. Create a customer (customer API)
  2. Create a user for that customer (user API)
  3. Place an order (order API)
  4. View billing statement (billing API)
  5. View customer report (report API)

Like I say, it seems a little chatty for each API to talk to the federation provider on each request.

Best Answer

In general:

  • User logs into some authentication system.
  • Authentication system provides a token that effectively says "Authentication System X asserts that you are Bob, until 3:00 PM 8/31/2015 UTC".
  • User then passes that token as metadata (header, some data envelope) to the various APIs.
  • The various APIs look at it and decide if they trust Authentication System X. If they do, they let Bob in, since only Bob could've had the authorization credentials (password, fingerprint, retina, etc) to get this token.

The nitty gritty details of setting all that up will vary depending on what Authentication System, what sort of Token, and what API libraries you're using. Though if you're doing something beyond basic google/facebook integration, it's likely to be agonizing.

Related Topic