Question

I am inquiring whether or not it is possible to provide both AD authentication and Basic for my WebApi Controller Services. I intent is to have all internal (company) users authenticated with AD credentials (windows) for seamless sign on, but Basic Authentication for Mobile and External (non-company) users. I’m finding information in regards to using either but not necessarily best approach to use both. What I am not interested in doing is adding external users in AD.

Answer 1

An approach you could take is to create a custom action filter and register it globally.

Something along the lines of

public class MixedAuthenticationAttribute : System.Web.Http.Filters.ActionFilterAttribute
{ 
    public override void OnActionExecuting(System.Web.Http.Controllers.HttpActionContext     actionContext)
    {
           //basic auth header check
           if (actionContext.Request.Headers.Authorization == null)
           {
                 //no auth header run AD authentication process.
           } else {
                 //basic auth authentication
           }

    }
}