SSO

SSO with JWT in ASP.NET MVC and Web API

This article explains how to implement Single Sign-On (SSO) in an ASP.NET MVC application and consume a secure Web API using JWT tokens. We use OpenID Connect, a standard identity protocol used by providers like Auth0, Azure AD, and Okta.

🔐 Overview

• User logs in via an identity provider (SSO)
• MVC app receives a JWT access token
• MVC app sends the JWT to a Web API
• The Web API validates the JWT and returns data

🔧 Step 1: Configure Identity Provider

Register your ASP.NET MVC app with an identity provider like Auth0 or Azure AD. Set the redirect URI to https://localhost:5001/signin-oidc.

🖥️ Step 2: ASP.NET MVC App (Login Client)

Install the required NuGet packages:

Install-Package Microsoft.Owin.Security.OpenIdConnect
Install-Package Microsoft.Owin.Host.SystemWeb
Install-Package Microsoft.Owin.Security.Cookies

Configure OWIN Startup:

app.UseOpenIdConnectAuthentication(new OpenIdConnectAuthenticationOptions
{
    ClientId = "your-client-id",
    Authority = "https://your-idp.com/",
    RedirectUri = "https://localhost:5001/signin-oidc",
    ResponseType = "id_token token",
    Scope = "openid profile email",
    SignInAsAuthenticationType = "Cookies",
});

🔒 Step 3: Web API (Protected Backend)

Install the JWT middleware:

Install-Package Microsoft.Owin.Security.Jwt

Configure JWT validation in Startup.cs:

app.UseJwtBearerAuthentication(new JwtBearerAuthenticationOptions
{
    TokenValidationParameters = new TokenValidationParameters
    {
        ValidIssuer = "https://your-idp.com/",
        ValidAudience = "your-api-audience",
        IssuerSigningKeys = ... // Load from JWK
    }
});

📡 Step 4: Call Web API Using Access Token

client.DefaultRequestHeaders.Authorization = 
    new AuthenticationHeaderValue("Bearer", accessToken);

var response = await client.GetAsync("https://localhost:5002/api/secure/userinfo");

✅ Conclusion

With SSO and JWTs, users can securely log in once and access protected APIs across applications. This setup improves security, simplifies user management, and supports modern authentication protocols.