title: Aspnet Web API Authentication on mobile clients
body: <p>I am implementing an API using ASP.net Web API and I'm trying to find proper alternatives for authentication in my scenario, it is as follows:</p>
  
  <ul>
  <li>The API should be accessible from mobile clients</li>
  <li>The mobile client user should not sign in, the client is a native application</li>
  <li>The API is authorized with credentials composed by the Device ID and an User ID, obtained within the app with other means, valid credentials stored in a sql database</li>
  <li>The client should not store static credentials</li>
  <li>The API manages sensible data and should be secure</li>
  </ul>
  
  <p>So I've explored some options and I have found that a basic authentication over SSL would be enough, but some people say it might not be enough, a claims based solution would.</p>
  
  <p>Then I have explored Azure ACS and I see there are some advantages but maybe it's overcomplicated for my scenario? still I should create an identity provider like in basic authentication. Sample flow (second approach): <a href="http://msdn.microsoft.com/en-us/library/gg429784.aspx" rel="nofollow">http://msdn.microsoft.com/en-us/library/gg429784.aspx</a> </p>
  
  <p>What do you think?</p>
  
  <p>Thanks</p>
  
  <p><strong>UPDATE:</strong></p>
  
  <p>I have been thinking about using an implementation of DotNetOpenOauth and using the Resource Owner Password Grants so I can just use the device id and user id the first time to get an access token without storing credentials, the server can authorize the caller based on the device calling it, is this correct?</p>