title: OAuth and OWIN Authentication - Confusion
body: <p>I have been asked to create a 'Authentication/Authorization' Middle man or broker as an http,MVC web application, so that this can be used to multiple applications on our organization for authentication/Authorization purposes. Means, users will signup, Login on this broker application and once confirmed Authenticated, authorized user, he will get redirected to client applications accordingly. This is the use case. </p>
  
  <p>I am choosing OAuth and OWIN to develop this broker in an MVC applicaiton, which means OAuth(Authorization) will issue access token + refresh token, once user is successfully authenticated. I use normal, simple, minimal authentication logic inside the Oauth Authorization Server's Login Controller as below :</p>
  
  <pre><code>public class AccountController : Controller
  {
      public ActionResult Login()
      {
          var authentication = HttpContext.GetOwinContext().Authentication;
          if (Request.HttpMethod == "POST")
          {
              var isPersistent = !string.IsNullOrEmpty(Request.Form.Get("isPersistent"));
  
              if (!string.IsNullOrEmpty(Request.Form.Get("submit.Signin")))
              {
               var user = Constants.Users.UserCollection.Where(u =&gt; u.Email.ToLower() == Request.Form["username"].ToLower().Trim() &amp;&amp; u.Password == Request.Form["password"].Trim());
  
                  if (user.Count() &gt; 0)
                  {
                      authentication.SignIn(
                          new AuthenticationProperties { IsPersistent = isPersistent },
                          new ClaimsIdentity(new[]
                          { new Claim(ClaimsIdentity.DefaultNameClaimType, Request.Form["username"]),
                           new Claim("DisplayName", user.FirstOrDefault().DisplayName) } , "Application"));                          
  
  
                  }
              }
          }
  
          return View();
      }
  </code></pre>
  
  <p>This is the MSFT sample application I am following to develop this conceptual application. 
  <a href="https://docs.microsoft.com/en-us/aspnet/aspnet/overview/owin-and-katana/owin-oauth-20-authorization-server" rel="nofollow noreferrer">https://docs.microsoft.com/en-us/aspnet/aspnet/overview/owin-and-katana/owin-oauth-20-authorization-server</a>.</p>
  
  <p>My question here is : I read in many articles like, its not good  to use Oauth authentication, else use OPENID Connect handling authentication. To be frank, I am not used with OPENID Connect and I am not sure about the necessity of creating a OPENID Provider for my organization, Since this service will be used only by customers of our organization - less than 200,000 users. We hardly need a user signup and login, this account need to be used among different web applications of our organization. Please help me here with your inputs. Thanks in advance.</p>