How to use the Stormpath (or similar) OAuth provider to authenticate external users?

Question

How can we replace the existing membership provider in Sitecore with an OAuth- based provider (like stormpath.com)?

Further details: We are designing a solution in which the external users are stored in an external system instead of the build-in membership database. The authentication is to be handled via stormpath (stormpath.com) using the OAuth token-based authentication they provide, but we are unsure how to change the default membership provider in Sitecore to use the OAuth methods provided by Stormpath (or similar OAuth-provider).

Any suggestions on how to solve this issue?

We have played around with the VirtualLogin feature of Sitecore, which in combination with custom login/logout methods could be used to some extend. However, this introduces an additional authentication cookie instead of the JWT-token issued by the OAuth provider (as far as we can see).

Answer 1

If there is not already a Sitecore Module that handles the specific OAuth provider, you can manually setup it up by:

1. Redirect the user to the oAuth2 authentication screen
2. Have the ID provider (IDP) validate and authenticate the user
3. The ID provider will return back to Sitecore an authorization token, most likely containing a list of claims
4. In code (potentially in a custom HttpBeginRequest pipeline processor) log the user in as a Virtual User, then assign predefined Sitecore roles to the virtual user based on mapping the claims provided from the IDP to the user