Configure IdentityServer4 with OWIN self-hosted WebApi

Question

I am trying to create an Identity Service using IdentityServer4. The service is self-hosted with OWIN (.Net Fx 4.7.x). Here are what I have tried so far.

Attempt#1: Use the examples from the documentation: However, all the examples are based on .Net core. Replicating the codes such as app.UseIdentityServer(); does not work simply because in the example, app is of type IApplicationBuilder, whereas in OWIN self-hosted app, we have IAppBuilder.

// Startup.cs
public void Configuration(IAppBuilder app)
{
    // Configure Web API for self-host. 
    HttpConfiguration config = new HttpConfiguration();
    config.Routes.MapHttpRoute(
        name: "DefaultApi",
        routeTemplate: "api/{controller}/{id}",
        defaults: new { id = RouteParameter.Optional }
    );

    // Configure Unity IOC

    app.UseIdentityServer(); //<--doesn't compile
    app.UseWebApi(config);
}

Attempt#2: Register the IdentityServer middleware manually: I tried to register the needed middlewares manually, by looking at the sources. This looks something like below:

//Startup.cs
public void Configuration(IAppBuilder app)
{
    ...
    // Configure Unity IOC

    app.Use<IdentityServerMiddleware>(
        config.DependencyResolver.GetService(typeof(ILogger<IdentityServerMiddleware>)));
    app.UseWebApi(config);
}

This too does not work, as the Main method throws the following error while staring the WebApp with WebApp.Start<Startup>(baseAddress);

No conversion available between System.Web.Http.Owin.HttpMessageHandlerAdapter and Microsoft.AspNetCore.Http.RequestDelegate. Parameter name: signature

How can I correctly configure this? I know that I can possibly use IdentityServer3 in this case, but I am keen on using IdentityServer4 as IdentityServer3 is not maintained anymore.

Answer 1

Directly from the documentation for Identity server 4

IdentityServer4 is an OpenID Connect and OAuth 2.0 framework for ASP.NET Core 2.

Identity server 4 only works with Asp.Net core 2.0. You are not going to be able to use this to create an identity server with old ASP.Net (Owin/KATANA) I recommend you switch to ASP.NET Core 2.0.

As mentioned in comments you could go back to Identity Server 3 but this is no longer supported so there will probably not be any security updates if any issues arise with it. Due to that i would not personally use it in a new production product.