WCF security in an internet scenario

Question

I have a WCF service hosted in a Windows Service. Clients from various platforms will access the service. Now I would like to add a basic security mechanism. Ideally, the clients should use username/password for authentication.

Which binding settings do I have to use in this scenario and how can I authenticate the client? Interoperability is more important than a very secure solutions. If possible the client should not be forced to use a certificate or something the like. Additionally, authentication should not be strongly coupled with a SQL Server database. I would like to manually inspect the client credentials.

Thanks for your help

Answer 1

The best for your case can be BasicHttpBinding with security set to TransportWithMessageCredentials and credential type set to UserName. In this case your service will be secured with HTTPS (requires server certificate for SSL which has to be trusted on clients) and authentication will be provided on message level with UserName Token Profile (SOAP header). You can implement your own password validator.

BasicHttpBinding configuration skeleton:

<bindings>
  <basicHttpBinding>
    <binding name="Secured">
      <security mode="TransportWithMessageCredential">
        <message clientCredentialType="UserName" />
      </security>
    </binding>
  </basicHttpBinding>
</bindings>

If you don't want to use HTTPS you can create custom binding with HttpTransport, TextMessageEncoding and with security mode set to UserNameOverTransport. But you have to set allowInsecureTransport to true (be aware that there is some bug with WSDL generation in this setting).

Custom binding configuration skeleton:

<bindings>
  <customBinding>
    <binding name="Secured">
      <security authenticationMode="UserNameOverTransport" allowInsecureTransport="true" />
      <textMessageEncoding messageVersion="Soap11" />
      <httpTransport />
    </binding>
  </cutomBinding>
</bindings>