1

What are the authentication options for having a ASP.NET web application communicating with a WCF service?

The scenario:

  1. User enters their username and password in an ASP.NET form.
  2. ASP.NET needs to pass this to WCF to authenticate the user.
  3. If authenticated, the user can perform actions on the website. Each action would require sending data to different WCF operations. WCF needs to know who the user is on each call.

The easiest solution would be to store the username/password in the ASP.NET session state. However, this is insecure because the password is stored in memory on the server.

I would rather not use a certificate to authenticate the ASP.NET "client" to the service because there's a possibility that this WCF could be consumed by another client in addition to ASP.NET.

The best suggestion I've seen so far is to use Windows Identity Foundation (WIF). It appears that this requires an STS. According to MSDN, Microsoft does not seem to recommend setting up an STS through Visual Studio. There's no guarantee that an STS would be available in the deployment environment as some environments may use Active Directory and other environments may have a custom user store. Is it possible to setup a custom STS to authenticate against a custom user store? I'm having trouble finding documentation on doing this.

Are there any other options besides using WIF? What about a custom WCF authentication service that returns a token that can be used for authenticating against a primary WCF service?

Bob Wintemberg
  • 3,212
  • 6
  • 34
  • 44

1 Answers1

1

The standard way of doing this is by using WIF with Microsoft's STS viz. Active Directory Federation Services v2.0 (ADFS).

There are a number of custom STS available e.g. Identity Server. This use a SQL DB as an attribute store. It's open source so could be adapted to whatever you require.

You can create your own custom attribute store: AD FS 2.0 Attribute Store Overview.

TechNet WIF / WCF: WIF and WCF.

rbrayb
  • 46,440
  • 34
  • 114
  • 174