0

I need to secure a WCF Service that uses webHttpBinding with tokens, but having a hard time figuring out how to do so. It is my understanding that the recommend way of doing this is by using JWT Tokens?

I have an STS (IdentityServer) that issues JWT tokens to my Mobile Client (Sencha Touch Application) through OAuth 2.0, and this application needs to call a webHttpBinding based WCF Service.

Now I want to secure this using tokens, and I know Microsoft has released a JWT Security Token Handler NuGet package.

I have added this security token handler in the "securityTokenHandlers" tag under my "identityConfiguration" tag in the web.config, but I feel a bit lost on how to actually use the token handler to validate the token, extracting the claims and setting the IClaimsPrinicipal object.

Most examples I have been able to find use WebAPI and are for ASP.NET applications, but in my case I need to just secure an "ordinary" WCF Service using a webHttpBinding.

Any help on how to accomplish this, would be greatly appreciated.

Bahr
  • 5
  • 1
  • 4

1 Answers1

0

You won't find many samples with OAuth implementation over SOAP services. OAuth was created primarily for clients that could not handle SOAP and its associated WS-Security complexity.

Although not common, it is still possible, you just need to implement your own WCF pipeline hook (IDispatchMessageInspector) to get the token from HTTP header and then use the JWT classes to set your claims.

I have not used this code sample, but it looks like it will do what you want. http://blogs.msdn.com/b/pavelkhodak/archive/2013/07/26/enable-http-bearer-jwt-token-authentication-for-rest-service-using-webhttpbinding-in-wcf.aspx

0leg
  • 966
  • 5
  • 9
  • Thank you for answering. I'm a bit confused now however. I use a webhttpbinding in WCF, which as I understand is a REST-style binding and not SOAP based? So is it that uncommon to use OAuth to secure a REST-style service? If it is then I'm very confused and would appreciate if you can point me to some other direction on how to secure a webhttpbinding with tokens? Thank you for providing the link, I'll have a look at it :) – Bahr Jul 01 '14 at 13:19
  • Sorry for the confusion. My mistake, webhttpbinding is a REST style service. WCF REST framework was short lived, since WCF was primarily designed with SOAP in mind. Now all REST services in .NET are built using Web API, which has a different interception points for security. The article I mentioned is still valid, though. You need to implement IDispatchMessageInspector component as a behavior extension to hook into WCF pipeline and process the tokens. – 0leg Jul 01 '14 at 17:15
  • If you want to better understand WCF pipeline and interception points, read this article. http://msdn.microsoft.com/en-us/magazine/cc163302.aspx – 0leg Jul 01 '14 at 17:20