17

Is there a way to use the same username and password from the membership provider for a WCF service authentication? if so, which binding does it supports? I need to extract a profile variable from the user currently calling the service. Thanks for any help.

Aidan Ryan
  • 11,389
  • 13
  • 54
  • 86
ryudice
  • 36,476
  • 32
  • 115
  • 163

1 Answers1

22

Basically any binding that accepts username/password as client credentials for message security can be configured to use the ASP.NET membership provider.

Check out this MSDN docs on how to use the ASP.NET Membership provider in WCF - you need to configure your binding for client credentials of type "UserName"

<bindings>
  <wsHttpBinding>
  <!-- Set up a binding that uses UserName as the client credential type -->
    <binding name="MembershipBinding">
      <security mode ="Message">
        <message clientCredentialType ="UserName"/>
      </security>
    </binding>
  </wsHttpBinding>
</bindings>

and the service to use ASP.NET Membership for user authentication:

<serviceBehaviors>
  <behavior name="AspNetMembership">
     <serviceCredentials>
        <userNameAuthentication 
             userNamePasswordValidationMode ="MembershipProvider" 
             membershipProviderName ="SqlMembershipProvider"/>
     </serviceCredentials>
  </behavior>
</serviceBehaviors>

and of course, you have to apply this service behavior to your services when configuring them!

<services>
   <service name="YourService" behaviorConfiguration="AspNetMembership">
   ....
   </service>
</services>

The UserName client credential type is supported by basicHttpBinding, wsHttpBinding, netTcpBinding - so pretty much all the usual suspects.

marc_s
  • 732,580
  • 175
  • 1,330
  • 1,459
  • is it possible to use username with basicHttpBinding without using https? Also, if i use wsHttpBinding, is https mandatory? – Nil Pun Aug 15 '11 at 12:54
  • 2
    If you're using username/pwd, WCF wants a secure link - so you must use https (since you cannot use message-based encryption). And no: you can absolutely use wsHttpBinding without https - as long as you can encrypt the messages, e.g. by having a certificate available – marc_s Aug 15 '11 at 13:50
  • Could you please answer http://stackoverflow.com/questions/9584198/authentication-service-using-wcf ? – LCJ Mar 06 '12 at 13:08