Best way to use and secure WCF on the Compact Framework?

Question

I am working on an app that has several clients - Desktop, Mobile Device, Web Portal. We're moving to an SOA kind of architecture and will be using WCF.

The WCF story is great when it comes to using netTcp+transport/message security+Windows authentication (or even UsernameToken and a custom UsernameValidator provider) on the Desktop and Web Portal side.

Where it totally breaks down is on the compact framework side...the subset of WCF it supports is so limiting. I was resigned to simply using basicHttp + Username/Password in the headers all over SSL, but it seems that you cannot add headers when on the compact framework stack (no OperationContextScope) - so that leaves me with including username/password as parameters for EVERY SINGLE operation method in the service.

Please tell me I am wrong and there is a better way.

Answer 1

Your best bet is going to be to expose a WCF end-point that conforms to the WS-Security standards.

You should then be able to use those standards for message based security (most likely using X.509). Here's the MSDN link to get started:

Messaging in the .NET Compact Framework

Answer 2

An alternative solution is to pass a ticket (read: guid).

The client logs in (sends username and password). A randomly generated ticket is generated (guid again), cached on the server, and sent back to the client. This ticket is then passed back and forth instead of the username and password.

Of course, all of that is assuming you don't just want to utilize session state.

But in other words: I've had the same problem you've had. It sucks. This is how I got around it a bit so it was usable.

Anyway, another good reference is the WCF Guidance for Mobile.