WCF Security and what to use in this situation.....

Question

I have a client/server application that has many client machines and one service on a server.....

On the server side I will be using a Windows Service to host my WCF service. The service will be passing data across the internet to the client machines. I figure I will be using wsHttpBinding with message level security, which requires a username or a certificate.

Now here's the problem.....

-We don't want to have the user log in to the system

-there is no Windows Authentication on the client machines

-and I would use certificates but, we have tons of client machines going out everyday, so installing certificates manually on each machine is not gonna be an option (unless it can all be done through code... and I mean creation and installing)

anybody have any ideas on how to secure this kind of service? Thanks in advance

Peace

Answer 1

In your scenario, it seems like you're looking for the "basicHttpBinding" with no security whatsoever.

<bindings>
  <basicHttpBinding>
    <binding name="NoSecurity">
      <security mode="None" />
    </binding>
  </basicHttpBinding>
</bindings>

and then configure your endpoints to use that binding configuration:

<system.serviceModel>
    <services>
        <service name="YourNamespace.YourService"
                 behaviorConfiguration="MyServiceBehavior">
           <endpoint address="" 
                     binding="basicHttpBinding" 
                     bindingConfiguration="NoSecurity" 
                     contract="YourNamespace.IMyService">
            </endpoint>
            <endpoint address="mex" 
                      binding="mexHttpBinding" 
                      contract="IMetadataExchange" />
        </service>
    </services>

There's also a really good blog post series that talk about the basics of WCF security in terms of five different, typical scenarios - excellent read! Your scenario would be the "No security at all" scenario.

Another good introductory article is Michele Leroux Bustamante's Fundamentals of WCF Security.

A more thorough (but also more complex) set of guidance for WCF can be found at the WCF Security Guidance on Codeplex.

Marc

Answer 2

Since you will be using an app wirtten by yourself. You can use wshttpbinding with username and password authentication (Client credential type basic) where your app reads the username and password from a config file.

http://msdn.microsoft.com/en-us/library/ms731299.aspx

EDIT

The windows service could run under an account that the user does not have the password for. The service is in a directory that is protected with ACLs, such that the user of the machine does not have access to the config file.