Impersonate FormsAuthenticated user in HttpHandler for WCF call

Question

I'm using HttpHandlers to generate PDF report files "on-the-fly" using the authenticated user context. However, to create the report PDF file I need to call a method on a secure WCF service with the context of the caller (the authenticated user).

I saw plenty of answers for the Windows authentication but I'm using plain old Forms authentication so the answers don't apply. The authentication on the service side is done using ASP.NET membership (same server that hosts the HttpHandler).

There should (I hope) be a way for me to just pass on the caller context to the service.

I'm afraid I didn't make myself clear enough.

What I have is a WCF service and an HttpHandler. The user is authenticated with the WCF service with ASP membership.

What I want to do is, in the HttpHandler, be able to do

SetContextAsCaller();
myWCFService.MyMethodCall();

and have MyMethodCall() called using the HttpCaller's context to pass on its ASP ticket/username etc.

Answer 1

You could - depending on what binding and thus transport protocol you use - use UserName/Passwort authentication, and instruct the WCF server side to use ASP.NET membership provider for authenticating the incoming callers.

Check out the Fundamentals of WCF Security and this blog post series on WCF security scenarios - they contain a lot of very useful information on how to use and set up WCF security.

Does that help, or do you need additional info? If so: what do you need?

Marc

UPDATE:
OK, after you commented, here are a few more articles that deal specifically with a WCF service impersonating the caller - hope these help:

• WCF security guidance - How To Impersonate the original caller
• Delegation and Impersonation with WCF
• Setting up WCF to Impersonate Client credentials
• Caller impersonation for WCF services