How to configure secure RESTful services with WCF using username/password + SSL

Question

I'm looking to write a config file that allows for RESTful services in WCF, but I still want the ability to 'tap into' the membership provider for username/password authentication.

The below is part of my current config using basicHttp binding or wsHttp w/out WS Security, how will this change w/ REST based services?

 <bindings>
  <wsHttpBinding>
   <binding name="wsHttp">
    <security mode="TransportWithMessageCredential">
     <transport/>
     <message clientCredentialType="UserName" negotiateServiceCredential="false" establishSecurityContext="false"/>
    </security>
   </binding>
  </wsHttpBinding>
  <basicHttpBinding>
   <binding name="basicHttp">
    <security mode="TransportWithMessageCredential">
     <transport/>
     <message clientCredentialType="UserName"/>
    </security>
   </binding>
  </basicHttpBinding>
 </bindings>
 <behaviors>
  <serviceBehaviors>
   <behavior name="NorthwindBehavior">
    <serviceMetadata httpGetEnabled="true"/>
    <serviceAuthorization principalPermissionMode="UseAspNetRoles"/>
    <serviceCredentials>
     <userNameAuthentication userNamePasswordValidationMode="MembershipProvider"/>
    </serviceCredentials>
   </behavior>
  </serviceBehaviors>
 </behaviors>

Answer 1

Before you continue down this path of fighting to implement REST over WCF, I suggest you read this post by Tim Ewald. I was especially impacted by the following statement:

I'm not sure I want to build on a layer designed to factor HTTP in on top of a layer that was designed to factor it out.

I've spent the last 12 months developing REST based stuff with WCF and that statement has proven itself to be so true over and over again. IMHO what WCF brings to the table is outweighed by the complexity it introduces for doing REST work.

Answer 2

I agree with Darrel that complex REST scenarios over WCF are a bad idea. It just isn't pretty.

However, Dominick Baier has some good posts about this on his least privilege blog.

If you'd like to see WSSE authentication support with fallback to FormsAuthenticationTicket support on WCF, check out the source code of BlogService.

Answer 3

Here's a podcast on securing WCF REST services with the ASP.net membership provider:

http://channel9.msdn.com/posts/rojacobs/endpointtv-Securing-RESTful-services-with-ASPNET-Membership/

Answer 4

Regardless if the community has opinions against REST on WCF (I'm personally on the fence) Microsoft has taken a swipe at it, http://msdn.microsoft.com/en-us/netframework/cc950529.aspx

Answer 5

Yes agreed with Moto, a link off the WCF Starter Kit is the closest thing I saw to authentication of credentials using a custom HTTP header (http://msdn.microsoft.com/en-us/library/dd203052.aspx).

However I could not get the example going.

Answer 6

Try custombasicauth @ codeplex