How to restrict access to a WCF service with a shared key

Question

I have a few services that are being consumed by clients within a secure zone. I've been asked to protect these services typically against development clients mistakenly connecting to the wrong service.

The idea was to pre-shared key (like a guid) which is set in the config for both the client and the service host. Whenever The client tries to consume the service it must present the correct key.

How would I go about configuring a service to implement this kind of security? How much customization is necessary?

Answer 1

If you do it using the key, you would change the contract of the service to include a field that the key would be placed in. Then check the value in the key on the server side.

However, in your case you could restrict which IP addresses were allowed to access the service, through the network configuration. This would be less work than changing the signature of your services.

Answer 2

I would have the client send the key as an extra message header and create a IDispatchMessageInspector to check for the header and optionally reject it. This Code Project article describes the filter part based on the IP address.

Answer 3

You could easily add a custom message header to each call - pretty easy to do, actually, and it doesn't "pollute" your real service contract, e.g. you don't have to add extra parameters to your service calls just to pass this.

See these articles for info on how to achieve this:

• WCF Custom Message Headers
• HOw do I add a custom header to every WCF message?
• WCF Messaging fundamentals

Basically, you need to wrap your call to the service in a OperationContext - that's all, no ClientMessageInspector and other trickery needed :-)

 using (OperationContextScope scope = new OperationContextScope(proxy))
 {
     Guid myToken = Guid.NewGuid();

     MessageHeader<Guid> mhg = new MessageHeader<Guid>(myToken);
     MessageHeader untyped = mhg.GetUntypedHeader("token", "ns");

     OperationContext.Current.OutgoingMessageHeaders.Add(untyped);

     proxy.DoOperation(...);
  }

and on the server side, you can simply inspect the IncomingMessageHeaders collection:

Guid myToken = OperationContext.Current.
                 IncomingMessageHeaders.GetHeader<Guid>("token", "ns");

Marc