wcf and windows authentication

views:

answers:

wcf and windows authentication

I like to use wcf (windows communication foundation) with windows authentication.

Do I need Active directory for this purpose? How the server knows about the identity of the client?

If someone can found out the pass of the client that is using the wcf services, can he create the same user name on different computer and use the password to access the wcf services ?

Regards, Darko Petreski

+1 A:

Yes, if you want to use Windows authentication, you need Active Directory as the source where the user gets validated.

The way this happens is by means of a user "token" - when your client logs into his PC with his Windows credentials, the login process will check with AD whether the user is legit and issue a "token". This token is then used in calls to a WCF service to determine who it is that is calling the service.

marc_s 2010-04-24 08:25:40

Is the user connected somehow with the hardware or it can be used from several computers? I mean if it is once added to the active directory with admin pass for the active directory, can it be reused from other computer (just to add the username to the computer and full the active directory?).Example for payment software for supermarket. I cannot trust the sellers. Can they see the windows username and somehow find the pass and reuse them for malicious attacks from another computer?

darko petreski 2010-04-24 08:40:33

The user is authenticated against the Active Directory - he's definitely *not* tied to a specific PC

marc_s 2010-04-24 08:52:17

If you need something like this, you could send along the machine name as a WCF header, and in your service check against a list of "allowed" machine names or something. But even that can be spoofed, if they really want to....

marc_s 2010-04-24 08:55:44

Great answer. Thanks.

darko petreski 2010-04-24 09:20:39

ansaurus

tags:

views:

answers:

wcf and windows authentication

related questions