WCF Security Learning Resources

Question

What are the best soup-to-nuts learning resources to get up to speed on WCF security?

Most WCF tutorials don't bother with security and use basicHttpBinding however, what I'm doing needs to be industrial strength. I need to learn how to

• minimize the size of messages on the wire
• encrypt messages on the wire so they can't be sniffed and read.
• be able to authenticate users with and without Windows authentication.
• Authorise callers using custom roles and permissions.
• pass extra metadata in the request message such as users machine name and a logging context guid.
• log plaintext request/response messages for tracing and maybe auditing.
• profile service operations for performance.

The services I work on are self-hosted, and I will use IIS if there is a specific benefit otherwise my services need to remain hosted in windows services in production and console apps in development.

I should say I'm using .NET 3.5 and VS2008 at the moment. Might move to 4.0 if there's a killer WCF feature that would be helpful.

Thanks in advance for helping me take the next giant step.

Answer 1

There is a 15 part series of Top to Bottom WCF video webcasts here, the two security related ones are part 10 and part 11.

There is also a 18 part WCF Soup to Nuts series, part 1 is here.

Answer 2

Check out the MSDN docs WCF Security Overview for a good overview of the entire topic.

Also, I would recommend Juval Lowy's article on Declarative WCF Security where he specs out five commonly encountered scenarios of services and how to properly secure them. He even goes as far as making that into attributes, e.g. you can just simply decorate your services with a security-related attribute and be done with it.

For a very comprehensive set of guidance and how-to (more of a reference that a learning resource, though), check out the WCF Security Guidance - it has tons of step-by-step how-to's, code samples, background info.