WCF & ASP.NET Membership Provider

Question

I know for WCF to work with a membership provider you have to explicitly configure it: (e.g. http://www.codewrecks.com/blog/index.php/2009/09/08/use-aspnet-membership-provider-with-a-wcf-svc-service/)

But if you already have the ASP.NET site using it, can't you prevent anonymous access to the service simply by doing the following?

  <location path="PathToWCFService">
    <system.web>
      <authorization>
        <deny users"?" />
        <allow users="*" />
      </authorization>
    </system.web>
  </location>

Assuming this works, then I would guess WCF wouldn't have access to the membership information? Any other reasons why this might be a bad idea? Thanks!

Edit: Any other way to use WCF with the membership provider that doesn't require maintaining a certificate?

Answer 1

Ok, I usually am comfortable deferring to marc_s, but in this case, I think his comments may be not entirely accurate.

The thing I think he is disregarding is that hosting a service in ASP.NET is entirely different than self hosting.

When you host a service in an ASP.NET website, the host factory is managed by ASP.NET and is actuated by accessing the .svc endpoint, which is served by ASP.NET.

So, while participating in and having access to the ASP.NET context for a service is opt-in, ASP.NET most certainly does process the request.

And so, yes, you may guard any .svc endpoint with ASP.NET authorization as you show.

So you have it guarded against unauthenticated access. What now? How to authenticate a client so that it may access your service?

That is where the link you provide for using membership/authentication with a service.

So, in your question, you are describing the two reciprocal aspects of protecting an ASP.NET hosted wcf service with the membership provider stack but perhaps are viewing them as either/or.

Now, I could be mistaken, but this is how I understand it and how I have implemented it in the past.

Good luck.

And yes, there are methods of protecting a service with membership that do not involve a certificate but they typically have either a bit of smell to them and/or require a BasicHttp or WebHttp binding.

I am happy to explore this with you more if you like.