views:

51

answers:

2

Is it possible to set clientcredentials for an WCF in App.config?

I would like to avoid doing this:

Using svc As New MyServiceClient
  svc.ClientCredentials.UserName.UserName = "login"
  svc.ClientCredentials.UserName.Password = "pw"

  ...
End Using

Rather the login and password should be part of the configuration.

+1  A: 

As far as I know, that is not possible using the serviceModel configuration section due to the security hole it would create. But you could create regular appSettings for these values and use them in code:

svc.ClientCredentials.UserName.UserName = ConfigurationManager.AppSettings("...")

I would advise against this approach though, unless you encrypt the configuration file.

Johann Blais
Thanks. But storing the credentials in AppSettings will still require I set the values programmatically. I'm sure it's probably a security-issue, but I just don't see the difference: People are going to store login/pw somewhere anyways - why not right there along with the rest of the WCF configuration?? :)
Jakob Gade
As you said, it is related to security. Providing the user with a way to specify a password in clear text is an obvious security hole. Now, if the developer decides to by-pass it with the code I provided, he will be aware of his wrong doing. He will not be able to say "Hey Microsoft, your fault, you said it was OK to put it in the WCF config."
Johann Blais
A: 

You can try to inherit ClientCredentialsElement (handles default configuration section) and add support for UserName and Password. Than you can register this element in configuration file as behavior extension and use it instead of common configuration section.

Ladislav Mrnka