WCF Authorization using IIS and ACLs

Question

Hi guys,

i'm trying to secure some WCF services. I'd like to use IIS or the Web.config todo all of the heavy lifting/configuration if possible. I don't want to embed anything in my code - thought I know that may not be feasible. If possible, I'd like to achieve this without having to resort to AspCompatibilityMode :(

I'm using a custom BasicHttp binding with TransportCredential enabled.

This works fine. Any valid domain or machine account seems to validate against the service.

My problem is I only want users from specific windows groups to be able to access my service. I wanted to use ACLs on the actual folders to achieve this, but I don't think it is possible.

Would appreciate your help!

Thanks TM

Answer 1

In your web.config try the following:

<authentication mode="Windows" />  
<identity impersonate="false" />
<authorization>
   <allow users="MYDOMAIN\YourGroup" />
   <deny users="*" />
</authorization>

This will block it at the web config level. You can also put an ACL on your folder. Note the Windows authentication and the impersonate = false means that it is the users credentials that are being used to access the directory.