wcf - enable windows AND username authentication

Question

Hi,

What are the important configuration points needed to enable a scenario where a WCF service can be called with either the logged-on-users windows credentials or a username/password combination.

I'm pretty sure I know how to set them up, but what I don't know is how I can force usage of the username/password endpoint.

Is it simply a matter of using the constructor that allows you to specify a particular endpoint, and then setting ClientCredentials.UserName.UserName and .Password ?

Thanks.

Answer 1

You simply need to change the binding on the endpoint;

<wsHttpBinding>
  <binding name="WSHttpUserName">
    <security>
      <transport clientCredentialType="None" />
      <message clientCredentialType="UserName" />
    </security>
  </binding>
</wsHttpBinding>

Now if you want automatic windows authentication then you'll need another endpoint, with another binding at the clientCredentialType of "Windows"

Or you can put it in the transport and not the message, but in any case you will need SSL for username authentication.

Answer 2

There's a security section in the binding configuration for the services. There you can choose what security mode (None/Transport/Message/TransportWithMessageCredential) do you want to use and then for each particular mode you can customize security settings (things like credential type - UserName/Windows/Certificate etc.). Then on the client side you need to configure bindings accordingly where you setup what type of security mode do you want to use and what kind of identity. You can configure it equally either from your code or using configuration file.

There's a very nice WCF Security Guidance from MS Patterns&Practices. Here is the link: http://www.codeplex.com/WCFSecurityGuide

It has plenty of HoTos for particular scenarios. For example here's walkthrough on how you configure netTcpBinding with Windows Authentication and Message Security from WinForms: http://wcfsecurityguide.codeplex.com/Wiki/View.aspx?title=How%20To%20-%20Use%20netTcpBinding%20with%20Windows%20Authentication%20and%20Message%20Security%20in%20WCF%20from%20Windows%20Forms

Answer 3

So long as your configuration client endpoints exist in config and are configured for the relevent authentication method, you are right, it is as simple as specifying the configuration name in the constructor and supplying the uname/pwd to the client.