Custom client credentials type (username in querystring)

Question

I've been digging through WCF security in an apparently vain attempt to create a service/endpoint behavior that allows me to specify the client username/password credentials (but not to authenticate them, I'm happy to use the built in functionality for that). My intent is to supply the username (no password) in the querystring for use with JSONP.

So far, though, it's just making my brain leak out my ears. Can anyone point me in the right direction?

While we're here, can anyone explain the difference between clientCredentials and serviceCredentials?

I'm using WCF with .NET 3.5 SP1.

Edit: I've been through the MSDN article [How To: Create Custom Client and Service Credentials|http://msdn.microsoft.com/en-us/library/ms730868(VS.85).aspx] but it's particularly great at showing you what to extend but not the responsibilities of each are. Even using reflector, I just can't seem to find which class/interface has the responsibility of actually picking the credentials from the request (be it from an HTTP header or whatever).

Edit 2: I'd like to avoid using aspnet compatability as there will be a named-pipes binding (using a traditional authentication method).

Edit 3: Before anyone thinks of it, I am aware of the username:[email protected] format, but it is disabled in IE8 (at least). It seems to be automatically rejected, even when included in a <script> tag on a test page.

Answer 1

Try here:

• Codeplex - Security
• Codeplex - Security Guide

Client credentials - the user/client app will provide it: i.e. username/password, windows account

Service Credentials - server provides - i.e. a certificate (SSL)

both are required to set up a security context.

Answer 2

ClientCredentials are those that the client provides to the service. ServiceCredentials are those that the service provides to the client when the configuration requires mutual authentication.

On the service side:

WSHttpBinding b = new WSHttpBinding(SecurityMode.Transport);
b.Security.Transport.ClientCredentialType = HttpClientCredentialType.Basic;

On the client side:

proxy.ClientCredentials.UserName.UserName = "username";
proxy.ClientCredentials.UserName.Password = "password";

OR

If you're using BasicHttpBinding, take a look at this.

Here a ClientCredentialType of UserName "Indicates that the client be authenticated using a username credential."

OR

Here is an example of creating a custom username/password validator.

I hope something here helps. :-)