WCF-service: how to authorize user

Question

WCF-service is hosted by ASP.NET web-site. ASP.NET Membership is not used in web-site. User is logged using "custom" page, ID of logged user is stored into Session (HttpContext.Current.Session).

WCF-service is consumed by Silverlight (4 version) application.

How to check if current user (that loaded Silverlight application) is authorised to access a certain WCF-method?

I see few options:

1. During request to WCF-method check if the HttpContext.Current.Session object contains user id. This method doesn't work for me (http://stackoverflow.com/questions/3162819/httpcontext-current-in-wcf-service-during-2nd-request).
2. Use OperationContext - I don't know how to use it.

Could you please:

a. advise me how to resolve any of the above listed issues;

OR (probably better option)

b. suggest me any other approach.

Thanks you very much.

Answer 1

1. You can pass in the HttpContext.Current.Session["YourUserID"] to the Silverlight 4 Application as in InitParameter;
2. add that value to the application resources so it's available throughout the SL app;
3. and pass it to the WCF service as a parameter in a method call;
4. validate if that user is authorized

Here's an example:

For the page holding your silverlight control:

protected void Page_Load(object sender, EventArgs e)  
{  
    this.Silverlight1.InitParameters = "UserID" + HttpContext.Current.Session["UserID"];  
}  

In App.Xaml.cs

private void Application_Startup(object sender, StartupEventArgs e)  
{  
   this.Resources.Add("UserId", e.InitParams["UserID"]);  
}  

Answer 2

I believe you can use OperationContext and send session cookie with your WCF request. On the server side it will either restore correct HttpContext.Current.Session either you will be able to do this manually.

Answer 3

Take a look at the build-in Silverlight 4 Business template - it contains validation and authorization of users using WCF RIA Services.

Answer 4

It's a magic... now HttpContext.Current is non-null during each request... don't know why... If you know why that's possible - please let me know. And I can use it for user authorization...