CODEWITHSUNDEEP
wcfiis-6transport-security
Stealth Rabbi
Stealth Rabbi

Reputation: 10346

Custom UserName/Password authentication in IIS6

I have a WCF service I'm hosting in IIS6. I'm trying to set up custom username/password authentication using Transport level security. I've set up a test certificate and got a client to connect over SSL with no authentication specified, i.e:

      <security mode="Transport">
        <transport clientCredentialType="Basic" />
      </security>

I've set up a custom validator with Message security and client credential type "UserName", but I'd like to incorporate this now with Transport level security. When I have my web.config set, when I try to view the WSDL, I get an error: "Security settings for this service require 'Basic' Authentication but it is not enabled for the IIS application that hosts this service."

Here are the important parts of my web.config:

<system.serviceModel>
    <bindings>
      <wsHttpBinding>
        <binding name="UserNameBinding">
          <security mode="Transport">
            <transport clientCredentialType="Basic" />
          </security>
        </binding>
      </wsHttpBinding>
    </bindings>
    <services>
      <service behaviorConfiguration="ServiceAuthenticationBehavior"
        name="Service.WebServices.MyService">
        <endpoint address="mex" binding="mexHttpsBinding" bindingConfiguration=""
          name="mexBinding" contract="IMetadataExchange" />
        <endpoint binding="wsHttpBinding" bindingConfiguration="UserNameBinding"
          name="wsHttpBindingWithAuth" contract="Service.WebServices.IMyService" />
      </service>
    </services>
    <behaviors>
      <serviceBehaviors>
        <behavior name="ServiceAuthenticationBehavior">
          <serviceMetadata httpsGetEnabled="true" />
          <serviceDebug includeExceptionDetailInFaults="true" />
          <serviceCredentials>
            <serviceCertificate findValue="TestCert01" storeLocation="LocalMachine"
              storeName="TrustedPeople" x509FindType="FindBySubjectName" />
            <userNameAuthentication userNamePasswordValidationMode="Custom"
              customUserNamePasswordValidatorType="Service.WebServices.ClientCredentialsValidator, Service.WebServices" />
          </serviceCredentials>
        </behavior>
      </serviceBehaviors>
    </behaviors>

Is there something I'm supposed to set in IIS6 to enable this? In IIS, I started initially with the "Enable anonymous access" option enabled. I also tried enabling "Basic authentication (password is sent in clear text)" checkbox, but no success.

Upvotes: 0

Views: 887

Answers (1)

jenson-button-event
jenson-button-event

Reputation: 18961

This post seems to suggest that Basic is only available for Windows account, with a 3rd party solution...

Basic Authentication with WCF REST service to something other than windows accounts?

I've been here myself, and ended up going with 1-legged openauth which worked nicely.

edit this post sent me well on my way to a solution http://www.cleancode.co.nz/blog/523/oauth-dot-net

its worth mentioning the diff between 1 and 2-leg OAuth. 1-leg is where the client and the service both know the client's secret (password) for the client's account name which is used to encrypt and decrypt the authentication request (which all gets added to the querystring). with 2-legged, this is generated by a 3rd party such as google, facebook etc.

Upvotes: 0

Related Questions