Custom authentication, authorization and session for WCF

Question

I have read about various implementations of authentication and authorization for WCF, starting from reusing some built in .NET and WCF features and ending with completely custom implementations.

But there are so many factors to take into account, so I'm confused about how to implement it for my intranet business application project.

Here is what I need: - WCF .NET 4.5 services will be hosted in IIS 7 or newer.

• Most probably, ASP.NET compatibility will be disabled.

• Protocol will be HTTP with BasicHttpBinding, but it might need binary serialization to minimize traffic.

• WCF method will receive a custom session ID which will be checked against a user session object in a database. No .NET sessions are allowed in this project.

• After receiving the ID, the service will read the corresponding user data (including authorization flags to see if the user is allowed to execute the current operation) and validate it. If data is invalid, an exception will be thrown and the WCF operation won't be executed. If validation succeeds, the identity of the user will be stored in a current operation context (and also current thread principal) so it can be accessed by various components during the WCF operation execution.

• All the authentication&authorization should be done transparently before the execution of the WCF operation - without additional efforts from programmers who will create the WCF methods.

• I need access to the WCF operation name being executed, when I perform the auth validations, so I can throw an exception if the user does not have permissions to execute the operation.

• testers will use SoapUI, so they'll need to be able to pass the session ID through standard SOAP or HTTP headers.

Which would be the most straightforward way to implement my auth routines? Should I use a custom binding? Custom behavior? Some kind of a built-in request event handler (which one exactly, and will they work if ASP.NET compatibility is disabled)? Authorization policy (seems a bit overkill because I won't be using most of its built-in features anyway)? Something else?

Answer 1

You can try making use of Message Inspectors. Your session ID can be passed like a token through SOAP or HTTP Headers and will be inspected by WCF through your defined behavior before it executes the actual service operation.

You can check the articles here and here, particularly focusing on the IDispatchMessageInspector interface which offers the "AfterReceiveRequest" and "BeforeReceiveReply" methods.