ASP.net Membership and Role Provider in WCF

Posted By: sgomez | Sep 18th, 2007 @ 1:49 PM
page 1 of 1
Comments: 4 | Views: 3781
#Sep 18th, 2007 @ 1:49 PM
sgomez
sgomez
Yada yada yada!
So, I've been Googling and Tafiting around for a long time now I've also posted many questions in the WCF form so this is pretty much my last hope... at least for now so if you understand WCF please, please write me back... at least just say "dude! I have no idea what you're talking about" Smiley

The thing is I need to implement Message security in WCF, UserName credentials in netTcpBinding with AspNetMemebershipProvider and I can't get it to work.

1- Is that possible?

2- Do I need to add a certificate in my services? (do I have to?)

3- Can somebody please point me out in the right direction? Expressionless

TIA
Regards,
Seba
#Sep 18th, 2007 @ 4:00 PM
JChung2006
JChung2006

It is possible (1).  You will need a certificate for your service to authenticate the service with your client (2).

Here are a couple good books on WCF. Both have sections on how to secure WCF services using the ASP.NET providers (3).

#Sep 19th, 2007 @ 6:55 AM
John Galt
John Galt
Actually you don't need a certificate.

You can create your own channel using shared secret.

There are numerous articles about how to do this in WSE, and the same basic logic applies to WCF. (I don't have a sample for you).

Basically MS took out the shared secret system that was built into WSE 1.0 for security reasons (which are all valid unless you're careful) and didn't replace it with a different, better solution.

What you want to do is have a shared secret between the server and the client. Do not pass the password, only the user name. I would suggest that the user name be unique for each client and the password would be some sort of unique hashing algorythem based on that user name.  The password should be LONG to ensure that it can't be hacked easily.

Then you encrypt the custom channel using whatever encryption system you wish, and you're set. (there is a one way implimentation of this on CodeProject somewhere)

MS:  Please put this back, but make it secure, because requiring certificates on both sides (x509) is rediculous!
#Sep 19th, 2007 @ 9:16 AM
JChung2006
JChung2006
I didn't see a clear cut way to implement a "shared secret" strategy in WCF.

Someone on my team is investigating creating a custom SOAP message (WCF Message Contract) with username credentials, but I would be interested in seeing an actual demo implementation of a custom WCF channel that does this.
#Sep 19th, 2007 @ 11:58 AM
sgomez
sgomez
Yada yada yada!
See what I'm saying?! There's no right answers to this kind of questions Sad

On the other hand I'm glad to see I'm not the only one thinking using a certificate sucks! Smiley

I'd like to read ore comments... keep'em coming!

Seba
page 1 of 1
Comments: 4 | Views: 3781
Microsoft Communities