WCF / basicHttp and NTLM authentication
Does anyone know exactly how NTLM authentication works in WCF / basicHttp? I wonder if user credentials are passed for each call to a service method, or if some kind of security token is used for subsequent calls to the service method.
The exact binding configuration I'm using:
<bindings>
<basicHttpBinding>
<binding name="winAuthBasicHttpBinding">
<security mode="TransportCredentialOnly">
<transport clientCredentialType="Ntlm" />
</security>
</binding>
</basicHttpBinding>
</bindings>
I found this type of config on the MSDN link. But I'm not sure if this is a good idea. An alternative would be to provide a custom GetAuthenticationToken () method to provide a security token for all subsequent client requests. This can be done using the Enterprise Library - Security Application Block.
Additional Information: The service is used by browser / Silverlight clients.
a source to share
In this case, each method call will complete.
What you are talking about would be a so called "secure session" where the client authenticates once against the server and then a shared token is used for subsequent exchanges. However, these protected session features are only available with wsHttpBinding and not with basicHttpBinding.
Mark
a source to share