WCF Based Forms Based Authentication via Web Application - Passing Credentials
I have a simple web service that handles security using forms based authentication.
WCFTestService.ServiceClient myService = new
WCFTestService.ServiceClient();
myService.ClientCredentials.UserName.UserName = "user";
myService.ClientCredentials.UserName.Password = "secret";
lblResult.Text = myService.GetData(1231);
myService.Close();
I am accessing this through a web app. So I want to do it above, but for security / performance reasons, there is no need to do it again. I was thinking about something like below, but since I am using FormsAuthentication it doesn't work ...
//Obtain the authenticated user Identity and impersonate the original caller
using (((WindowsIdentity)HttpContext.Current.User.Identity).Impersonate())
{
WCFTestService.ServiceClient myService2 = new WCFTestService.ServiceClient();
lblResult.Text = "From Logged On Credentials"+myService2.GetData(1231);
myService2.Close();
}
a source to share
What you are trying to do is establish a "secure session" between your client and your service. This is a concept that will only work with wsHttpBinding - so if you don't use that particular binding, it won't work.
To establish a secure session, you need to set a few specific configuration properties in the client and server config files - you can find these settings by reading the docs (search for "installSecurityContext") or check out Michele Leroux Bustumante's excellent WCF screencast on security basics on MSDN.
But really: I would not recommend using a secure session by all means. Under normal circumstances, the preferred option is to use services on a per-call basis, and the overhead of re-authenticating with each service call is indeed negligible.
Mark
a source to share