Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>This is a very reasonable approach. </p> <p>To do this you setup your service endpoint and configure it with your custom membership provider (You can do the same with SQL membership provider, it doesn't require a custom one).</p> <p>On the web application you set up the Authenticate event of the Login control to instantiate a new service proxy and set the username/password in the ClientCredentials in the proxy.</p> <p>Now when you make the call to the Service through the proxy WCF will pass these credentials through the secure channel to the service and use them for authentication.</p> <p>Now you simply need to store the proxy in session and use it for future access to the service as it has the channel state and a private key.</p> <pre><code>protected void LoginControl_Authenticate(object sender, AuthenticateEventArgs e) { bool Authenticated = false; try { MyServiceClient proxy = new MyServiceClient("MyServiceEndpoint"); proxy.ClientCredentials.UserName.UserName = LoginControl.UserName; proxy.ClientCredentials.UserName.Password = LoginControl.Password; //It doesn't really matter what is called or what it does because //Membership Provider for the Service does the authentication. string retval = proxy.login("Logging in"); //Now that channel is established the proxy needs to be kept //since it contains the channel state which includes a private key Session["MyServiceProxy"] = proxy; Authenticated = true; } catch (Exception ex) { //Login Error... } e.Authenticated = Authenticated; } </code></pre>
    singulars
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. VO
      singulars
      1. This table or related slice is empty.
    2. VO
      singulars
      1. This table or related slice is empty.
    1. COI think your suggestion is interesting, but I am concerned about what would happen if the channel faulted (communication error, unhandled service exception, etc) - the web application session would contain a reference to a dead proxy and there would be no way to create a new proxy since I wouldn't have access to the user's password.
      singulars
    2. COHaving thought about your suggestion some more, I don't think this kind of approach would be appropriate. The web application needs to interact with multiple WCF services (with the same user credentials) and this approach would require me to create a proxy for every service at the point when the user logs in and cache all these proxy references in the session. I don't think this will scale well and I need to support a large number of concurrent users on a shared server.
      singulars
    3. COEach time you instantiate the proxy it needs to go through a handshake to establish a secure channel. Depending on the configuration this may include certificate exchange and generating and sharing an ephemeral encryption key. Caching the proxy eliminates this exchange from happening on each and every request. I’m not sure how to answer the question about the faulted channel since I haven’t tested this scenario. If it doesn’t re-establish automatically then you would probably need to save the username/password somewhere as well. I don’t know that you would have much of a choice.
      singulars
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload