Databases
StackOverflow2013
Postsdbo
POUser/Pass Authentication using RESTful WCF & Windows Forms
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POUser/Pass Authentication using RESTful WCF & Windows Forms
    primarykey
    data
    text
    <p>What is the best approach to implementing authorisation/authentication for a Windows Forms app talking to an IIS-hosted RESTful WCF Service?</p> <p>The reason I ask is I am very confused, after sifting through different articles and posts expressing a different method and eventually hitting a ~650 page document on WCF Security Best Practices" (<a href="http://www.codeplex.com/WCFSecurityGuide" rel="nofollow noreferrer">http://www.codeplex.com/WCFSecurityGuide</a>) I am just uncertain which approach is the BEST to take and how to get started on implementation, given my scenario.</p> <p>I started with this article "A Guide to Designing and Building RESTful Web Services with WCF 3.5" (<a href="http://msdn.microsoft.com/en-us/library/dd203052.aspx" rel="nofollow noreferrer">http://msdn.microsoft.com/en-us/library/dd203052.aspx</a>) and a PDC video on RESTful WCF services, which was great and helped me implement my first REST-friendly WCF service,</p> <p>After I had the service working, I returned to implement security, see. "Security Considerations" (quarter down the page) and attempted to implement a HTTP Authorization header as per the instructions, however I found the code to be incomplete (see how 'UserKeys' variable was never declared). This is the point at which I tried to research more on how to do this (using a HMAC hash with the "Authorization" HTTP header, but could not find much on google?) it led me to other articles regarding message-level security, forms auth and custom validators and frankly I am not sure which is the best and most appropriate approach to take now.</p> <p>So with all that said (and thanks for listening up till now!), I guess my main questions are,<br /></p> <p><strong>- Which security implementation should I use?<br /><br /> - Is there any way to avoid sending the username/password with every WCF call? I would prefer not to send these extra bytes if a connection has been established at the beginning, which it will be before subsequent calls are allowed to be made after login.<br /><br /> - Should I even really be concerned about anything other than plain text if I am using SSL?</strong></p> <p>As said, .NET 3.5 win forms app, IIS-hosted WCF service, however what is important is I wish any and all WCF services to require this authorization procedure (however it should be, session, http header or otherwise) as I do not want anybody to be able to hit these services from the web.</p> <p>I know the above post is large but I had to express the route I have already been down and what I need to accomplish, any and all help is greatly appreciated.</p> <p>PS: I am also aware of this post <a href="https://stackoverflow.com/questions/141484/how-to-configure-secure-restful-services-with-wcf-using-usernamepassword-ssl">How to configure secure RESTful services with WCF using username/password + SSL</a> and if the community suggests I move away from REST for WCF services, I can do this, however I started with this to keep consistency for any public APIs to come.</p> <p>I think it's important I state how I am accessing my WCF Service (contacting the service is working, but what is the best way to validate credentials - and then return the Member object?):</p> <pre><code>WebChannelFactory&lt;IMemberService&gt; cf = new WebChannelFactory&lt;IMemberService&gt;( new Uri(Properties.Settings.Default.MemberServiceEndpoint)); IMemberService channel = cf.CreateChannel(); Member m = channel.GetMember("user", "pass"); </code></pre> <p>Code that was half implemented from MS article (and some of my own for testing):</p> <pre><code> public Member GetMember(string username, string password) { if (string.IsNullOrEmpty(username)) throw new WebProtocolException(HttpStatusCode.BadRequest, "Username must be provided.", null); if (string.IsNullOrEmpty(password)) throw new WebProtocolException(HttpStatusCode.BadRequest, "Password must be provided.", null); if (!AuthenticateMember(username)) { WebOperationContext.Current.OutgoingResponse.StatusCode = HttpStatusCode.Unauthorized; return null; } return new Member() { Username = "goneale" }; } </code></pre>
    singulars
    1. PO
      singulars
      1. PTAnswer
    1. This table or related slice is empty.
    1. PTQuestion
    1. USCommunity
    1. USGONeale
    plurals
    1. PL
      singulars
      1. LTLinked
    2. PL
      singulars
      1. LTLinked
    1. PL
      singulars
      1. LTLinked
    2. PL
      singulars
      1. LTLinked
    3. PL
      singulars
      1. LTLinked
    1. This table or related slice is empty.
    1. PO
      singulars
      1. PTAnswer
    2. PO
      singulars
      1. PTAnswer
    3. PO
      singulars
      1. PTAnswer
    1. VO
      singulars
      1. POUser/Pass Authentication using RESTful WCF & Windows Forms
      1. This table or related slice is empty.
      1. VTUpMod
    2. VO
      singulars
      1. POUser/Pass Authentication using RESTful WCF & Windows Forms
      1. This table or related slice is empty.
      1. VTUpMod
    3. VO
      singulars
      1. POUser/Pass Authentication using RESTful WCF & Windows Forms
      1. USbalexandre
      1. VTFavorite
    1. COcan you past the Video link for "...a PDC video on RESTful WCF services..."? Thanks.
      singulars
      1. POUser/Pass Authentication using RESTful WCF & Windows Forms
      1. USbalexandre
    2. COOn my blog - http://goneale.wordpress.com/2008/12/28/gearing-up-wcf-services-to-be-restful/
      singulars
      1. POUser/Pass Authentication using RESTful WCF & Windows Forms
      1. USGONeale
    3. COthank you very much :) i did found out about TL35 and I even downloaded the High Quality WMV movie, but you have much more links ;)
      singulars
      1. POUser/Pass Authentication using RESTful WCF & Windows Forms
      1. USbalexandre
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload