you're right, afaik in the wsHttpBinding script you describe requires us to use the WCF internal security stack. So what you usually do is
- leave anonymous access enabled
- create serviceBehavior with <serviceAuthorization mainPermissionMode = "UseWindowsGroups" />
- PrincipalPermissionAttribute,
- ?
:
public class TestService : ITestService
{
[PrincipalPermission(SecurityAction.Demand, Name = "testdomain\\administrator")]
public string DoWork()
{
return "Hello World " + Thread.CurrentPrincipal.Identity.Name;
}
}
<system.serviceModel>
<behaviors>
<serviceBehaviors>
<behavior name="WcfSecurity.Www.TestServiceBehavior">
<serviceMetadata httpGetEnabled="true" />
<serviceDebug includeExceptionDetailInFaults="false" />
<serviceAuthorization principalPermissionMode="UseWindowsGroups" />
</behavior>
</serviceBehaviors>
</behaviors>
<services>
<service behaviorConfiguration="WcfSecurity.Www.TestServiceBehavior" name="WcfSecurity.Www.TestService">
<endpoint address="" binding="wsHttpBinding" contract="WcfSecurity.Www.ITestService" />
<endpoint address="mex" binding="mexHttpBinding" contract="IMetadataExchange" />
</service>
</services>
</system.serviceModel>