Require credentials for some methods only in WCF web service

Question

I have a UserAccountService with various methods, some of which require user authentication (e.g. ChangePassword, ChangeUserData), and some not (RegisterUser).

However, it seems that I cannot get it to work, so only some methods require authentication.

Authentication methods decorated

[PrincipalPermission(SecurityAction.Demand, Authenticated = true)] 

In my app.config, I have a binding that uses encryption and asks for UserName credentials:

  <binding name="authenticatedBinding"> <security mode="TransportWithMessageCredential"> <message clientCredentialType="UserName" /> </security> </binding> 

(I am using basicHttpBinding)

I also have a custom authentication provider configured:

  <serviceCredentials> <userNameAuthentication userNamePasswordValidationMode="Custom" customUserNamePasswordValidatorType="..." /> </serviceCredentials> 

In this configuration, I cannot name any service methods without authentication.

If I do not use the security configuration, I can call methods that do not require authentication, but the message credentials are no longer migrated.

How can I configure my service to allow all methods to be called and require only a username / password to be set if PrincipalPermission requires it?

I use Silverlight as my client, if that matters ...

Thanks!

Answer 1

Security settings can be fine-grained at the endpoint level, but not within the contract, so you cannot combine safe and unsafe methods in the way you need. I suggest that

• You split your service contract (interface) in two parts - one for unsafe methods. And the second, which is inherited from the unprotected part and will contain operations that must be protected.
• You should not change (for example, implement a secure interface), you need to execute this implementation as two different contracts (on secure and other unsecured) at two different endpoints. You need to block the endpoint with a secure contract with any necessary security configuration.
• Unfortunately, from the point of view of the client, you need to switch the endpoint / URL on the authentication border, that is, until the user is authenticated, you can use an unprotected endpoint, but once it is authenticated, the client can use any end point.