MVC2 applications (and others) share WCF services and authentication

Question

I have seen several similar scenarios described here, but not mine. I wonder if anyone can tell me which direction to go?

I am developing two (and later) MVC2 applications. In the future, there will also be another (thicker) client (WPF or Silverlight, TBD). All of them must use the same authentication. For MVC2 applications, they (preferably) should be a single login - that is, if a user logs into one MVC2 application, they must be logged in with another if a cookie has not been set.

Form authentication must be used.

All applications must use common business functions and access the database through a common WCF service application. It would be nice (I think) if WCF is not publicly available (i.e. blocked by FW). A thicker client can use an additional service layer to access the Common WCF App.

What should look like this:

MVCApp1 → WCFAppCommon

MVCApp2 → WCFAppCommon

ThickClient -> WCFApp2 -> WCFAppCommon

Is it possible to complete all authentication / authorization in WCFAppCommon? Otherwise, I think I will have to repeat all the security logic in MVCApps and WCFApp2, while for me it seems to sit naturally in WCFAppCommon. On the other hand, it seems that if I authenticate / authorize in WCFAppCommon, I would not be able to use forms authentication.

Where I have seen possible solutions (which I have not tried yet), they seem much more complicated than forms using authentication and one DB.

Any help is appreciated,

Phil

Answer 1

I thought I should get back to this with what I learned (and relearn).

At first, the lesson of re-learning is not fixed on architecture, and then try to make everything else suitable. I fixed on .Net, SQL Server, WCF, MVC2, EF4, and IIS7. Fixing in my mind, as I want them to fit together, is very stupid! It’s better to go out and see what the manual is.

Which leads me to what I found out - here is the link:

http://wcfsecurityguide.codeplex.com/

I have declined this article several times because it is a bit outdated. Nevertheless, I would say that this is really very relevant, and if you are starting a project remotely related to the provision of services, take a look. Part IV was all I needed.

Answer 2

We use the WCF web application hosting reporting system (we access it from Silverlight), and since it uses the same machine keys as our MVC application, we can also use cookie authentication.

Otherwise, you need to send an authentication ticket (user or not) to your WCF application.