Question

After having searched for an answer thoroughly on SO, I have to ask my first question for good this time !

Here goes :
I have a Windows Forms app, which uses a dozen WCF services to handle all the business logic.
WIF is implemented on every single WCF service, and users are authenticated through a basic UserName authentication.
Everything works well except the Ping() method that we have.
Before WIF was implemented, we used to call every WCF service with a dummy Ping() method during the splash screen to ensure the service was up, but now the user can’t access this method since he’s not logged yet.

Is there a way to distinguish Authenticated and Anonymous Methods in a service on which WIF is implemented ? I suppose there isn’t, so I’d like to know if maybe an anonymous token could be issued by the STS ?

I’m pretty out of ideas right now, so any help or just some hints would be greatly appreciated 🙂

Answer 1

Depending on your configuration, you could create a set of services within a specific folder in your site, then add custom configuration to that location that would not include the Authentication and Session modules.

As an example:

<location path="AnonymousServices">
    <system.webServer>
        <modules>
            <remove name="WSFederationAuthenticationModule" />
            <remove name="SessionAuthenticationModule" />
        </modules>
    </system.webServer>
</location>

I have not tried this in practice, but it should work.