Home/ Questions/Q 1015199
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-16T10:21:55+00:00

Basic question here (I think), I was hoping someone could point me in the

  • 0

Basic question here (I think), I was hoping someone could point me in the right direction. I don’t know much about WCF but I’d like to create a web service to be called from an ASP.Net MVC application. The goal is to make sure only authorized ASP.Net users (we’re using forms authentication) can call the web service, not just anyone. Are there tutorials out there I can look at on how to approach this? Many thanks.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    I assume from the question that you don’t care what the end (MVC) user ID is that is hitting the WCF service (in other words you don’t need a specific authenticated user to hit the WCF so you can get the ID of that specific user (i.e. so you know that joeBobUser hit the WCF)). you just want to make sure that user is authenticated and authorized to use the site. You don’t need every potential user of your MVC app to be authenticated/authorized.

    As long as that is true, then my approach would be as follows:

  2. run your MVC app as a specific, known user account (i.e. set up the app pool in IIS to runas a domain user such as yourdomain\youMvcAccount) instead of the default asp account. There are lots sites that have instructions on how to make this happen if you are not already running your mvc app as a domain user.

  3. set up your WCF service endpoint configuration binding as WsHttp. Again, many sites describe how to do this. here’s one that does it via GUI (I prefer hand-editing the config but whatever). So now your WCF service will only accept secure, authenticated requests

  4. create your WCF client proxy in the MVC app. easiest way to do this (probably not best re: separation of concerns, but just to get started) is just add new web service and discover you WCF endpoint that way. Again, basic stuff easily googable if you don’t know how to do that.

  5. Now your MVC app will be making the call to the WCF service authenticated. However, at this point, any client authenticated in your domain can call the service. You are now accepting ONLY authenticated but ANY authorized user. All calls issued from your MVC app hitting the WCF will be from the identity yourDomain\yourMvcApp

  6. Restrict authorization to the identity set in #1 restricting (authorizing) authenticated users can be done a number of ways. The get’r’done fast way (but not very flexible as any change requires recompile) is just to check the identity of the request is the same as the identity of your WCF service directly in your service call. Alternatively, you can set up more robust (with the concurrently more goo) options such as AzMan or other WCF authentication rule sets. Again, many sites have instructions on setting that sort of thing up after you have an authenticated user. Here is a SO question that limits authorization to a windows group post (I’d do it that way–more flexible but you need to add that user to a group on your domain), and another article that goes more into the details of WCF security and allowing only a specific user access to the service.

  • 0