Question

Does anyone know how exactly NTLM authentication works in WCF/basicHttp? I wonder if user credentials are passed for every single service method call, or if some kind of security token is being used for subsequent service method calls.

The exact binding configuration that I am using:

<bindings>
  <basicHttpBinding>
    <binding name="winAuthBasicHttpBinding">
      <security mode="TransportCredentialOnly">
        <transport clientCredentialType="Ntlm" />
      </security>
    </binding>
  </basicHttpBinding>
</bindings>

I found this type of configuration on the MSDN reference. But I am not sure if this a good idea performance wise. An alternative would be providing a custom GetAuthenticationToken() kind of method to provide a security token for all subsequent requests of the client. This could be done via the Enterprise Library – Security Application Block.

Further details: The service is being consumed by Browsers/Silverlight Clients.

Answer 1

In this case here, every single method call will be authenticated.

What you’re talking about would be what is called “secure sessions”, where the client authenticates once against the server and then a common token is used for subsequent exchanges. That secure sessions features however is only available with wsHttpBinding – not with basicHttpBinding.

Marc