Question

I am a WCF / Security Newb. I have created a WCF service which is hosted via a windows service. The WCF service grabs data from a 3rd party data source that is secured via windows authentication. I need to either:

1. Pass the client’s privileges through the windows service, through the WCF service and into the 3rd party data source, or…

2. Limit who can call the windows service / WCF service to members of a particular AD group.

Any suggestions on how I can do either of these tasks?

Answer 1

Is this in an intranet / behind-the-corporate firewall scenario?

If so, I’d use netTcp binding (the fastest in this scenario) with transport security and Windows client credentials. In that case, the caller’s Windows credentials will be passed into your WCF service.

Using the standard role-based security, you can then limit the callers to a given service method using Principal permissions – you can declaratively restrict who can call a method like this:

[PrincipalPermission(SecurityAction.Demand, Role = "Administrators")]
[PrincipalPermission(SecurityAction.Demand, Name = "JohnDoe")]
public void YourSensitiveMethod();

or you can programmatically check for existance of the WindowsIdentity in your service method and do whatever you want to do with it:

if(ServiceSecurityContext.Current.WindowsIdentity != null)
{
    WindowsPrincipal principal = new WindowsPrincipal(ServiceSecurityContext.Current.WindowsIdentity);
    if(!principal.IsInRole("Administrators")
    { 
        return; // or throw a FaultEXception or something
    } 
}

Does that help at all?

UPDATE: the ultimate resource for all things related to WCF and security would be the WCF Security Guidance on Codeplex. You should find samples and how-to’s for just about anything (and explanations about them, too!) on that page.

For securing a netTcpBinding with Transport security and Windows authentication as client credentials, use this binding configuration:

<bindings>
  <netTcpBinding>
    <binding name="SecuredByWindows">
      <security mode="Transport">
        <transport clientCredentialType="Windows"/>
      </security>
    </binding>
  </netTcpBinding>
</bindings>