I am developing a WCF service that can be consumed by ASP.NET applications where the user may be authenticated using either Windows or Forms. I want to be able to pass the principle user identity (be it forms or windows) to the WCF service.
The options for clientCredntialType are ‘windows’, ‘username’ ‘certificate’ or ‘issuedtoken’. ‘Windows’ cannot be used as sometimes it may use the forms authentication, and ‘UserName’ is out as it requires specifying the user name in code, which I will not be able to do. Is ‘Certificate’ the right way to go? Is this a certificate that contains the user identity or is it the certificate that is used to sign the message?
I can’t seem to find any demonstration of how to pass through the credntials. The possibility that forms authentication may be used means impersonation is not possible.
I’ve looked through just about everything regrding WCF security but I have not seen this explained. Can anyone help?
You can use forms authentication to authorize a user in WCF. Here is a great tutorial on how to get a simple WCF service up and running