Question

I have a WCF service which uses netTcp binding and transport security. It uses Windows authentication (default).

Everything is working smoothly but I want to ensure that only a select windows user account can use this service instead of everyone in the domain.

Is there any way to accomplish this such that select user accounts can be written in config file and service will use them (rules out using attributes)?

Answer 1

You cannot do this in config – but since you’re using Windows authentication, you could easily use the ASP.NET role providers – either based on Active Directory / Windows domain role membership, or based on the ASP.NET build-in role/membership database.

With this, you could then use declarative syntax to limit callers to certain groups:

[ServiceContract]
interface IMyService
{
   [OperationContract]
   [PrincipalPermission(SecurityAction.Demand, Role="YourCustomRole")]
   public string MethodLimitedToGroup(string someInput);
}

Anyone who is not member of that group you specified, and tries to call this method, will receive a SecurityException – but nothing else.

You can also limit to a specific set of actual user names – not recommended, though – too complicated, too restrictive, in general:

[ServiceContract]
interface IMyService
{
   [OperationContract]
   [PrincipalPermission(SecurityAction.Demand, Name="User1")]
   [PrincipalPermission(SecurityAction.Demand, Name="User2")]
   public string MethodLimitedToGroup(string someInput);
}

You can define all of this in config:

<behaviors>
  <serviceBehavior>
     <behavior name="WinAuth">
        <serviceAuthorization principalPermissionMode="Windows" />
     </behavior>
  </serviceBehavior>
</behaviors>

and then simply assign that service behavior to your service in your config:

<service name="YourService" behaviorConfiguration="WinAuth"> ......

If you want to use the ASP.NET supplied membership/role database, specify

        <serviceAuthorization principalPermissionMode="UseAspNetRoles" />

instead.

Marc