Question

I have a web service that has multiple web methods. Is there a way to expose only one of these web methods to a certain group or person?

As of right now, I use Windows authentication and user groups for authorization. This just allows complete access to the web service.

<authentication mode="Windows"/>
<authorization>
    <allow users="*" roles="domain\groupName"/>
    <deny users="*"/>
</authorization>

Is there a way to add another group in the roles attribute that would allow access to only “MyMethod” and not the other web methods that exist in the web service?

Any help is greatly appreciated!

Answer 1

Have a look at the Role-based Authorization Options in WCF section in the article Authentication, Authorization, and Identities in WCF. The Declarative Authorization section seems to be what you are looking for.