Question

I have multiple NET.TCP services that provide access to my apps bussiness logic layer. I want to authenticate clients with username & password, within all the services, from one dedicated authentication service.

I have thinked that I can generate a custom authentication ticket when the authentication service logons the user and send it to other services. However when talking about security I prefer to use builtin implementations that have been already tested.

Is there a more WCF way to do this? Should I ever try this, or share the authentication logic and authenticate every service?

Thanks in advance

Answer 1

Yes, the (new) WCF way to do this is to use a (or implement your own) security token service based on the windows identity foundation framework.