Home/ Questions/Q 3958670
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-20T02:38:13+00:00

I have WCF web service and client that calls this service, This client will

  • 0

I have WCF web service and client that calls this service, This client will be deployed in many locations. I have to authenticate and authorize each client uniquely. So each location will have their unique user name and password.

Now my questions are

  1. how to identify each client uniquely?
  2. how to store some sensitive data in client side?

I thought about few approaches,

  1. Using a cert to identify the client. I have to generate and deploy certificate.
  2. Having an active directory on server side, and let each client use a windows user account.
  3. Encrypting user name and password and store them in config file. I believe encrypting config files using aspnet_regiis wont help me, since anyone can decrypt it, if they gain access to the machine.
Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Your question can be devided into three parts. Two are directly related to security in WCF and one is out of scope.

    Authentication and authorization – yes this is possible. WCF offers several settings to allow authenticating client and provide its roles. You can also build your own. The most common scenario for authenticating clients which are not in your AD domain is using user name and password credentials with custom validation on service or using client certificates.

    Confidentality and integrity – because of your consern about security you should also involve secure transport of credentials (and message data). If you do not provide secure transport anybody on the network will be able to sniff communication and steal credentials (or data). Attacker will also be able to intercept communication and modify transported data. To secure communication you need transport security (TLS,SSL / HTTPS) or message security – in Internet scenario provided by certificates.

    Securing credentials on client – this is mostly out of your control. Once you deploy client application with credentials to client machine which is not under your control you can never enforce security of provided credentials. It is up to your users / customers. If you somehow include credentials in your application skilled end user / attacker will probably always be able to get them. But this is problem of every secure solution – somebody must have access to credentials.

    • 0