Question

I need to extend built-in WCF authentication, so my new one should work side-by-side with built-in ones.

For instance, I want to allow access from registered IP (custom auth) or with username+password (built-in auth).

I’ve successfully implemented ServiceAuthenticationManager and ServiceAuthorizationManager.

ServiceAuthenticationManager.Authenticate simply adds IPrincipal implementation to message properties, ServiceAuthorizationManager.CheckAccessCore copies IPrincipal from incoming message properties to AuthorizationContext properties.

However, ServiceAuthenticationManager.Authenticate is completely broken for standard mechanisms, even if I return authPolicy or result of base.Authenticate call.

Maybe I went in the wrong direction? What is the correct way to add custom WCF authentication, not affecting existing ones? How to fallback to built-in authentication if custom fails?

Answer 1

Correct approach:

Setup ServiceHost in OnOpening override

Authorization.PrincipalPermissionMode = PrincipalPermissionMode.Custom;
Authorization.ExternalAuthorizationPolicies = new ReadOnlyCollection<IAuthorizationPolicy>(new[] { new MyCustomAuthorizationPolicy() });

In the Evaluate method of custom policy assign three properties of evaluation context “PrimaryIdentity” to IIdentity, “Identities” to collection of identities and “Principal” to IPrincipal

evaluationContext.Properties["PrimaryIdentity"] = identity;
evaluationContext.Properties["Identities"] = new List<IIdentity>(new[] { identity });
evaluationContext.Properties["Principal"] = principal;