I want my silverlight application to use windows authentication so the user does not have to log in and I can use that to identify them.
One issue has come up though.
I have a set of super secret web services that do not have access to authenticate the user. What can I do to make sure that calls coming from the silverlight application are actually allowed? Do I need a certificate or something?
OK. A client certificate is probably what you need.
Reference: http://msdn.microsoft.com/en-us/library/ff649203.aspx
And then keep close control of the certificate. Your web service and your Silverlight app should be the only things with access to the certificate.