Home/ Questions/Q 6748549
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-26T12:34:43+00:00

Planning to migrate our existing application to Azure. Our existing architecture with security flow

  • 0

Planning to migrate our existing application to Azure.
Our existing architecture with security flow is as follows

  • ASP MVC 3.0 UI layer that takes user name password from the user
    We are planning to migrate the UI layer onto a compute cloud.
    and will be accessible at say uilayerdomainname.com which would have a SSL cert.

  • WCF REST webservices layer that amongst other things does authentication as well. This is currently on say servicename.cloudapp.net. (We could map it to servicelayername.com and get a SSL for that domain name as well).

  • SQL Azure database

The UI layer sends the credentials to the service layer which authenticates it against the SQL azure database.

Question

  • Both the WCF compute cloud and UI Layer are on the same region in Azure. Would the communication between these two be prone to man in the middle attacks? Does my WCF compute cloud need SSL as well? We do have two domain names with SSLs and so could just map the services to one.

  • Is there any way I can restrict traffic between the UI layer and the WCF compute cloud – allow only the UI layer to access the services layer?

  • Would the performance be better if I publish both the WCF services and UI layer on the same instance? It sort of shoots down the nice layered architecture but if it improves performance I could go with it. We don’t want to jump through too many hoops to accomodate the app to Azure lest it becomes difficult to migrate out of it.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    If you host your services in a Worker Role, then they can be available only to your Web Role. You can also host it elsewhere and monitor requests in code. Azure Roles in the same deployment can communicate with one another in a very specific way that is not available outside of the deployment.

    In Azure deployments, you need to very specifically define your public endpoint because the roles are hosted behind a load-balancer. If you host your WCF service from within a worker-role it will not be accessible publicly.

    Hope this helped

    • 0