Question

(WCFDS = WCF Data Services 5,backed by Entity Framework, using oData v3, formatted as JSON, served up via IIS7 and protected by Windows authentication.)

The crux is accessing the WCFDS in an authenticated manner from an AJAX call.

To this end, I have a client as an ASP.Net Web Application with Windows authentication set in Web.config and a Service Reference pointing to the WCFDS.

I want to use client-side JavaScript to access the Service Reference. How can I do this?

I thought about creating an aspx page, hosting in the client and direct calls from JavaScript code to this page, which would then retrieve data through the Service Reference – but I’m at a loss over how to expose the full functionality of the Service Reference in this manner (there are dozens of entities).

Can anyone help with advice?

Answer 1

The Windows authorization settings in web.config are not directly related to WCF Data Services, so you probably won’t need to set anything there. You WILL need to set your settings up properly in IIS.

There are a number of good articles out there about using Windows authorization over WCF Data Services; in a nutshell you have a wide degree of freedom in how you choose to expose authorization (ranging from filtering out individual entities from a feed to throwing 401/403s).

A couple of good articles to read through:

• http://msdn.microsoft.com/en-us/data/gg192997
• http://blogs.msdn.com/b/astoriateam/archive/2010/07/21/odata-and-authentication-part-7-forms-authentication.aspx (yes, I know that’s forms auth but the auth part of this is entirely orthogonal to what the code looks like in your WCF Data Services)
• http://blogs.msdn.com/b/astoriateam/archive/2010/07/19/odata-and-authentication-part-5-custom-httpmodules.aspx

The simplest code you could possibly write would be something along the lines of:

namespace Scratch.Web
{
    [ServiceBehavior(IncludeExceptionDetailInFaults = true)]
    public class ScratchService : DataService<ScratchContext>
    {
        [QueryInterceptor("Products")]
        public Expression<Func<Product, bool>> ProductsAuthorization()
        {
            if (!HttpContext.Current.Request.IsAuthenticated)
            {
                return (p) => false;
            }
            return (p) => HttpContext.Current.User.IsInRole("AllowAccessToProducts");
        }

        // ...rest of service code...
    }
}

Note that everything on the client side is controlled by the browser, so you don’t really need to do anything there (the biggest step might be to add the site to Trusted Sites so it doesn’t prompt you for your credentials if you’re on a domain-joined machine).