Home/ Questions/Q 6564183
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-25T13:56:05+00:00

We have WCF services being self-hosted by a Windows Service inside our domain, using

  • 0

We have WCF services being self-hosted by a Windows Service inside our domain, using NetTCP with the following settings.

// Set Binding Security.
netTcpBinding.Security.Mode = SecurityMode.Transport;
netTcpBinding.Security.Transport.ClientCredentialType = TcpClientCredentialType.Windows;
netTcpBinding.Security.Transport.ProtectionLevel = System.Net.Security.ProtectionLevel.EncryptAndSign;

We now have a requirement to allow people outside the domain to access these Services (as long as they can provide proper domain credentials). Our goal isn’t to host the services via IIS, just allow those outside folks into our services. In my testing I was able to connect to a service from outside by “impersonating” the client proxy credentials during the WCF call as such.

proxy.ClientCredentials.Windows.ClientCredential.Domain = "MyDomainName";
proxy.ClientCredentials.Windows.ClientCredential.UserName = "MyUserName";
proxy.ClientCredentials.Windows.ClientCredential.Password = "MyPassword";

My question is: Is this the correct way? Is there a better way? Any advice would be greatly appreciated.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    This route is perfectly valid if you need to imperatively (in code, e.g. a credential popup, or read from a configuration file) set the credentials. A more secure option is to use the windows credential cache. Firstly you would set it up to use the cache:

    proxy.ChannelFactory.Credentials.Windows.ClientCredential = CredentialCache.DefaultNetworkCredentials;

    Next you would set up the credentials in the credential cache. In Windows XP/2003 this is under “Stored Usernames and Passwords,” (in the control panel) in Vista/7/2008 this is under “User Account > Credential Manager” (in the control panel).

    As said, your way is perfectly valid – the cache is just more secure.

    • 0