如何正确地将 System.Net.NetworkCredential 传递给 WCF 客户端？

Question

I currently have client device that prompts the user for user/pass and creates a System.Net.NetworkCredential that is passed to a WCF Service. This WCF Service then uses the credential to use on another external service.

The problem is that whenever I pass through the System.Net.NetworkCredential to the service it seems to lose the password field and so I never get it to authenticate with the external service. I've tested just passing in plain text/strings as user/pass and it works but feel like this is not great for security (although I do have HTTPS enabled for all traffic between the two services).

Is there a way to pass these credentials to the service correctly?

Here is some test code on the WCF service:

public string TestCred(System.Net.NetworkCredential c, string username, string pass)
{

    cred = c;
    userName = username;
    passWord = pass;
    string s = cred.UserName + cred.Password + "end";
    return s;

}

I have it return that string to test what is actually received at the Service side and the password is completely blank (the username makes it there ok).

Here is the code I use on the WCF service to contact the external service:

externalService.Credentials =  new System.Net.NetworkCredential(cred.UserName, cred.Password, "domain");

This doesn't work since the cred.Password field is blank, also I've tried:

externalService.Credentials = cred;

Which also fails.

When I use the plain strings though it works great:

externalService.Credentials =  new System.Net.NetworkCredential(userName, passWord, "domain");

Any suggestions? Since the connection between the client device-WCF and Service-External Service are all HTTPS-SSL required, it is slightly secure but I didn't feel great passing user/pass with strings.

Answer 1

Have you looked at the TokenImpersonationLevel? MSDN: TokenImpersonationLevel

                var credentials = new ClientCredentials();
            credentials.Windows.AllowedImpersonationLevel = TokenImpersonationLevel.Impersonation;
            credentials.Windows.ClientCredential = CredentialCache.DefaultNetworkCredentials;

            reportChannel.Endpoint.Behaviors.Remove<ClientCredentials>();
            reportChannel.Endpoint.Behaviors.Add(credentials);