通过WCF服务的多跳传递SecurityException

Question

I've got an ASP.NET MVC/WebApi application that acts as a WCF client. My WCF services are authorizing via ClaimsPrincipalPermission and additionally throw a SecurityException if the combination of the current user and the data does not match (eg user is trying to access data from other user).

I catch this as a SecurityAccessDeniedException in my filters and return status code 403.

This however only works for communication that involves a single hop. If the service itself communicates with yet another service, then the SecurityAccessDeniedException gets turned into a FaultException before it reaches the web application.

Example flow:

Web client --> Service A [SecurityException] --> [SecurityAccessDeniedException] Web

Web client --> Service A --> Service B [SecurityException] 
  --> [SecurityAccessDeniedException] Service A [FaultException] --> [FaultException] Web

I tried implementing an IErrorHandler that handles the SecurityAccessDeniedException but I cannot just throw a SecurityException there.

What are my options to propagate the SecurityException up to the Web client?

Alternatively: how can I construct a message in my error handler, which the client then correctly interprets as a SecurityAccessDeniedException ?

Answer 1

I'm now using an IErrorHandler which generates a corresponding FaultException . On the caller, this generates yet another SecurityAccessDeniedException , which I could then handle with the same IErrorHandler etc.

public void ProvideFault(Exception error, MessageVersion version, ref Message message)
{
    if (error is SecurityAccessDeniedException)
    {
        var code = FaultCode.CreateSenderFaultCode(
            "FailedAuthentication",
            "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd");

        var faultText = new FaultReasonText(error.Message, CultureInfo.CurrentCulture);

        var faultException = new FaultException(new FaultReason(faultText), code);
        MessageFault messageFault = faultException.CreateMessageFault();
        message = Message.CreateMessage(version, messageFault, "FailedAuthentication"); // the last parameter might not be semantically correct...
    }
}

I got this idea by looking at http://leastprivilege.com/2007/11/01/wcf-and-securityaccessdeniedexception/