使用WCF和Entity Framework在分层应用程序中实现身份验证和授权的最简单方法

Question

I am designing (and will be implementing) an layered application for "task management".
I would like to use ASP.NET MVC (not a condition) and use WCF (any kind of web services) for communication between server and client (= database and controller in mvc case). I would like to make it with WCF, because there probably will be an desktop client later (which will probably provide only part of functionality, but still...).
I have several layers in mind so far:

---- Services (Business logic) - WCF
--- Repository
-- ORM: Entity framework
- DB: MsSQL

This should be base (or let's say a server) of whole system. Client should be web application in ASP.NET MVC or Silverlight and also a desktop application (whatever technology.. silverlight, forms.. or even Adobe Flex).

The main problems so far:

1. I don't know what is better (easier): Trying to somehow implement default asp.net membership and glue it somehow with my tables for tasks (and projects etc.). Or should I try to modify asp.net membership to use my own users table? I need users to be able to change their details or create new user etc. inside my application (not with ASP.NET configuration tool). So I think, that I will need to find some easy way how to use asp.net membership, but with my users table.

2. I don't know where and how to do authentication and authorization of users. I like using attributes at controllers, which say, that controller isn't accessible unless user is in some group. But I think, that this way, I would only secure my client side, but the server remains insecure. So when someone gets an service's address, he can call it and get data. I don't know what is the simplest way to secure services in this scenario. Should I add an additional parameter to each service's operation, which would provide username and password which would service check every time? I don't think, that it's a correct solution.

I am really stuck with this.. because there is just too many different types of protocols, services and types. I'm lost in it. Also from what I have seen so far, the trend is all about REST. Which is of course cool and there are awesome visual studio templates like WCF Data Service, when I just provide my entities context and I got working CRUD app. But I am not creating an public service, I got one storage with data for all users and every user has to see only his data.

3 - Is there a simple way, how to generate serializable entities from Entity Framework? I have read few paragraphs about 'metal' tool, which can make LINQ to SQL entities serializable, co I can transfer them. I just want to know if there is any better way, then rewriting all my entities into composite types (lot's of remapping).

Sorry, if this seems too chaotic. I am quite new in .Net and there are simply too many technologies and principles, so it's hard to consume it all at once. I am also probably missing some relations and obvious solutions...

Thanks for any possible hint

Answer 1

We use a similar architecture but with NHibernate instead of EF.

1. ASP.NET Membership Provider is designed to support the scenario you are talking about. You can create your own subclass of System.Web.Security.MembershipProvider. This allows you to map all the functions to operate against your own tables.

2. You are absolutely correct - this needs to happen at the server. You need to look into System.IdentityModel.Policy.IAuthorizationPolicy. This interface allows you to customise the handling of authorisation at the WCF service. This can be based on name/password, windows authentication or even claims-based authorisation.

3. Cannot help with EF serialisation - but with NHibernate we had two options: i) Create DTOs for transmission on the wire and map to/from the DTOs, or ii) Create custom serialisers to take care of circular references etc. We went the second route.

My only other suggestion would be to question whether you need the repository layer if you're using EF. Why not have the service implementation logic deal directly with EF?