ensure web service only accessed by authorized applications

Question

I have ac# .net wcf web service on a windows server with iis. I need to know if there is a way to tell the web service that it can accept request only from specific URL. example: ApplicationA call ApplicationAwebService = should work ApplicationB call ApplicationAwebService = should be denied

Right now, they are all on the same server, but I need a solution that works even if they are on a different server (3tier applications). thanks

Answer 1

If you are using WCF then its possible to use mutual authentication between services and clients. Mutual authentication achieves not only security for the server to accept connections from legit clients but provides the ability for the clients to verify that they are talking to a legit server.

Mutual authentication can be achieved through Message security (Encrypting the data sent between the client and server and vice versa) by using certificates, kerberos (Windows auth), tokens and a username/password configuration.

Mutual authentication can also be achieved in WCF through rolebased authentication, identities, and resource based authentication

Reference from msdn: https://msdn.microsoft.com/en-us/library/ff647503.aspx