WCF Authentication using basicHttpBinding and custom UserNamePasswordValidator

Question

My first question is, is it even possible to use a custom UserNamePasswordValidor with basicHttpBinding?

I have a asp.net web site using Forms authentication and a custom membership provider. I realise that I could use the built in System.Web.ApplicationServices.AuthenticationService to authenticate my client (a WPF app) but I don't want two service calls (one for auth service, one for logic).

So it seems that a custom UserNamePasswordValidator would be perfect for the job. In my client I can then have:

        var service = new MyServiceClient();
        service.ClientCredentials.UserName.UserName = "username";
        service.ClientCredentials.UserName.Password = "password";

        MessageBox.Show(service.SayHello());

I've seen this working with wsHttpBinding but ideally would like to test without an SSL certificate.

Alternatively, is it possible to make use of the AuthenticationService from within another WCF service?

To clarify what I mean above regarding authentication service, I don't want to have 2 service calls ie:

            if (authService.Login("username", "password"))
            // then call my service

I know this a minor thing but the external developer of the client app is expecting just one service that takes the credentials and returns the required data.

Thanks, Ben

Answer 1

检查ClearUserName绑定： http ://webservices20.blogspot.com/2008/11/introducing-wcf-clearusernamebinding.html它应该可以解决您的问题。

Answer 2

I use UserNamePasswordValidator over basicHttpBinding on a couple of my current projects. It works great; however, like Brett Robi mentioned in the comments, you need to have your Security mode set to Message or TransportWithMessageCredentials in order for the validator to be called. These security modes require SSL through.

So in short - Yes you can over basicHttpBinding; however, only with SSL. Removing the security mode and SSL removes the credential validations from being called.