How to implement WCF security for this scenario?

Question

Ok, so I'm a little new to WCF in terms of exposing services for public consumption. I need to expose an API for public consumption that will do two things:

1) Allow both .NET and non-.NET consumers to utilize the service. 2) Restrict access only to clients we have authorized.

There's a lot of info on WCF/Security out there and I have a feeling I'm overcomplicating it so I'm hoping the SO folks can boil it down to the basics for me. I'm looking for basically the easiest implementation that satisfies the above two requirements.

Answer 1

If you are hosting in IIS, take a look at the Custom Basic Authentication by leastprivilege. This blog post describes how to integrate it with WCF.

Answer 2

If you are happy to use Windows accounts for your authentication, simply use Basic Authentication. You will need to host the service using SSL to ensure passwords are not transmitted in the clear. More details and example are available here: http://msdn.microsoft.com/en-us/library/ms733775.aspx .