2

I'm developing a WCF Service Application with

  • Server hosting the app is in domain
  • Authorize client using basic authentication
  • mapping username and password to AD user
  • HTTP
  • IIS only allow Basic Auth

I have found this MSDN article, but this is a sample for HTTPS.

Huge mount tries on web.config has been made, but I cannot figure out how to config.

Any help will be appreciated :)

Thanks

2
  • 1
    the tutorial is HTTPS related because you should not be passing credentials through HTTP
    – Kritner
    Apr 28, 2016 at 11:09
  • 2
    In general, yes. But in the internal and protected network, HTTP will be a option.
    – user5466334
    May 6, 2016 at 1:43

1 Answer 1

1

you can change the binding to be basic binding instead of wsBining

<basicHttpBinding>
        <binding name="BasicBinding" receiveTimeout="00:01:00"
          sendTimeout="00:01:00">
          <security mode="None">
            <transport clientCredentialType="Basic"/>
            <message clientCredentialType="UserName" />
          </security>
        </binding>
      </basicHttpBinding>

an other option you can add a custom user validation method (Class) to your application and create your authentication inside of it

<serviceBehaviors>
<behavior name="ServiceBehaviour">
<useRequestHeadersForMetadataAddress />
<serviceMetadata httpGetEnabled="true" httpsGetEnabled="true" />
<serviceDebug includeExceptionDetailInFaults="true" />
<serviceCredentials>
<clientCertificate>
<authentication customCertificateValidatorType="WCFServices.clsCertificateValidator, App_Code/WCFServices" certificateValidationMode="Custom" revocationMode="NoCheck" />
</clientCertificate>
<userNameAuthentication userNamePasswordValidationMode="Custom"              customUserNamePasswordValidatorType="WCFServices.clsUserValidator, App_Code/WCFServices" />
<peer>
<peerAuthentication customCertificateValidatorType="WCFServices.clsCertificateValidator, App_Code/WCFServices" certificateValidationMode="Custom" revocationMode="NoCheck" />
<messageSenderAuthentication customCertificateValidatorType="WCFServices.clsCertificateValidator, App_Code/WCFServices" certificateValidationMode="Custom" revocationMode="NoCheck" />
</peer>
<issuedTokenAuthentication audienceUriMode="Never" customCertificateValidatorType="WCFServices.clsCertificateValidator, App_Code/WCFServices" certificateValidationMode="Custom" revocationMode="NoCheck" allowUntrustedRsaIssuers="true" />
</serviceCredentials>
</behavior>
</serviceBehaviors>

And in this class if you need to stop the user throw exception.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.