- Transport- eg SSL. basicHttpBinding is the only binding with no default security (to enable, configure the binding with security mode="Transport".). You also can't do transport security with wsDualHttpBinding (callback listeners).
- Message- eg WS-Security <security mode="Message">
message clientCredentialType="Windows" or "Certificate" or UserName ...
- Transport with message credential - both, but it's not end-to-end security like Message
If using transport security, you can only use Certificate or Windows credential type. behavior/serviceCredentials configure where to find authentication (eg certificate)
//For windows authentication access the current user by
var name1 = OperationContext.Current.ServiceSecurityContext.PrimaryIdentity.Name;
var name2 = ServiceSecurityContext.Current.PrimaryIdentity.Name;
In a json webHttp endpoint with [AspNetCompatibilityRequirements(RequirementsMode = AspNetCompatibilityRequirementsMode.Allowed)] you can use HttpContext.Current.User.Identity.Name as normal.
You can use the securitycontext for impersonation (MSDN) ServiceSecurityContext.Current.Windowsldentity.ImpersonationLevel = TokenlmpersonationLevel.Impersonation (or to access remote systems) .Delegation
You can impersonate some operations (Allowed or Required) using the ServiceAuthorization behavior ImpersonateCallerForAllOperations=true
For custom authentication, set the credentialType="UserName", and create a class that inherits from UserNamePasswordValidator (Validate doesn't return boolean- throw a SecurityTokenValidationException) For authorization, you can use OperationContext.Current.ServiceSecurityContext - you can get claimSets.
There's an IAuthorizationPolicy interface for custom authentication (reference System.IdentityModel). Implement the Evaluate method and assign a readonly list<IAuthorizationPolicy>
to host.Authorization.ExternalAuthorizationPolicies or in config <serviceAuthorization>
Use ASP Membership with WCF
<serviceCredentials> has a <userNameAuthentication> element- set userNamePasswordValidationMode="MembershipProvider" for ASP.Net membership instead of windows.
Or use <serviceAuthorization
roleProviderName ="SqlProvider" />
serviceCredentials has a clientCertificate and serviceCertificate.
clientCertificate/serviceCredentials/authentication has a certificateValidationMode can be Custom (a customCertificateValidatorType), ChainTrust (chain to root certificates) or PeerTrust (self-issued in Trusted People store).
In code you can set ProtectionLevel [OperationContract(ProtectionLevel = ProtectionLevel.EncryptAndSign)] (if you're using Transport security, this has no effect; you can't use it with BasicHttpBinding as that has no default security)