WCF Authentication with Credentials in Message's Body

I am developing a webservice which must conform to a WSDL specification required by a given application, and in which every SOAP request carries a username and password in clear, plain text (I know that's a pretty bad idea, but that was not my desig开发者_Python百科n choice). Now I must authenticate every call to my service's methods by checking those credentials against a database of valid credentials. I have heard about WCF's UserNamePasswordValidator but, from what I understood, that applies only if the credentials are passed through the SOAP headers, which they are not. What are my options here?

---

You know this a bad idea, so I'm not going to question your setup :-)

If you have username and password send in clear text over the wire inside your soap body, simple use the info to validate the against your database instance manually. Take the username and password and validate that (or its MD5 hashes) with an SQL query, returning a row only when the values are found in the database. When the row returns, you know the user is authenticated.

---

What are my options here?

What you need to do in this case is implement a Custom Authorization Manager for your service. This is not too difficult to do as I have done it several times before. In a nutshell, you configure your service to point to a newly overridden method named CheckAccessCore where you preform the authorization logic. You should be able to inspect the context and the message body to get any credentials you need. The one thing to understand is there is some performance implications to inspecting the message body at this point, but if you have no choice at least a working solution will suffice.

This all happens prior to the actual method being called getting executed which is efficient because the method is never called if they are not authorized.

So here might be a typical configuration (some other configuration left out for brevity):

<behaviors>
  <serviceBehaviors>
    <behavior name="MySvcBehavior">
      <serviceAuthorization serviceAuthorizationManagerType="MyWCFService.CustomAuthorizationManager, MyWCFService" />
    </behavior>
  </serviceBehaviors>
<behaviors>

In your code for the service you might have something similar to the following, or use your own needs to inspect the message body:

public class CustomAuthorizationManager : ServiceAuthorizationManager
{

    protected override bool CheckAccessCore(OperationContext operationContext)
    {

        IIdentity primaryIdentity = operationContext.ServiceSecurityContext.PrimaryIdentity;
        if (primaryIdentity.Name == "user1")
        {
            return true;
        }
        else
        {
            return false;
        }

    }

}

Here were some notes in particular from my code comprised from the MSDN: The Identity Model infrastructure in Windows Communication Foundation (WCF) supports an extensible claims-based authorization model. Claims are extracted from tokens and optionally processed by custom authorization policies and then placed into an AuthorizationContext. An authorization manager examines the claims in the AuthorizationContext to make authorization decisions. By default, authorization decisions are made by the ServiceAuthorizationManager class; however these decisions can be overridden by creating a custom authorization manager. To create a custom authorization manager, create a class that derives from ServiceAuthorizationManager (this class) and implement CheckAccessCore method (done in this class). Authorization decisions are made in the CheckAccessCore method, which returns 'true' when access is granted and 'false' when access is denied.

Here are (2) additional links that exampnd on this. The 1st is a MSDN link that uses claims within the method. Just remember you can do anything you require within CheckAccessCore. It just requires by the end returning true or false. The second link is one from my blog where I have a full implementation but using Windows Authentication. Once again, the details for you will be to inspect the message body to get the needed details within that CheckAccessCore method.

How to: Create a Custom Authorization Manager for a Service:
http://msdn.microsoft.com/en-us/library/ms731774.aspx

How To: Create an ASP.NET style Windows Authentication Policy for WCF Services:
http://allen-conway-dotnet.blogspot.com/2010/01/how-to-create-aspnet-windows.html