WCF - Third party application authentication

I am currently working on an iPhone application. This application calls back to WCF services exposed through my ASP.NET web application. Currently, my WCF operation looks like the following:

[Operation开发者_高级运维Contract]
[WebInvoke(Method = "POST")]
public string SubmitMessage(string message, int priority)
{
  try
  {
    // Process message
    // Return success code | message
  }
  catch (Exception)
  {
    // Return error code | message
  }
}

My web application is using ASP.NET Forms Authentication. My challenge is, I only want authenticated users to be able to call this operation from their iPhone. I know that the iPhone SDK has baked in support for XML. However, I’m not sure how to lock down my WCF operation such that only authenticated users can access it.

How do I make my WCF operation only accessible to authenticated users from third party applications?

Thank you

---

This has to be done in both sides of the transfer, namely server (WCF site) and client (iPhones).

• If you're using SOAP endpoints then you should look for Objective-C SOAP client libraries. This way all you will have to do is to setup best security options to your needs and your server-side code will be almost identical as it is at the moment.

• Instead if you're exposing as RESTful endpoints I suggest you to look for an OpenID(&OAuth) approach. Here also, there are .NET and Objective-C libraries available. I belive this solution would require much more coding in both of the sides.