WCF: Is Authentication / Authorization inside a message inspector a good design?

Question

This question is not about HOW something can be done. Everything is working fine. I like to know, if it is "ok" to do the authentication / authorization process inside a WCF message inspector.

Currently I am working on a client/server application with a WPF client and a self-hosted WCF server. The used protocol is Net.Tcp and all SOAP messages are AES256 message-encrypted and signed. Also all send SOAP message-headers are always message-encrypted and signed.

The complete auth process looks like this:

• Both server and client are always sending certificates to authenticate each other
• Client receives a list of all endpoints it can connect to
• Client sends User/Pass to authenticate and gets a session-id from the login-service
• The session-id, the user-id and all user-rights associated with the user-id are stored into RAM in a singleton service, which is available system-wide inside the server application.
• On every further request after the first login, the client only sends the session-id and a certificate inside a custom message-header, no more user/pass combination.

The situation:

Before a request from the client reaches any webservice operation, a message inspector reads the session-id and the requested webservice operation. It then uses the available singleton-service to determine if the session-id is still valid and if the associated user-id has the right to do this webservice operation. If not a fault-exception is thrown.

The question:

Is there anything wrong, to do the authentication / authorization process inside a WCF inspector?

Answer 1

If its working then dont break it :) But to answer you, I have put some insights for your to consider:

1- For service operations that dont require authentication, you would have to change the inspector code to whitelist them. This contradicts with the open close principle where your class must be open for extensions and closed for modification.

2- If later on, you decide to modify your authentication mechanism and use a third party component, you would have to modify your interceptor code drastically.

I usually use the WCF inspector to pass the token and other related info into my services classes where i normally implement the cross cutting concerns (Validation, Authentication, Authorization, Logging and exception handling). When you inject your authorization engine into your services, it becomes easier for you to first swap the mechanism when need be, second unit test your service method in isolation of whatever authentication mechanism you are using.