WCF Security Clarification Needed

Question

I have created a WPF application and data storing and fetching based on my WCF services this is working fine.

When I try to implement security in WCF I got some problem.

1. This is the intranet application so I have enabled WCF security as transport security like below format --- transport clientCredentialType="Windows"

   
   
   
   
   
   
   
   
   

2. The problem is who are all having an intranet they can access my service. This I should stop. Only my application users can access.

3. I have created IIS server user groups but the problem is every user I should add the user in that group.

My Question: 1. How to enable security who is access my WPF application?

Answer 1

The problem is you're confusing security with authentication. Essentially security is securing the transport connection between your client and your services (i.e., the network traffic). As you've figured out by using client creditial type of "windows" it uses your windows login to validate that the client can talk to the services, but the client refers to your WPF application, not to the user of the WPF application.

What you need to be looking at is authentication. This refers to authenticating the user of your application with your WCF service. This page has some links to help with that: https://learn.microsoft.com/en-us/dotnet/framework/wcf/feature-details/authentication-in-wcf in particular I would recommend looking at asp.net membership provider: https://learn.microsoft.com/en-us/dotnet/framework/wcf/feature-details/how-to-use-the-aspnet-membership-provider