I have an ASP.NET Web API that is set up to interact with WPF and soon other clients. This is a fully internal ecosystem, however I am aware security is still a large priority.
I have multiple HTTP GET methods that need admin permissions to access the necessary data (I am working partly with certificates within the local machine store and thus far haven't come to a way to access AND create certificates within this space without admin perms).
I can simply have the application pool being used by ASP.NET have full admin permissions, but I am aware of the poor security in that.
I have an idea but just wondering (A) am I wasting time with this approach as it is straight up wrong/not ideal or (B) how do I go about setting this up?
My current idea is to make a Windows Service running with admin perms. But I am unsure how to call the Windows service methods from my ASP.NET Web API.
As jeb mentioned in the comments, using communication protocols such as WCF or GRPC are valid options. I chose to go with named pipes. It worked well for my case because I just needed a simple, efficient, and local IPC to call methods on Windows Service from the ASP.NET API running on the same machine.