Securing WCF Services

Question

I have WCF services hosted on a console application and a web application accessing its operations. I have searched for WCF security and in most cases the web services were hosted on IIS. What points should I follow in order to implement WCF transport layer security in my case?

What I want is

Using username and password to execute WCF operations
Use SSL to encrypt data.

If my WCF services are hosted on a console application. Are there any IIS configurations that I should make?

Ladislav Mrnka Ladislav Mrnka · Accepted Answer · 2011-04-29T07:41:21

If you want to expose WCF service over HTTP you can use BasicHttpBinding with custom configuration:

<bindings>
  <basicHttpBinding>
    <binding name="secured">
      <security mode="TransportWithMessageCredential">
        <message clientCredentialType="userName" />
      </security>
    </binding>
  </basicHttpBinding>
</bindings>

<behaviors>
  <serviceBehaviors>
    <behavior name="securedService">
      <serviceMetadata httpsGetEnabled="true" />
      <serviceCredentials>
        <userNameAuthentication userNamePasswordValidationMode="Custom" customUserNamePasswordValidatorType="Namespace.Type, assembly" />
      </serviceCredentials>
    </behavior>
  </serviceBehaviors>
</behaviors>

<services>
  <service name="Namespace.Type" behaviorConfiguration="securedService">
    <host>
      <baseAddresses>
        <!-- some url -->
        <baseAddress baseAddress="https://localhost:8088/Service" />
      </baseAddresses>
    </host>
    <endpoint address="" contract="Namespace.Type" binding="basicHttpBinding" bindingConfiguration="secured" />
    <endpoint address="mex" contract="IMetadataExchange" binding="mexHttpsBinding" />
  </service>
</services>

This will create SOAP 1.1 service using HTTPS and UserName token profile for transporting credentials in the message. It will also expose metadata (WSDL) over HTTPS and user name and password will be validated by custom validator. Default validation validates windows accounts but it can also be reconfigured to use ASP.NET membership provider.

The last thing you need to do is allowing HTTPS on used port (8088 in the example). For this you need a certificate with private key installed in certificate store on the machine (should be in My / Personal store in LocalMachine). You can create self signed certificate for test purposes.

Once you have a certificate you must assign the certificate to the port by using netsh. You should also allow application to listen on the port by using netsh otherwise your console application will have to run as admin (UAC - Windows Vista, 7, 2008, 2008 R2).

Securing WCF Services

2 Answers