Part #8 DotNetNuke/WCF Service Security

WCF is a highly configurable technology/framework from Microsoft.  You can configure various deployment and security scenarious by simply editing your web.config file without have to make any code changes to your service contract or code.  That is incredibly powerful.  It is also incredibly complex.  Most of the examples you will find if you search the internet for “WCF Security” will talk about transport and message security, federation, WIF, ACS, etc…. and you will spend hours and hours reading whitepapers and blog posts about all of the options for implementing security for your WCF service. 

There is also not a single answer to the question of “how do I secure my WCF service?”.  If you get 100 security experts in a room, you’ll get dozens of different answers, and that’s because of the extreme flexibility of WCF.  You have many options.  So, while reading this section, keep in mind that this is “my” suggestion for securing a WCF service within DotNetNuke.  My requirements are that the security implementation secure both the SOAP and REST endpoints (ie: I don’t want to have to implement 2 different security schemes) and it should be easy to implement. (ie: I don’t want to have to write a bunch of security code in each and every exposed method).  I believe the approach I am about to present meets those requirements extremely well.  In fact, you’ll see that I really don’t have to write ANY security code in my methods at all!! I will just write my code, then apply a security layer “on top” of my OperationContracts. Buckle your seat belts!

http://www.gooddogs.com/Blog/tabid/97/EntryId/53/Part-8-DotNetNuke-WCF-Service-Security.aspx