How to Handle Errors during ClaimsAuthenticationManager.Authenticate

Question

I have implemented a ClaimsAuthenticaitonManager in my WCF service to accept incoming claims from our enterprise ADFS and transform them into claims related to a user of the system (or generate an unauthorized response if the AD user is not registered as part of the system). These transformed claims are generated by querying the application database, and I would like to account for the possibility of network connectivity problems by returning a 503 status from the Authenticate method in the event the database cannot be reached to transform the claims.

First, is this a reasonable approach, and second, is it possible to do such a thing at this point in the request pipeline and how would I go about it?

Answer 1

The correct way to do this in WCF SOAP services is by using a custom ErrorHandler. This is the case whether you're using WIF or not.

A custom error handler implements IErrorHandler. This allows your service to throw exceptions, which are passed by WCF to your registered custom error handler. This allows you to inspect the exception and create an appropriate fault.

In your case, you would probably throw the exception that comes from your SQL client. As well as creating the right fault, you would also be able to do any other relevant action (e.g. typically logging the error).

The two methods on IErrorHandler are

ProvideFault(Exception error, MessageVersion version, ref Message fault) which allows you to inpsect the thrown exception and modify or create the correct fault.

And

HandleError(Exception error) which is called after the response is returned to the client. This is where you can do things like logging the error.

Details on how to implement this can be found at

http://blogs.msdn.com/b/carlosfigueira/archive/2011/06/07/wcf-extensibility-ierrorhandler.aspx

The error handler can easily be wired in using code, as in the link above. with a little extra work it can be wired in using web.config by implementing a custom service behaviour extension. An example of how to do this can be found at

http://weblogs.asp.net/pglavich/archive/2008/10/16/wcf-ierrorhandler-and-propagating-faults.aspx

Having said that, typically for SOAP services, you would not return the HTTP status code directly (i.e. the 503 status). Instead you would wrap the error up in a FaultException and return that.

For WCF REST, you would just throw a WebFaultException and the built in error handler for webHttpBinding would handle the transformation into an HTTP error:

http://blogs.msdn.com/b/endpoint/archive/2010/01/21/error-handling-in-wcf-webhttp-services-with-webfaultexception.aspx