wcf webhttp authentication

Question

I am working with WCF Webhttp services. I have created a bunch of services and all that remains is to put in user authentication...

Questions

• Keeping with the rest architecture style, should I authenticate each service call against the user db. If so, I should just do authentication by supplying the credentials and password each time the service is called and make it secure with SSL. Basically, each webget/webinvoke function should contain the user credentials as parameters and I authenticate each call. Is this right? This seems rather inefficient.

• Using session key somehow seems wrong but any pointers as to how to use Session in WCF Webhttp?

• I am not working with ASP .net membership (will be looking into it soon) since I was working with Mysql and have my own registration/user database created. Should I be looking at that? Can I use a wcf authentication service along with wcf webhttp services?

Any literature on handling authentication in WCF webhttp services would be greatly helpful.

Many thanks

Answer 1

You can check Chapter 8 of RESTful .NET book (Amazon, Google books)

You will authenticate only the first call from the user, any subsequent calls will use the context of the authenticated user. There are several options how you can use SSL(TLS), like always or just when you send username/password.

I am not sure where exactly and how you store the authentication token (like in Session or similar type).

You don't need to use ASP.NET membership provider, in fact you may not use any membership provider at all, just use other authentication models. Usually, there will be only one authentication model per service, like you get the credentials, check them against persisted storage, if valid you set the security token and that token is used for all the next calls for a limited amount of time.