Internet facing WCF Security best option

Question

My scenario is that I have to expose some API over WCF to third party clients. I wanna use the most secure option. Ideal solution would be making a windows account for each client in my server active directory and letting them access the service with Transport & Message security and Client credentials username. So I could ask the client to provide username and password and use windows group policy to role base authorization.

Since this is an internet facing WCF service, I'm not sure I could use windows accounts??? Should I be using database solution to manage usernames, pwd and roles?

Should be able to consume from .NET clients as well as Java clients. Third party clients could be anything that can consume soap.

What's the best security option to this scenario? VPN is not an option as this totally should go over internet. Your help is very much appreciated.

Answer 1

It sounds like what you need is some kind of a token based authentication setup. Microsoft seems to publish the best material in the game for this kind of thing. You can find their articles here and pick the scenario of security that most closely matches your needs:

Microsoft WCF Security

Answer 2

you can use ASP.net membership with form authentication for your service.

using windows authentication for internet facing service is not a good idea.
for more information:

How to: Enable the WCF Authentication Service

Windows Communication Foundation Authentication Service Overview

Securing WCF with Forms Authentication