Section 10.4. Identity Management

10.4. Identity Management

Identity management is the security aspect that deals with which security identity the client sends to service and, in turn, what the service can do with the client's identity. Not only that, but when designing a service, you need to decide in advance which identity the service executes under. The service can execute under its own identity; it can use the client identity (when applicable); or the service can use a mixture, where it will alternate in a single operation between its own identity, the client identity, or even a third identity altogether. Selecting the correct identity has drastic implications on the application scalability and administration cost. In WCF, when enabled, the security identity flows down the call chain, and the service can find out who its caller is, regardless of the identity of the service.