Section 10.6. Scenario-Driven Approach

10.6. Scenario-Driven Approach

Security is by far the most intricate area of WCF. For example, the following list shows the elements that govern security in every WCF operation call:

• Service contract

• Operation contract

• Fault contract

• Service behavior

• Operation behavior

• Host configuration

• Method configuration and code

• Client-side behavior

• Proxy configuration

• Binding configuration

Each of the items on the list may have a dozen or more security-related properties. Obviously, there is an overwhelming number of possible combinations and permutations. In addition, not all combinations are allowed or supported, and not all allowed combinations make sense or are consistent. For example, while technically possible, it does not make sense to use a certificate for client credentials in a homogenous Windows intranet, much like it makes little sense to use Windows accounts in an Internet application. The solution I chose for this book is to focus on a few key scenarios (and slight variations of them) that address the security needs of the majority of applications today.

The scenarios are:

• Intranet application

• Internet application

• Business-to-business application

• Anonymous application

• No security

I will demonstrate how to make the scenarios consistent and secure. In each scenario I will discuss how to support the security aspects of transfer security, authentication, authorization, and identity management. If you need an additional scenario, you can follow my analysis approach to derive the required security aspects and settings.