4

I am in the process of creating a WCF RESTful service that will be secured by passing externally obtained authentication tokens in the HTTP headers. In summary the sequence is much like this:

  1. Client : Get authentication token from identity server
  2. Client : Construct REST call placing authentication token in a custom HTTP header
  3. Client : Perform get
  4. Rest Server : Verify auth token is present
  5. Rest Server : Query identity server to verify token and obtain user context
  6. Rest Server : Authorise user Rest Server : Perform service action

So, my question is what is the best way of going about doing this in WCF/.NET? I could of course hand craft the authentication/authorisation check in my REST method, i.e.

public void DoSomething(string input)
{
    if (Authed())
    {
        ...Do DoSomething...
    }
    else
    {
        throw new FaultException<MyFault>(new MyFault("Not today, thanks"));
    }
}

public bool Authed()
{
    string rawUserAuthToken = WebOperationContext.Current.IncomingRequest.Headers["MyCustomHttpHeader"];

    ...Do the magic needed to verify and Authorise the incoming token...

    return result;
}

However, I am sure there are far more elegant ways of achieving this in WCF. Having done a little Googling I have come across SecurityTokenAuthenticator but it doesn't seem to fit what I need.

https://msdn.microsoft.com/en-us/library/system.identitymodel.selectors.securitytokenauthenticator(v=vs.110).aspx

So, any suggestions?

EDIT: A key factor here is that the solution has to be cross system/language neutral, clients will be based on just about every technical stack imaginable so they can't "just add a service reference"

Thanks

MrEyes
  • 13,059
  • 10
  • 48
  • 68
  • Are you looking for a way which will allow you to check tokens on a server without writing `if (Authed())` in each method? – Yoh Deadfall Mar 24 '15 at 14:33
  • @YohDeadfall In essence yes, I would like the user to be authorised before the call into DoSomething(). I may want to enforce different security models/requirements for different deployments having it outside the functional method makes this much easier – MrEyes Mar 24 '15 at 15:23
  • You can use `IClientMessageInspector` to perform authentication and `IDispatchMessageInspector` to verify a token. Or use `IParameterInspector` to do same things not on all operations. I can write an example if you want . – Yoh Deadfall Mar 24 '15 at 15:49

0 Answers0