Learning WCF

Summary

In this chapter, I covered a lot of ground related to security features of WCF. I started by explaining how you create a security policy for your services using binding configurations related to authentication, authorization, and message protection. I detailed the possible security settings for each of the core bindings, including NetNamedPipeBinding, NetTcpBinding, BasicHttpBinding, WSHttpBinding, and WSFederationHttpBinding. In addition, I discussed the following security concepts:

• Choices between transport and message security.

• The purpose of message security and extended features provided beyond transport security.

• Runtime identities, security principals, and their relationship to authentication, authorization, and access to operations and resources.

• Credential types supported for various scenarios and how to map to security tokens and claims.

• How to configure credentials for mutual authentication between clients and services.

• How to work with certificates, including a backgrounder on digital signatures and encrypytion.

In an attempt to simplify this otherwise daunting set of features, I then took you through several scenarios for secure communication for intranet, Internet, partner or machine authentication with certificates, and federation. In each section, I provided you with some guidance on how you would configure these scenarios to reduce the noise of features provided by each binding. What you should take away from this chapter are examples for the most common scenarios ...