Programming WCF Services

Security Auditing

I will end this chapter with presenting a useful feature WCF supports called security audits. As the name implies, a security audit is a logbook of the security-related events in your services. WCF can log authentication and authorization attempts, their time and location, and the client’s identity. The class ServiceSecurityAuditBehavior governs auditing and is listed in Example 10-30 along with its supporting enumerations.

Example 10-30. The ServiceSecurityAuditBehavior class

public enum AuditLogLocation
{
   Default,//Decided by the operating system
   Application,
   Security
}
public enum AuditLevel
{
   None,
   Success,
   Failure,
   SuccessOrFailure
}
public sealed class ServiceSecurityAuditBehavior : IServiceBehavior
{
   public AuditLogLocation AuditLogLocation
   {get;set;}
   public AuditLevel MessageAuthenticationAuditLevel
   {get;set;}
   public AuditLevel ServiceAuthorizationAuditLevel
   {get;set;}
   //More members
}

ServiceSecurityAuditBehavior is a service behavior. The AuditLogLocation property specifies where to store the log entries, in the application logfile or in the security log, both in the event log on the host computer. The MessageAuthenticationAuditLevel property governs the authentication audit verbosity. For performance’s sake, you may want to audit only failures, or both success and failures. For diagnostic purposes you can also audit successful authentication. The default value of MessageAuthenticationAuditLevel is AuditLevel.None. Similarly, you use the ServiceAuthorizationAuditLevel ...