In the Internet scenario, the clients or services may not be using WCF, or even Windows. If you are writing an Internet service or client, you cannot assume the use of WCF on the other end. In addition, an Internet application typically has a relatively large number of clients calling the service. These client calls originate from outside the firewall. You need to rely on HTTP for transport, and multiple intermediaries are possible. In an Internet application, you typically do not want to use Windows accounts and groups for credentials; instead, the application needs to access some custom credentials store. That said, you could still be using Windows security, as demonstrated later.
In an Internet application, you must use Message security for the transfer security
mode to provide for end-to-end security across all intermediaries. The client should
provide credentials in the form of a username and password, as this is a safe, low common
denominator that all platforms support. For the Internet scenario, you should use the
WSHttpBinding and the
WSDualHttpBinding. You cannot use the basic binding because it does not
provide for username credentials over Message security. In addition, if you have an
intranet application that uses the
NetTcpBinding but you do not wish to use Windows security for user accounts and groups, you should follow the same configuration as with the WS-based bindings. This is done uniformly across these ...