Custom Username and Password Authentication in WCF 3.5

A few days ago I wrote about a new feature in WCF 3.5 to detect client's IP address. The other new feature in .NET Framework 3.5 and Windows Communication Foundation 3.5 is the ability to write custom username and password validators in transport level over HTTP.

You probably know that in WCF 3.0 you had three options to use Windows authentication, ASP.NET Membership provider authentication and custom validator authentication in message level to authenticate users. Having the capability to write custom validators in transport level has been a request for developers and the reason seems to be obvious in my opinion!

Fortunately in WCF 3.5 this feature has been added and is easy to use for everyone.

In WCF 3.5 you can write your own username and password validator just by deriving from UserNamePasswordValidator base class available in System.IdentityModel.Selectors and overriding its Validate method.

In the below code I implement my own validator by deriving from UserNamePasswordValidator class and override its Validate method. Here I just write an insecure implementation to show the concepts. There is only one point to mention and that is throwing the SecurityTokenException type when authentication fails.

using System;

using System.Collections.Generic;

using System.Linq;

using System.Text;

using System.IdentityModel.Selectors;

using System.IdentityModel.Tokens;

using System.ServiceModel;

 

namespace CustomValidator

{

    public class MyCustomValidator : UserNamePasswordValidator

    {

        public override void Validate(string userName, string password)

        {

            // This isn't secure, though!

            if ((userName != "Keyvan") || (password != "testPa$$word"))

            {

                throw new SecurityTokenException("Validation Failed!");

            }

        }

    }

}

Once you write your own custom implementation for the validator, you're able to configure your service to user it.

Read more: Keyvan Nayyeri

Posted via email from Jasper-net