In the previous post
I showed how token based authentication can be implemented for WCF HTTP based services.
Authentication is the process of finding out who the user is – this includes anonymous
users. Then it is up to the service to decide under which circumstances the client
has access to the service as a whole or individual operations. This is called authorization.
By default – my framework does not allow anonymous users and will deny access right
in the service authorization manager. You can however turn anonymous access on – that
means technically, that instead of denying access, an anonymous principal is placed
on Thread.CurrentPrincipal. You can flip that switch in the configuration
class that you can pass into the service host/factory.
var configuration
= new WebTokenWebServiceHostConfiguration
{
AllowAnonymousAccess = true
};
But this is not enough, in addition you also need to decorate the individual operations
to allow anonymous access as well, e.g.:
[AllowAnonymousAccess]
public string GetInfo()
{
...
}
Inside these operations you might have an authenticated or an anonymous principal
on Thread.CurrentPrincipal, and it is up to your code to decide what to do.
Side note: Being a security guy, I like this opt-in approach to anonymous
access much better that all those opt-out approaches out there (like the Authorize attribute
– or this.).
Claims-based Authorization
Since there is a ClaimsPrincipal available, you can use the standard
WIF claims authorization manager infrastructure – either declaratively via ClaimsPrincipalPermission or
programmatically (see also here).
[ClaimsPrincipalPermission(SecurityAction.Demand,
Resource = "Claims",
Operation = "View")]
public ViewClaims GetClientIdentity()
{
return new ServiceLogic().GetClaims();
}
In addition you can also turn off per-request authorization (see here for
background) via the config and just use the “domain specific” instrumentation.
While the code is not 100% done – you can download the current solution here.
HTH
(Wanna learn more about federation, WIF, claims, tokens etc.? Click here.)
