Security in WCF
Security in WCF
By : Kasim Wirama, MCDBA, MVP SQL Server
Security in distributed environment is very important. In internet/intranet environment, security covers authentication process and communication after authentication process. This also applies to WCF. This article, I would like to describe security aspects in WCF.
Some security issues in WCF are:
1. Message confidentiality.
It is possible that message could be eavesdropped before it reaches destination. To handle this issue, message encryption is the resolution.
2. Even though message is already encrypted, it is still possible the message is intercepted and made corrupted in the middle of trip from source to destination by hacker. To handle this issue, attach digital signature to the message.
3. Message could be intercept and diverted to other location so it never reached its real destination address or the message is repeatedly sent to destination. This kind of repeatedly sent to destination is known as replay attack. To avoid this possibility, message has timestamp on it, so service can check to the timestamp and discard it if it is outside range of allowable timestamp toleration. For handling reply attack, each message has its unique identifier.
4. It is possible that hacker imitates real service and client could send its important data to the false service, it is known as spoofing. To handle this issue, service should establish certificate to its clients, so clients can make sure that they connect to real service, and service also make sure that the real clients connect to.
When you begin to use WCF service, you need to provide identity to be authenticated by WCF service, once it is authenticated, it check whether your role has rights to execute certain method, it is called authorization. For enterprise environment, use of Active Directory is commonly used. Client application gives user name and password to WCF service, in turns, WCF service will query to Active Directory. Security authentication in windows domain with Active Directory is more like single sign on, means that user just issue his credentials for authentication only once for accessing several services that use Active Directory authentication, this single sign on is called windows integrated security. If there are more than one active directory in your organization, integrate them with mutual trust relationship.
For authorization, WCF can associate allowed operations to roles that an authenticated user belongs to. This could be achieved with .NET framework declarative security. To determine which roles a user belong to, WCF can use role provider provided by .NET framework. These role providers are:
1. Windows token role provider.
This provider takes roles information from Active Directory.
2. SQL role provider.
The source for roles and its user is in SQL Server database.
3. Authorization role provider.
The provider uses roles that are defined by Microsoft Authorization Manager tool. You can store roles definition in XML file or in Active Directory.
You use windows token role provider in windows domain environment, combined with windows integrated security. For internet environment, it is more appropriate to use SQL role provider.