Solved

Limiting access to WCF service using Windows authentication

Posted on 2016-10-12
5
64 Views
Last Modified: 2016-11-02
I have a WCF service that can only be accessed by domain users. I used the following config:
    <system.web>
        <authentication mode="Windows" />
        <authorization>
            <deny users="?" />
        </authorization>
    </system.web>

Open in new window

The service is hosted on IIS 6, where Windows authentication is enabled and anonymous - disabled. the above worked fine for me but now i want to limit access to only a single uers. i tried the following:

    <system.web>
        <authentication mode="Windows" />
        <authorization>
            <allow users="DOMAIN\user1" />
            <deny users="*" />
        </authorization>
    </system.web>

Open in new window

but that did not work - all the domain users have access, not just user1.

I also tried:
    <authorization>
            <allow users="DOMAIN\Group1"/>
            <deny users="DOMAIN\Domain Users"/>
    </authorization>

Open in new window

I also tried to utilize PrincipalPermission attribute to limit access to a method:

 [PrincipalPermission(SecurityAction.Demand, Role = "Group1")]

Open in new window


But it did not make any difference at all. What can i do to limit the access to a user or group?
0
Comment
Question by:YZlat
  • 3
  • 2
5 Comments
 
LVL 26

Expert Comment

by:Dan McFadden
ID: 41841468
Here is an article that explains Authorization & Authentication.

Link:  https://weblogs.asp.net/gurusarkar/setting-authorization-rules-for-a-particular-page-or-folder-in-web-config

Here is the MSDN reference:  https://msdn.microsoft.com/en-us/library/wce3kxhd.aspx

An IIS Forum thread over issues with Authorization:  https://forums.iis.net/p/1173012/1961218.aspx

I've also answered a similar question recently here on EE:

https://www.experts-exchange.com/questions/28974384/IIs-block-files-web-config.html

Dan
0
 
LVL 35

Author Comment

by:YZlat
ID: 41846905
@DanMcFadden, per my code above, I am already using techniques described in the articles but it is not working.

None of the links you have provided helped me, plus most of them are on Forms authentication while I am using Windows authentication
0
 
LVL 26

Expert Comment

by:Dan McFadden
ID: 41857020
OK, have you read thru the followng article which explains the various strategies for using Authentication and Authorization is .NET apps?

Link:  https://msdn.microsoft.com/en-us/library/ff649337.aspx#secnetch08_authstrategies

It was released a while back, but the concepts remain essentially the same.

Also, what OS version are you using?

Have you only tried modifying the web.config?  Have you tried building the rules thru the IIS Manager?

Have you tried your config like this"

<authorization>
    <allow roles="DOMAIN\Group1"/>
    <deny roles="DOMAIN\Domain Users"/>
</authorization>

Open in new window


Dan
0
 
LVL 35

Author Comment

by:YZlat
ID: 41857189
Hi Dan. Yes, i have tried the above but found that when it comes to WCF services, authorization is a bit complicated. i am currently looking into creating custom WCF authorization using ServiceAuthorizationManager. Are you familiar with it?
0
 
LVL 26

Accepted Solution

by:
Dan McFadden earned 500 total points
ID: 41857195
I have read about it and played in DEV with the developers, but not implemented any production web services with it.

I do have an interesting article, its old but most likely still relevant.

Link:  https://pieterderycke.wordpress.com/2011/04/07/implementing-restricted-access-to-a-wcf-service-with-the-serviceauthorizationmanager/

Seems in line with the current MSDN article:  https://msdn.microsoft.com/en-us/library/ms731774(v=vs.110).aspx

Dan
0

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

What is an ISAPI filter?   •      It's an assembly (.dll file) that can add or change the way IIS works.   •      They can be enabled globally for your web server or on a site-by-site basis.   When the IIS server receives a request, enabling the ISAPI fi…
A long time ago (May 2011), I have written an article showing you how to create a DLL using Visual Studio 2005 to be hosted in SQL Server 2005. That was valid at that time and it is still valid if you are still using these versions. You can still re…
Windows 10 is mostly good. However the one thing that annoys me is how many clicks you have to do to dial a VPN connection. You have to go to settings from the start menu, (2 clicks), Network and Internet (1 click), Click VPN (another click) then fi…
Internet Business Fax to Email Made Easy - With  eFax Corporate (http://www.enterprise.efax.com), you'll receive a dedicated online fax number, which is used the same way as a typical analog fax number. You'll receive secure faxes in your email, f…

895 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

17 Experts available now in Live!

Get 1:1 Help Now