All geek questions in one place

Submitting an authenticated user to a WCF application

I have 2 applications; one is an ASP.NET 3.5 Ajax application (client), and the other is a WCF web application (BackEnd).

Applications are deployed in a separate Windows Server 2008 compared to IIS 7. The backend application supports net.tcp and http network bindings; some services are exposed under netTcpBinding, and other services are exposed under basicHttpBinding; bindings did not configure any security.

The client application uses FormsAuthentication to authenticate users. All services under netTcpBinding are consumed in the client application. In the backend, I need to know which user invokes the service to perform any audit task. Is it possible?

+3
source share
1 answer

If you really don’t want to implement security for backend services and just want to be able to verify the user's identity (which means that you really TRUST, who sends you this information about your identity), you can consider the possibility of transmitting identification information through a custom header with every request.

IClientMessageInspector, , ASP.NET - HttpContext.Current.User.Name BeforeSendRequest. IClientMessageInspector , IEndpointBehavior, ( IClientMessageInspector ).

BeginSendRequest:

public void BeginSendRequest(ref System.ServiceModel.Channels.Message request, IClientChannel channel)
{
   string currentContextUserName = HttpContext.Current.User.Identity.Name;

   MessageHeader userNameHeader = MessageHeader.CreateHeader("Username", "urn:my-custom-namespace", currentContextUserName);

   request.Headers.Add(userNameHeader);
}

, IDispatchMessageInspector . , "" , OperationContext:: IncomingMessageHeaders.

+5

Source: https://habr.com/ru/post/1720607/

More articles:


All Articles