Custom UserNamePasswordValidator with Silverlight 3.0

Question

I implemented a WCF service that uses the TransportWithMessageCredential binding and the custom UserNamePasswordValidator.

I have a Silverlight 3 client that connects to this service. However, if I set valid credentials, it works fine, however in the username validator I throw a SecurityTokenException if the username and password do not match.

Now I applied a dummy service call only to verify credentials, is there a “better” way to verify credentials. A service method that accepts a username and password and returns true / false does not feel secure.

Answer 1

I think that you are going wrong on security. There are built-in methods to deal with this. See Membership Providers. Example:

http://blogs.msdn.com/brada/archive/2008/05/03/accessing-the-asp-net-authentication-profile-and-role-service-in-silverlight.aspx