Home » Silverlight 3: Securing your WCF service with a custom username / password authentication mechanism

Silverlight 3: Securing your WCF service with a custom username / password authentication mechanism

By Alex van Beek
14 years ago
9 comments
.NET

There seems to be a lot of confusion on the web about how to secure the backend WCF service of your Silverlight application, with a username and a password. In Silverlight 2, things were a bit tricky. The generated proxies of Visual Studio didn’t have a ClientCredentials property. So to send any custom username / password information to your service, you had to manipulate some headers. Another option was to let the browser do the authentication for you, in combination with asp.net and forms authentication, but that would leave your site open for CSRF attacks. This was the most convenient option in Silverlight 2. You can find a good tutorial about combining ASP.NET’s forms authentication with Silverlight here.

Luckily, in Silverlight 3 we have a third option and this is in my opinion the best way to secure WCF services with a username / password for Silverlight. I’m going to cover this option in this blog post.

The WCF Service

We’re going to use a simple WCF service, because the point of interest is of course the security part. This is the service interface:

using System;
using System.Collections.Generic;
using System.Linq;
using System.Runtime.Serialization;
using System.ServiceModel;
using System.Text;
&nbsp; 
&nbsp; 
[ServiceContract]
public interface IHelloSayer
{
    [OperationContract]
    string SayHello();
}
&nbsp; 

And this is the implementing class:

using System;
using System.Collections.Generic;
using System.Linq;
using System.Runtime.Serialization;
using System.ServiceModel;
using System.Text;
using System.Security.Permissions;
using System.Security;
&nbsp; 
&nbsp; 
public class HelloService : IHelloSayer
{
    
    public string SayHello()
    {
        //block unauthenticated users, can't use the [principalpermission] attribute for this
        if (!OperationContext.Current.ServiceSecurityContext.PrimaryIdentity.IsAuthenticated)
        {
            throw new SecurityException();
        }
        return "Hello: " + OperationContext.Current.ServiceSecurityContext.PrimaryIdentity.Name;
    }
    
}

Note the part to block unauthenticated users, I can’t use the [PrincipalPermission] attribute for this because I haven’t configured any role based security and therefore the calling thread’s current principal is not set. If you have a lot of methods, you could of course write your own behavior for this.

WCF Configuration

What’s more important, is the configuration file that is going to enable the security for my service. Well, here it is:

<system.serviceModel>
    <services>
        <service behaviorConfiguration="ServiceBehavior" name="HelloService">
    <host>
      <baseAddresses>
        <add baseAddress="https://localhost"/>
      </baseAddresses>
    </host>
        <endpoint address="" binding="basicHttpBinding" bindingConfiguration="test" contract="IHelloSayer">
            <identity>
                <dns value="localhost"/>
            </identity>
        </endpoint>
            <endpoint address="mex" binding="mexHttpsBinding" contract="IMetadataExchange"/>
        </service>
    </services>
<bindings>
  <basicHttpBinding>
    <binding name="test">
      <security mode="TransportWithMessageCredential">
        <message clientCredentialType="UserName"/>
      </security>
    </binding>
  </basicHttpBinding>
</bindings>
    <behaviors>
        <serviceBehaviors>
            <behavior name="ServiceBehavior">
                <serviceMetadata/>
                <serviceDebug includeExceptionDetailInFaults="false"/>
                <serviceCredentials>
                    <userNameAuthentication userNamePasswordValidationMode="Custom"
                       customUserNamePasswordValidatorType="MyValidator, AuthenticationLib"/>
                    </serviceCredentials>
            </behavior>
        </serviceBehaviors>
    </behaviors>
</system.serviceModel>

The most of this should be familiar to WCF developers, so i will highlight only the options that have something to do with Silverlight and Security:

Line 9: I’m using the basicHttpBinding, this is of course because Silverlight only supports the basicHttpBinding. Note that I use a specific binding configuration named “test”.
Lines 18-24: This part specifies the “test” binding configuration. Note the security mode. Using Transport only would leave me no options for a custom username / password scenario; basic and digest both don’t play nice with WCF’s custom username / password mechanism. Ideal would be Message security, but the combination of Message security and basicHttpBinding doesn’t support a username / password scenario. That leaves us with one option that supports a WCF custom username / password scenario and can be used with a basicHttpBinding, namely TransportWithMessageCredential. This option means that the credentials are part of the SOAP message, but are stored in plain text. Because storing the credentials in plain text is unsecure, a secure connection is mandatory, for http this means SSL. So this option really is a combination of transport security (SSL) and credentials inside the message, hence the name TransportWithMessageCredential I guess :).
So far we have configured that we need the credentials to be a part of the message and that the transport of the message must be done using SSL. The only thing we still have to configure is what form of credentials the client must provide. That part is configured in line 21, the value “UserName” actually means “UserNameAndPassWord”, because a client can provide a username and a password.
Lines 31-34: This section inside a service behavior, specifies how WCF should handle incoming client credentials. Since our credentials take the form of a username / password combination, we use the “userNameAuthentication” element to configure that we want to authenticate the credentials our self. This is achieved by setting the “userNamePasswordValidationMode” to “Custom” and the “customUserNamePasswordValidatorType” to a type that can perform our custom validation. The format is {FullyQualifiedTypeName, AssemblyName}. Take a look at the “MyValidator” class:

using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using System.IdentityModel.Selectors;
using System.Security;
using System.IdentityModel.Tokens;
using System.ServiceModel;
&nbsp; 
/// <summary>
/// Custom username / password validator
/// </summary>
public class MyValidator : UserNamePasswordValidator
{
    public MyValidator()
    {
        
    }
&nbsp; 
    public override void Validate(string userName, string password)
    {
        if (userName != "Alex" || password != "vanbeek")
        {
            throw new FaultException("Invalid username / password combination!");
        }
&nbsp; 
    }
}

This is a very simple example, but I might have used ADO.NET to check the credentials in a database or any other way to authenticate the credentials. A couple of rules for this class:

In order to be used as a custom username / password validator, it must be derived from the UserNamePasswordValidator class.
Perform authentication by overriding the Validate method.
If validation fails, throw a SecurityTokenException if you want a non informative message or a FaultException if you want a informative message. If validation succeeds, just do nothing.

Binary Message Encoding

More and more people are using the new Silverlight 3 binary message encoding and with good reason. So just for completeness, here is the binding part of the configuration file when using the new BinaryMessageEncoding for Silverlight 3:

<customBinding>
   <binding name="test">
     <security authenticationMode="UserNameOverTransport"/>
     <binaryMessageEncoding/>
     <httpsTransport/>
   </binding>
</customBinding>

The Silverlight application

 Take a look at the code of the Silverlight application:

using System;
using System.Collections.Generic;
using System.Linq;
using System.Net;
using System.Windows;
using System.Windows.Controls;
using System.Windows.Documents;
using System.Windows.Input;
using System.Windows.Media;
using System.Windows.Media.Animation;
using System.Windows.Shapes;
using SecureSilverlightApp.security;
using System.Net.Browser;
&nbsp; 
namespace SecureSilverlightApp
{
    public partial class MainPage : UserControl
    {
        public MainPage()
        {
            WebRequest.RegisterPrefix("https://", WebRequestCreator.ClientHttp);
            InitializeComponent();
            HelloSayerClient hsc = new HelloSayerClient();
            hsc.ClientCredentials.UserName.UserName = "Alex";
            hsc.ClientCredentials.UserName.Password = "test";
            hsc.SayHelloCompleted += new EventHandler<SayHelloCompletedEventArgs>(hsc_SayHelloCompleted);
            hsc.SayHelloAsync();
        }
&nbsp; 
        void hsc_SayHelloCompleted(object sender, SayHelloCompletedEventArgs e)
        {
            if (e.Error != null)
            {
                MessageBox.Show(e.Error.InnerException.Message);
            }
            else
            {
                MessageBox.Show(e.Result);
            }
        }
    }
}

It’s a simple application that calls the service on startup. Important lines are:

Line 21: I’m using the new ClientHttpStack, to prevent the dreaded “NotFound” errors. This way, error messages from the service can flow through to my Silverlight application.
Lines 24-25: In Silverlight 3 the generated proxies support the new ClientCredentials property. You can use this to set the username and password. You have to set this only once and the credentials get send with every call you make on the proxy. The observative reader will notice that the provided password, is not allowed by my custom password validator. When running this application the message will be:

After changing the password property of the ClientCredentials property of the proxy to the allowed password “vanbeek”, the message will look like this:

 This shows that the client’s credentials flow neatly into the WCF service with every call. You can extend this example with declarative role based security by using WCF’s custom role based security mechanism.

9 comments

Nice example on how to secure a silverlight app using custom username/password mechanism.

However, what security does the binary message encoding provide? If I’m a rogue application I can still try to figure out the binary encoding and hack the application. In my opinion this is a case of security through obscurity.

willemm/ 14 years ago
Hi Willem,

The binary encoding itself doesn’t provide any security, just the encoding. In above example the security with the binaryEncoding comes from the
element. This authenticationMode forces that the messages travel over a secure transport because the credentials are a unencrypted part of the messages, hence the
element. A normal element isn’t allowed. So binaryEncoding itself, doesn’t provide security, but the other elements in the custom binding do.

Alex van Beek/ 14 years ago
Hi Alex,

I see and I’m glad Microsoft limited the use of that security setting to be used only with a https transport. This saves developers a lot of trouble and I’m pretty sure architects and reviewers will be pleased with this topo 😉

In my opinion the binary message encoding provides other advantages that developers like. Mainly because it saves you precious time to get the request to the server and a response back to the silverlight client, because the messages send and received are a lot smaller.

willemm/ 14 years ago
Thanks, that’s a realy nice example…

Calabonga/ 14 years ago
Thanks Calabonga………

Alex van Beek/ 14 years ago
I Get the following error when i run my WCF service

Could not load type ‘MyValidator’ from assembly ‘BasicSSLWcf’.

Sid/ 14 years ago
Maybe you forgot to mark the MyValidator class as public? Also, try to put the MyValidator class in it’s own library project and see if that works…..

Alex van Beek/ 14 years ago
Great article!
I need to open an ASPX page from my Silverlight app in a new browser window. In the code behind page I have to check the username / password. Do you have any suggestions how to to share the username / password?

Michel Metselaar/ 14 years ago
Thank you!

This is real nice posts

Silverlight Hosting/ 14 years ago

Comments are closed.