What WCF Security is best to expose service in internet

Question

I'm new to WCF and have very limited knowledge in WCF security. I have written an WCF service which should be exposed in internet for my clients. I need to Authenticate the clients to use my services. Clients should invoke my service with user id and password. I will do SSL certification as well but apart form that I need some authentication mechanism. Please advice me what binding,security mode, clientCredentialType and related configurations I should do for the security.

Answer 1

You can make use of WSHttpBinding for your services. The binding supports HTTPS transport and WS-Security. Along with this, you can also set security configuration at transport and message level. You can either specify that at ServiceContract or at OperationContract levels.

Here are few MSDN links to get you started:

Bindings and Security
WCF Security Fundamentals
Authentication with Transport Security

Please note that these may be very basic in comparison to your requirements.

Answer 2

It depends on what technology your clients use. If they are all .NET then you have free choice. If you have Java or other clients accessing your services you may have less headaches with BasicHttpBinding, which is completely adequate if you only need username authentication and SSL. The link @danish provided (http://msdn.microsoft.com/en-us/library/ff649647.aspx) shows you how to do that.