Security is by far the most intricate area of WCF. For example, the following list shows the elements that govern security in every WCF operation call:
Service contract
Operation contract
Fault contract
Service behavior
Operation behavior
Host configuration
Method configuration and code
Client-side behavior
Proxy configuration
Binding configuration
Each of the items on the list may have a dozen or more security-related properties. Obviously, there is an overwhelming number of possible combinations and permutations. In addition, not all combinations are allowed or supported, and not all allowed combinations make sense or are consistent. For example, while technically possible, it does not make sense to use a certificate for client credentials in a homogenous Windows intranet, much like it makes little sense to use Windows accounts in an Internet application. The solution I chose for this book is to focus on a few key scenarios (and slight variations of them) that address the security needs of the majority of applications today.
The scenarios are:
Intranet application
Internet application
Business-to-business application
Anonymous application
No security
I will demonstrate how to make the scenarios consistent and secure. In each scenario I will discuss how to support the security aspects of transfer security, authentication, authorization, and identity management. If you need an additional scenario, you can follow my analysis approach to derive the required security aspects and settings.