Best way to secure a WCF service on the internet w

问题:

I am looking to expose a service to a selection of clients over the internet. At this stage the api is very small, and I only want known clients to be able to access the service. I don't need to be able to identify the clients now, however I envisage that in future I will need to be able to identify clients, as the api grows.

I'm wondering what the best way to secure the service is in the short term, with a view to the longer term where I may want to be able to authorise client access to specific methods on the service?

I was thinking of using Transport security - i.e. SSL. Should I also look at using Message security with

clientCredentialType="certificate"

in which clase each client will have their own certificate that will authenticate them with the service?

Or should I simply provide each client an API key which will provide a similar level of client differentiation?

Any other suggestions welcome.

Note that this is a service to service interface - i.e. not a client application. The number of users of the service will be limited, and I don't foresee needing to apply security at the data level, moreso at the method access level.

回答1:

You could use custom user name/password authentication to authenticate users or AD Authentication to control who can use the service.

Best solution to my mind as for now as you do not want to identify the users is to use the custom user name/password authentication and allow every one for now. In future when you want to identify users, change the code and put validation in.

Refer to https://msdn.microsoft.com/en-us/library/aa702565(v=vs.110).aspx. In the validate function, don't throw any exception for now

回答2:

Give them each a key, and they have to submit a SHA signature with their request (an encoded version of some/all of the parameters they're passing in, so you can also do the SHA and check it matches).

回答3:

The simplest approach for now would be to add SSL to your IIS host and then change the clients to connect on HTTPS, like this...

      <security mode="Transport">
        <transport clientCredentialType="None" />
      </security>