WCF - Which Binding

I have a web service hosted in IIS 7 that is to be called from a WCF client that runs in a different domain.

Currently, the wsHTTP binding has been configured using default settings. When the call is made the service complains that the client couldn't be authenticated (Message : The request for security token could not be satisfied because authentication failed.). I guess this is because it's trying to use windows authentication and the clients ID cannot be validated against the AD server of the service.

What's the best way to get around this? Can the service be configured to run under the ID of a local account? How bes开发者_Python百科t to check the call has come from authorised client? I'd rather avoid certificate generation and management if possible. Ideally, I'd authenticate the client by username / password by then have the service operate under it's own local ID - to gain access to resources on the service server.

Any advise gratefully received.

Thanks

Rob.

You can use user name and password but your service should use certificate if you don't want to send user name and password in plain text. Your option is either:

• HTTPS with user name and password in message
• Message security with user name and password in message

Both requires certificate.

Here's a good tutorial that I used to do just that.

http://www.codeproject.com/KB/WCF/wcf_https_usernameauth.aspx?msg=3527563#xx3527563xx