Need to authenticate users through a WCF service that is connected to a database

I'm getting increasingly frustrated with doing the authentication right. Usually I'm using terms that I'm not familiar with so answerers misunderstand my questions. Its not helped bu the fact that this is a case with many implementations.

So now I'm going to try to explain the facts and requirements surrounding my project so that I might get a pointer towards a good solution.

I will have a Database that includes the information I need. Included in this info will be the usernames and salted hash of passwords. This database will be connected to a WCF web service that supplies the data to other front end projects.

One of the front end projects is a asp.net MVC 3 web site that users will use to log in and such. Now the default in such a project is some sort of SQlMembership that is not right in this case as this site is not connected to the database (it might not even be a MSQL database).

Here are implementations that I looked at but couldn't quite figure how to use correctly.

1) Write my own MembershipProvider in the MVC project that would query the WebService for validation. Here I mean that it would just call some methods for all its needs. Not liking it for security issues, client side solution.

2) Validata using a service side MembershipProvider but then I would have to send userName Password with each action and I can't store password for security reasons.

3) Then I discovered something called WCF authenticationService http://msdn.microsoft.com/en-us/library/system.web.applicationservices.authenticationservice.aspx and it seemed to be what I need but I'm having problem understanding how it works. I wan't it to be part of my service but it seems to be a dedicated service. Also its not really explaining how it authenticates (I need to have a custom authentication based on my table, not some default table created for me). Here is a post Should authentication be in a separate service for wcf? with same problem that I'm not sure how got solved.

Can the WCF authentication service be the right tool for me?

Can you answer this for someone who doesn't know asp.net, web or service terminology?

EDIT

Here is one solution that I was hoping for but not sure if exists.

The WCF Service exposes a MembershipProvider, RoleProvider, ProfileProvider that are defined in the service.

In the MVC web.config under membership\providers\add the MembershipProvider is added along with a endpoint towards the service. Same with RoleManager etc.

So when I call MembershipProvider in the MVC project to validate user it auto开发者_Go百科matically calls the service and checks there and when it happens upon a Authorize attribute it as well checks the RoleProvider in the service automatically.

I would however also want to restrict the service calls themselves, even if they are inside a [Authorized] attribute method it might not be so in other clients that reference the web service. Would love if when a call comes from a website the service would automatically have access to the forms.authentication cookie.

I am not clear as to what you want to authenticate exactly, if the user login in, or the user accessing you service. Also, I am not sure how you mean for an answer about WCF Security not to use service terminology nor how you expect to solve this without knowing asp.net. I'll do my best though.

• If you are authenticating a user login in, you can implement your own MembershipProvider and have a service request credentials and return the authenticated user.
• Once authenticated, you can assign each user a GUID. This GUID is the ID which will travel with each message (encoded in the message header) and validate the user to call the service method.
• This doesn't involve transport security, which you should configure if you want your message to be secure over the wire, yet this is a different matter, not involving authentication.

Hope this can somehow help you. I tried to make it the least technical possible and left out anything too complicated. Hope this helps somehow...