Re: Send custom IPrincipal object from client to WCF service - Pos

not quite - because you do authentication first.

There could be a properly authenticated user A - which sends IPrincipal data for User B.

You see the issue?

-----
Dominick Baier (http://www.leastprivilege.com)

Developing More Secure Microsoft ASP.NET 2.0 Applications (http://www.microsoft.com/mspress/books/9989.asp)

Thanks guys for your response.

Yes, you cannot trust the client, however to recreate them on the
server side is the same security risk - you are getting a user/pass
from the client...

"James Crosswell" wrote:

Dominick Baier wrote:

Keep in mind that you shouldn't base any security decisions on
information originating from the client - the client is basically
untrusted.

That's precisely the purpose of authentication though - to verify the
client is who it says it is. Regardless of the strength of weakness
of the authentication mechanism you're using, you HAVE to make access
control decisions based on whoever you determine the client to be
during the authentication process.

Best Regards,

James Crosswell
Microforge.net LLC
http://www.microforge.net


.

Relevant Pages

  • Re: Windows Authentication, Single sign on and Active Directory
    ... service proxy client fails to connect due to authentication failure and then ... Co-author of "The .NET Developer's Guide to Directory Services Programming" ... The server is always in the domain. ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: BASIC authentication Issues with IE - Part II - Solved but WHY?
    ... it does not know the difference between a request from IE or from ... some other HTTP client. ... Some other authentication schemes are more ... IIS can sometimes remember the token for a particular set of credentials so ...
    (microsoft.public.inetserver.iis.security)
  • Re: Sporadic IAS Authentication problems
    ... * Some times however, a physical reboot of the client laptop is required, ... *The remote access policy in IAS is set to grant access to the group 'Domain ... Proxy-Policy-Name = Use Windows authentication for all users ...
    (microsoft.public.internet.radius)
  • Re: ISAPI Authentication
    ... The job of your authentication filter is to accept ... non-Windows credentials from the client and then map them to a Windows ...
    (microsoft.public.inetserver.iis.security)
  • Re: WCF security advice (and clarification) needed
    ... You, the client, resolve the foo.mycompany.com hostname within your ... TCP/IP) with that ticket as the security token. ... There are two parties participating in a security scenario, the server ... HTTP supports other authentication ...
    (microsoft.public.dotnet.framework.webservices)