WCF Security

Hello,

I want to do some 'custom' security checking on the level of a WCF services
(.SVC file). Therefore I have the next entries defined in my WEB.CONFIG

<behaviors>
<serviceBehaviors>
<behavior name="CobBusinessServiceBehavior">
<serviceMetadata httpGetEnabled="true"
httpsGetEnabled="false" />
<serviceDebug includeExceptionDetailInFaults="true" />
<serviceAuthorization principalPermissionMode="Custom">
<authorizationPolicies>
<add
policyType="Cob.Framework.Utilities.Services.MessageAuthorizationPolicy,
Cob.Framework.Utilities" />
</authorizationPolicies>
</serviceAuthorization>
</behavior>
</serviceBehaviors>
</behaviors>

<services>
<service behaviorConfiguration="CobBusinessServiceBehavior"
name="Cob.Tools.Security.ServiceModel.Services.Security">
<endpoint
behaviorConfiguration="CobBusinessEndPointBehavior" binding="netHttpBinding"
bindingConfiguration="netHttpBindingConfiguration"
name="ISecurityServiceContract"
contract="Cob.Tools.Security.ServiceModel.Contracts.ServiceContracts.ISecurityServiceContract"
/>
</service>
</services>

Currently my class MessageAuthorizationPolicy is empty (except some temp
code). It seems that I do not get into the constructor of this class. Anyone
an idea?

Regards
Kurt

Stupid question but,,are you sure you've defined a public constructor
for the policy? do u have a breakpoint on it?

Hello,

I didn't have a public contructor. Now I added on and indeed the code in the
constructor is executed when calling te service.

Now I have implemented the IAuthorizationPolicy which has an 'Evaluate'
method defined. When is this method called?

Kurt

"Priya" <priya.marwaha@xxxxxx> wrote in message
news:1189174999.140729.6930@xxxxxx

This method will be called right before every call you make to the
actual web service operation. If the policy has enough data to
evaluate authorization it should return True from this method, else it
should return false. This is typically the place you set a custom
thread principal if you need to, where you evaluate claims or roles
etc.
On Sep 10, 8:02 pm, "Kurt Biesemans" <Kurt.Biesem...@xxxxxx>
wrote:

Priya,

I have it working now. Indeed the intention is to have some 'custom'
security checking in the evaluate method. In our case people cannot make a
service call (access the .SVC file) if they don't have a role in the
application.

Kurt

"Priya" <priya.marwaha@xxxxxx> wrote in message
news:1189568497.341211.11400@xxxxxx