How to: Enable the WCF Authentication Service

This topic shows how to configure the ASP.NET authentication service on a Web server to make it available to clients as a Windows Communication Foundation (WCF) service. The topic also shows how to configure ASP.NET forms authentication.

For more information about how to configure ASP.NET membership, see Configuring an ASP.NET Application to Use Membership.

To enable the authentication service

1. If you do not already have an ASP.NET Web application, create one.

2. Add a service file (.svc) to the Web site that contains the following directive to reference the AuthenticationService class, as shown in the following example:

   <%@ ServiceHost 
     Language="VB"
     Service="System.Web.ApplicationServices.AuthenticationService" 
     Factory="System.Web.ApplicationServices.ApplicationServicesHostFactory" %>
   

   <%@ ServiceHost 
     Language="C#"
     Service="System.Web.ApplicationServices.AuthenticationService" 
     Factory="System.Web.ApplicationServices.ApplicationServicesHostFactory" %>
   

3. Make the following configuration settings in the Web.config file to configure the service and to require SSL:

   • Enable the authentication service in the authenticationService element.

   • Define the endpoint contract in the services element and the service behavior in the behaviors element. Include the bindingNamespace property in the endpoint contract as shown in the following example in order to prevent an exception in some proxy generation tools. For more information about WCF endpoints, see Windows Communication Foundation Endpoints.

   • Configure the serviceHostingEnvironment element for ASP.NET compatibility. For more information about hosting WCF services, see WCF Services and ASP.NET.

   • Create a binding in the bindings element that requires SSL. For more information about transport security in WCF, see Transport Security.

   The following example shows the system.serviceModel element from a Web.config file that shows the configuration settings described in the previous list.

   <system.web.extensions>
     <scripting>
       <webServices>
         <authenticationService enabled="true" 
            requireSSL = "true"/>
       </webServices>
     </scripting>
   </system.web.extensions>
   <system.serviceModel>
     <services>
       <service name="System.Web.ApplicationServices.AuthenticationService"
           behaviorConfiguration="AuthenticationServiceTypeBehaviors">
         <endpoint contract=
           "System.Web.ApplicationServices.AuthenticationService"
           binding="basicHttpBinding"
           bindingConfiguration="userHttps" 
           bindingNamespace="https://asp.net/ApplicationServices/v200"/>
         </service>
     </services>
     <bindings>
           <basicHttpBinding>
               <binding name="userHttps">
                   <security mode="Transport" />
               </binding>
           </basicHttpBinding>
     </bindings>
     <behaviors>
       <serviceBehaviors>
         <behavior name="AuthenticationServiceTypeBehaviors">
           <serviceMetadata httpGetEnabled="true"/>
         </behavior>
       </serviceBehaviors>
     </behaviors>
     <serviceHostingEnvironment 
       aspNetCompatibilityEnabled="true"/>
   </system.serviceModel>
   

To configure forms authentication

• In the Web.config file, configure the Web application to use forms authentication.

  The following example shows the authentication element in a Web.config file that is configured to use forms authentication.

  <authentication mode="Forms">
    <forms cookieless="UseCookies" />
  </authentication>
  

  The authentication service requires cookies. Therefore, in the authentication element, set the cookieless attribute to "UseCookies". For more information, see ASP.NET Forms Authentication Overview.

Security

If you are passing sensitive user data such as authentication credentials, always access the authentication service over the secure sockets layer (SSL, by using HTTPS protocol). For information about how to set up SSL, see Configuring Secure Sockets Layer (IIS 6.0 Operations Guide).

See Also

Tasks

Walkthrough: Using ASP.NET Application Services

Concepts

Windows Communication Foundation Authentication Service Overview

Other Resources

Configuring Services