Alternate ways WCF Authentication with netTcpBinding binding - wcf

Question

I'm writing a WCF server for an intranet application. I'm a newbie on WCF And have some queries on the Authentication. For this server the binding will netTcp, Its suggested to use netTcpBinding with Windows Authentication. But for my requirement I need a custom login where user will be validated with his own credentials not windows credentials.
I'm Planning to have a service contract implemented this way and validate the Login credentials
*[ServiceContract(SessionMode = SessionMode.Required)]
public interface Iservice
{
[OperationContract]
String Login(String username, String password);
}
[ServiceBehavior(InstanceContextMode=InstanceContextMode.PerSession) ]
public class serviceclass : Iservice
{
String Login(String username, String password);
{
//Validate uname and password with DB.
if (validate)
return OperationContext.Current.SessionId;
else return String.Empty;
}
}*
Is this a good approach or is there a better approach to acheive this.
Please guide.

Answer 1

I would suggest to you to use the UserNamePasswordValidator for custom validation, it fits to your requirement.
You just need to inherit and implement validate from UserNamePasswordValidator class like this:
public class CustomUserNameValidator : UserNamePasswordValidator
{
public override void Validate(string userName, string password)
{
if (null == userName || null == password)
{
throw new ArgumentNullException();
}
if (!(userName == "test1" && password == "1tset") && !(userName == "test2" && password == "2tset"))
{
// This throws an informative fault to the client.
throw new FaultException("Unknown Username or Incorrect Password");
// When you do not want to throw an infomative fault to the client,
// throw the following exception.
// throw new SecurityTokenException("Unknown Username or Incorrect Password");
}
}
}
You can replace static username and password and validate it in your data storage.
Service configuration :
<serviceBehaviors>
<behavior name="CustomValidator">
<serviceCredentials>
<userNameAuthentication
userNamePasswordValidationMode="Custom"
customUserNamePasswordValidatorType=
"MyAssembly.CustomUserNameValidator, MyAssembly"/>
</serviceCredentials>
</behavior>
<serviceBehaviors>
<netTcpBinding>
<binding name="tcpWithMessageSecurity">
<security mode="Message" >
<message clientCredentialType="UserName"/>
</security>
</binding>
</netTcpBinding>
For client side you can use Credentials to populate username and password.
proxy.ClientCredentials.UserName.UserName = "user";
proxy.ClientCredentials.UserName.Passsord = "password";