WCF serviceAuthorizationManager not being invoked - wcf

Question

Trying to add API Key authorization to an existing WCF service hosted on IIS 7
Followed Ron Jacob's tutorial for creating a class derived from ServiceAuthorizationManager.
It is not being invoked.
In case my understanding is wrong, I am expecting that all I have to do is correctly make the class and refer to it in Web.Config.
At that point my test web client should cease to get data from the service until the client is altered to handle API Key process flow.
The client however still consumes the contracts correctly and the Eventlog messages that I have placed in the ServiceAuthorizationManager class are not being generated.
I thought it must be the behavior node that I created
in the web.config but I have created that both manually and using the Visual Studio config editor tool and both entries don't work.
I believe the web config serviceAuthorization node is correct in that it correctly refers to the Namespace.Class of the authorization class and I have double checked that the assembly in the bin directory of the Webservice is CouponParkingWCF.dll.
The Class code is:
namespace CouponParkingWCF
{
public class APIKeyAuthorization:ServiceAuthorizationManager
{
public const string APIKEY = "ApiKey";
public const string APIKEYLIST = "APIKeyList";
public string GetAPIKey(OperationContext operationContext)
{
// Get the request message
ClsLogger.WriteInfoLog("InsideGetAPIKey");
var request = operationContext.RequestContext.RequestMessage;
// Get the HTTP Request
var requestProp = (HttpRequestMessageProperty)request.Properties[HttpRequestMessageProperty.Name];
// Get the query string
NameValueCollection queryParams = HttpUtility.ParseQueryString(requestProp.QueryString);
// Return the API key (if present, null if not)
return queryParams[APIKEY];
}
public List<Guid> APIKeys
{
get
{
// Get from the cache
// Could also use AppFabric cache for scalability
var keys = HttpContext.Current.Cache[APIKEYLIST] as List<Guid>;
if (keys == null)
keys = PopulateAPIKeys();
return keys;
}
}
private List<Guid> PopulateAPIKeys()
{
Dt dt = new Dt();
List<Guid> keyList = dt.GetApiKeys();
return keyList;
}
public bool IsValidAPIKey(OperationContext operationContext)
{
// if verification is disabled, return true
//if (Global.APIKeyVerification == false)
// return true;
ClsLogger.WriteInfoLog("InsideIsValidAPIKey");
//return true;
string key = GetAPIKey(operationContext);
Guid apiKey;
// Convert the string into a Guid and validate it
if (Guid.TryParse(key, out apiKey) && APIKeys.Contains(apiKey))
{
return true;
}
// Send back an HTML reply
CreateErrorReply(operationContext, key);
return false;
}
private void CreateErrorReply(OperationContext operationContext, string key)
{
ClsLogger.WriteErrorLog("We have an Authorization Error. Oh Dear.");
}
protected override bool CheckAccessCore(OperationContext operationContext)
{
return IsValidAPIKey(operationContext);
}
}
}
The web config behaviors node is:
<behaviors>
<endpointBehaviors>
<behavior name="RestJSONEndpointBehavior">
<webHttp helpEnabled="false" defaultBodyStyle="Bare" defaultOutgoingResponseFormat="Json" />
</behavior>
<behavior name="RestXMLEndpointBehavior">
<webHttp helpEnabled="false" defaultOutgoingResponseFormat="Xml" />
</behavior>
</endpointBehaviors>
<serviceBehaviors>
<behavior name="">
<serviceAuthorization serviceAuthorizationManagerType="CouponParkingWCF.APIKeyAuthorization, CouponParkingWCF, Version=1.0.0.1, Culture=neutral, PublicKeyToken=null" />
</behavior>
<behavior name="wsdl">
<serviceMetadata httpGetEnabled="false" httpsGetEnabled="false" />
<serviceDebug includeExceptionDetailInFaults="true" />
</behavior>
</serviceBehaviors>
</behaviors>
hopefully someone can spot what I have done wrong.
Thanks
Bob

Answer 1

The problem is that I put the serviceAuthorization node inside its own behavior node.
It should go inside the existing"wsdl" node
<serviceBehaviors>
<behavior name="wsdl">
<serviceAuthorization serviceAuthorizationManagerType="CouponParkingWCF.APIKeyAuthorization, CouponParkingWCF, Version=1.0.0.1, Culture=neutral, PublicKeyToken=null" />
<serviceMetadata httpGetEnabled="true" httpsGetEnabled="true" />
<serviceDebug includeExceptionDetailInFaults="true" />
</behavior>
</serviceBehaviors>
This got the API KEY working but then we need to have it working for GET and POST.
Ron's example shows using the querystring which is fine for GET but not for POST.
So we moved to putting the API Key into the header. The WCF key extraction code is:
public string GetAPIKey(OperationContext operationContext)
{
try
{
var request = operationContext.RequestContext.RequestMessage;
var requestProp = (HttpRequestMessageProperty)request.Properties[HttpRequestMessageProperty.Name];
string key = requestProp.Headers["ApiKey"];
return key;
}
catch (Exception exception)
{
ClsLogger.WriteErrorLog("GetAPIKey " + exception.Message);
throw;
}
}