WCF Service, Same Contract, But Some Data member are specific to client - wcf

Question

This is the scenario, Say I have a OperationContract GetEmployeeDetails, it returns Employee class.
class Employee
{
public int EmpId { get; set; }
public string EmpName { get; set; }
public string Salary{ get; set; }
}
Now I have two clients say HR and Manager.
When Manager client create the proxy, salary property should not be exposed.
When HR client create the proxy, salary property should be exposed.
I am using WCF Services, cant implement REST, dont have any control on the client side.
Cant use Interface to achieve this as the actual entity is very Complex, with multiple inner classes.
Please let me know, Is there any way I could implement this.

Answer 1

Don't do it this way. Do a proper authentication/authorization mechanics (data should be returned on the basis of user rights).
Reason: even if this was possible, your system would be a cake for any malicious attacker with as little as Visual Studio in hands. Giving out confidential data (and salary certainly is such data) based on client type is asking for trouble.
Never do access restriction in such way.

Answer 2

You could consider having a DataContract that exposes Salary as an optional property,
e.g.:
[DataContract]
public class Employee
{
[DataMember(IsRequired = true, Order = 0)]
public int EmpId { get; set; }
[DataMember(IsRequired = true, Order = 1)]
public string EmpName { get; set; }
[DataMember(IsRequired = false, Order = 2)]
public decimal? Salary{ get; set; }
}
Then only return a non-null value for the optional property if the client is authorized (e.g. must be in the "HR" role in your case).
Obviously this requires that you authenticate your clients, and have an authorization mechanism in place (e.g. an ASP.NET RoleProvider).
If your optional property is a value type, it should be a Nullable value so that you can return its value as null - e.g. in the above example, I've made Salary a decimal?.
With this approach, all clients see the data contract, so know of the existence of the optional property (which could in some situations be considered as a security weakness), but only authorized clients will see a value for the optional property.