N-Tier Application Authentication (RabbitMQ as Broker and C# as Business Tier) - WIF possible?

Question

I'm currently devoloping a N-Tier Application with C# as Business Tier. It's a kind of ERP and I need authentication (email/password) for this app. I need also permissions based on the login (create orders, delete articles) All this informations should be stored in one database.

As UI Clients I planned to make WPF Client, ASP.Net and maybe in future iPhone/Android. As message broker I use RabbitMQ (Clients talk to Business Layer only over AMQP. Due to the advanteges I have more than one Business Layer for round robin dispatching).

On my research for authentication in N-Tier applications I found one advise for Windows Identity Foundation. WIF is completly new for me. All the examples I found handle only ASP.Net Applications.

My question now is: Is WIF the right thing for me or should I implement this session handling on my own?

If WIF can fit my needs, what is the best way to handle this? Do I have to implement a custom STS and place it within a WCF Service?

Answer 1

As you are explicitly mentioning RabbitMq, I am suggesting ServiceStack for your service interface.

One issue with MQs in general is that they are decoupled from any meta information, such as HTTP Headers, to inject authentication. You should in contrast provide a property Session (with pre authentication) or UserName and Password in your message (where the later one is not prefered, as the credentials are passed in plain). A sample solution with the built-in SessionFeature of ServiceStack is available in their documentation.

Another nice feature of ServiceStack is that you can decorate your handlers not only with AuthenticateAttribute but also with RequiredRoleAttribute and RequiredPermissionAttribute.

Also: How do you plan to queue a message with Android? Can you expose the internal MQ to the outside, and is there a client available for eg Android? Therefore I suggest a dual endpoint over HTTP to queue messages in whatever MQ you choose to use. More information on how to integrate MQ in your HTTP service is available in the documentation.

With ServiceStack you can spin as many consumer instances you want, as there is a plain communication without all the serivce stuff available.

Trivia: As I am authoring an upcoming book on Mastering ServiceStack I am a little bit biased. Nevertheless I do cover most of your questions in the book, and provide code examples: Bits and pieces to your scenario are already covered here (do not get frightened by specific MQ, they are interchangeable).