RESTful windows authentication

309 views Asked by At

I've set up a RESTful WCF web service on our server (IIS 8.5 running on Windows Server 2012 R2). I can connect remotely and run exposed methods no problem. I get a problem when the method contains a connection to a database. Despite having windows authentication set up in IIS, the username passed through to the database is defaulting to the machine default, which is wrong.

I'm currently using this web.config:

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <configSections>
    <!-- For more information on Entity Framework configuration, visit http://go.microsoft.com/fwlink/?LinkID=237468 -->
    <section name="entityFramework" type="System.Data.Entity.Internal.ConfigFile.EntityFrameworkSection, EntityFramework, Version=6.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" requirePermission="false" />
  </configSections>
  <appSettings>
    <add key="aspnet:UseTaskFriendlySynchronizationContext" value="true" />
  </appSettings>
  <system.web>
    <identity impersonate="true"/>
    <customErrors mode="Off"/>
    <compilation debug="true" targetFramework="4.5.2" />
    <httpRuntime targetFramework="4.5.2" />
  </system.web>
  <system.serviceModel>
    <services>
      <service name="AriaRestFul2.Service1" behaviorConfiguration="AriaRestFul2.Service1Behavior">
        <endpoint address="../Service1.svc" binding="webHttpBinding" contract="AriaRestFul2.IService1" behaviorConfiguration="webBehaviour" bindingConfiguration="restbinding">
          <identity>
            <dns value="localhost"/>
          </identity>
        </endpoint>
        <endpoint address="mex" binding="webHttpBinding" contract="IMetadataExchange" bindingConfiguration="restbinding"/>
      </service>
    </services>
    <behaviors>
      <serviceBehaviors>
        <behavior name="AriaRestFul2.Service1Behavior">
          <serviceMetadata httpGetEnabled="true"/>
          <serviceDebug includeExceptionDetailInFaults="false"/>
        </behavior>
      </serviceBehaviors>
      <endpointBehaviors>
        <behavior name="webBehaviour">
          <webHttp />
        </behavior>
      </endpointBehaviors>
    </behaviors>
    <bindings>
      <webHttpBinding>
        <binding name="restbinding">
          <security mode="TransportCredentialOnly">
            <transport clientCredentialType="Windows"/>
          </security>
        </binding>
      </webHttpBinding>
    </bindings>
  </system.serviceModel>
  <system.webServer>
    <httpErrors errorMode="Detailed" />
    <modules runAllManagedModulesForAllRequests="true" />
    <validation validateIntegratedModeConfiguration="false"/>
    <directoryBrowse enabled="true" />
  </system.webServer>
  <connectionStrings>
    <add name="AriaEntities" connectionString="metadata=res://*/Aria.csdl|res://*/Aria.ssdl|res://*/Aria.msl;provider=System.Data.SqlClient;provider connection string=&quot;data source=<instance>;initial catalog=Aria;integrated security=True;MultipleActiveResultSets=True;App=EntityFramework&quot;" providerName="System.Data.EntityClient" />
  </connectionStrings>
  <entityFramework>
    <defaultConnectionFactory type="System.Data.Entity.Infrastructure.LocalDbConnectionFactory, EntityFramework">
      <parameters>
        <parameter value="mssqllocaldb" />
      </parameters>
    </defaultConnectionFactory>
    <providers>
      <provider invariantName="System.Data.SqlClient" type="System.Data.Entity.SqlServer.SqlProviderServices, EntityFramework.SqlServer" />
    </providers>
  </entityFramework>
</configuration>

The database I'm connecting to is through EF6. I'm using chrome as the client to pass in the URL to the service. I'm worried that this setup might require the credentials to be assigned in code in a client. If this is the case, is there anyway I can configure the service to just pass through the current user from the browser?

0

There are 0 answers