patterns & practices Improving Web Services Security Guide

WCF Security Resources

- J.D. Meier, Carlos Farre, Jason Taylor, Prashant Bansode, Steve Gregersen, Madhu Sundararajan, Rob Boucher

Getting Started

Microsoft

• MSDN Library - Fundamental Windows Communication Foundation Concepts - http://msdn2.microsoft.com/en-us/library/ms731079.aspx
• MSDN Library – Windows Communication Foundation Security - http://msdn.microsoft.com/en-us/library/ms732362.aspx
• WCF Security Documentation - http://msdn.microsoft.com/en-us/library/ms735093.aspx

Community

• DevX.com - Fundamentals of WCF Security, by Michèle Leroux Bustamante - http://www.devx.com/codemag/Article/33342
• Server Side - WCF Security Learning Guide ,by Brent Sheets - http://www.theserverside.net/tt/articles/showarticle.tss?id=WCFSecurityLearningGuide

Articles

Microsoft

• MSDN Library - The .NET Developer's Guide to Identity, by Keith Brown - http://msdn2.microsoft.com/en-us/library/aa480245.aspx
• MSDN Magazine - Identity - Secure Your ASP.NET Apps And WCF Services With Windows CardSpace by Michèle Leroux Bustamante - http://msdn2.microsoft.com/en-us/magazine/cc163434.aspx
• MSDN Magazine - IIS 7.0 - Extend Your WCF Services Beyond HTTP With WAS by Dominick Baier, Christian Weyer, and Steve Maine - http://msdn2.microsoft.com/en-us/magazine/cc163357.aspx
• MSDN Magazine - Security Briefs - Exploring Claims-Based Identity - Keith Brown - http://msdn2.microsoft.com/en-us/magazine/cc163366.aspx
• MSDN Magazine - Security Briefs - Limited User Problems and Split Knowledge, By Keith Brown - http://msdn2.microsoft.com/en-us/magazine/cc163531.aspx
• MSDN Magazine - Security Briefs - Security in Windows Communication Foundation, by Keith Brown - http://msdn2.microsoft.com/en-us/magazine/cc163570.aspx
• MSDN Magazine - Service Station - WCF Messaging Fundamentals by Aaron Skonnard - http://msdn2.microsoft.com/en-us/magazine/cc163447.aspx

Community

• DevX.com - Fundamentals of WCF Security, by Michèle Leroux Bustamante - http://www.devx.com/codemag/Article/33342
• TheServerSide.NET - Building a Claims-Based Security Model in WCF, by Michele Leroux Bustamente - http://www.theserverside.net/tt/articles/showarticle.tss?id=ClaimsBasedSecurityModel
• TheServerSide.NET - Building a Claims-Based Security Model in WCF - Part 2, by Michele Leroux Bustamente - http://www.theserverside.net/news/thread.tss?thread_id=45499
• TheServerSide.NET - Securing Your WCF Service, by William Tay - http://www.theserverside.net/tt/articles/showarticle.tss?id=SecuringWCFService
• TopXML - BizTalk and WCF: Part II, Security Patterns, by Richard Seroter - http://www.topxml.com/code/cod-72_10192_biztalk-and-wcf-part-ii-security-patterns.aspx

Blogs

Microsoft

• J.D. Meier - http://blogs.msdn.com/jmeier/archive/tags/WCF/default.aspx
• Kim Cameron - http://www.identityblog.com/
• Kenny Wolf - http://kennyw.com/category/indigo/
• Nicholas Allen - http://blogs.msdn.com/drnick/
• Ralph Squillace - http://blogs.msdn.com/ralph.squillace
• Steve Maine - http://hyperthink.net/blog/
• Tomasz Janczuk - http://www.pluralsight.com/blogs/tjanczuk/
• Vittorio Bertocci - http://blogs.msdn.com/vbertocci/
• Wenlong Dong - http://blogs.msdn.com/wenlong

Community

• Dominick Baier - http://www.leastprivilege.com/
• Keith Brown - http://www.pluralsight.com/blogs/keith
• Michèle Leroux Bustamante - http://www.thatindigogirl.com/
• Thomas Restrepo - http://www.winterdom.com/weblog

Channel9

Podcasts

• ARCast - Secure, Reliable Transacted Messaging with WCF (Part 1) - http://channel9.msdn.com/Showpost.aspx?postid=173405
• ARCast - Secure, Reliable Transacted Messaging with WCF (Part 2) - http://channel9.msdn.com/Showpost.aspx?postid=173830

ARCast.TV

• ARCast.TV - WCF Session Behavior from Slovenia - http://channel9.msdn.com/Showpost.aspx?postid=347826

Videos

• Vittorio Bertocci: WS-Trust - Under the Hood - http://channel9.msdn.com/tags/WS-Trust

Tags

• wcf tag - http://channel9.msdn.com/tags/WCF

Documentation

Overview

• Architecture - http://msdn2.microsoft.com/en-us/library/ms733128.aspx
• Concepts - http://msdn2.microsoft.com/en-us/library/ms731069.aspx
• Distributed Application Security - http://msdn2.microsoft.com/en-us/library/ms731204.aspx
• Overview - http://msdn2.microsoft.com/en-us/library/ms735093.aspx
• Security Architecture - http://msdn2.microsoft.com/en-us/library/ms788756.aspx
• Terminology - http://msdn2.microsoft.com/en-us/library/ms731846.aspx

Guidance

• Best Practices - http://msdn2.microsoft.com/en-us/library/ms731983.aspx
• Best Practices for Queued Communication - http://msdn2.microsoft.com/en-us/library/ms731093.aspx
• Best Practices for Reliable Sessions - http://msdn2.microsoft.com/en-us/library/ms733795.aspx

Scenarios

• Common Scenarios - http://msdn2.microsoft.com/en-us/library/ms730301.aspx
• Identity Model Scenarios - http://msdn2.microsoft.com/en-us/library/ms729851.aspx

Threats and Countermeasures

• Threats and Countermeasures - http://msdn2.microsoft.com/en-us/library/ms731086.aspx

Topics

• Auditing - http://msdn2.microsoft.com/en-us/library/ms731669.aspx
• Authentication - http://msdn2.microsoft.com/en-us/library/ms733082.aspx
• Authorization - http://msdn2.microsoft.com/en-us/library/ms733071.aspx
• Authorization Mechanisms - http://msdn2.microsoft.com/en-us/library/ms733106.aspx
• Bindings and Security - http://msdn2.microsoft.com/en-us/library/ms731172.aspx
• Claims-Based Authorization - http://msdn2.microsoft.com/en-us/library/ms729851.aspx
• Configuration Schema - Configuration Schema - http://msdn2.microsoft.com/en-us/library/ms731734.aspx
• Federation and Issued Tokens - http://msdn2.microsoft.com/en-us/library/ms730908.aspx
• Hosting - http://msdn2.microsoft.com/en-us/library/ms729846.aspx
• Impersonation and Delegation - http://msdn2.microsoft.com/en-us/library/ms730088.aspx
• Impersonation with Transport Security - http://msdn2.microsoft.com/en-us/library/ms788971.aspx
• Message Security in WCF - http://msdn2.microsoft.com/en-us/library/ms733137.aspx
• Partial Trust - http://msdn2.microsoft.com/en-us/library/bb412175.aspx
• Reliable Sessions Overview - http://msdn2.microsoft.com/en-us/library/ms733136.aspx
• SAML Tokens and Claims - http://msdn2.microsoft.com/en-us/library/ms733083.aspx
• Security Capabilities with Custom Bindings - http://msdn2.microsoft.com/en-us/library/ms733121.aspx
• Secure Conversations and Secure Sessions - http://msdn2.microsoft.com/en-us/library/ms731107.aspx
• Securing Services and Clients - http://msdn2.microsoft.com/en-us/library/ms734736.aspx
• SSL - http://msdn2.microsoft.com/en-us/library/ms734679.aspx
• Transport Security Overview - http://msdn2.microsoft.com/en-us/library/ms729700.aspx
• X.509 Certificates - http://msdn2.microsoft.com/en-us/library/ms731899.aspx

How Tos

• How to: Audit Windows Communication Foundation Security Events - http://msdn2.microsoft.com/en-us/library/ms734737.aspx
• How to: Configure Credentials on a Federation Service - http://msdn2.microsoft.com/en-us/library/ms730131.aspx
• How to: Configure a Local Issuer - http://msdn2.microsoft.com/en-us/library/aa347715.aspx
• How to: Configure a Port with an SSL Certificate - http://msdn2.microsoft.com/en-us/library/ms733791.aspx
• How to: Consistently Reference X.509 Certificates - http://msdn2.microsoft.com/en-us/library/aa702627.aspx
• How to: Create a Custom Binding Using the SecurityBindingElement - http://msdn2.microsoft.com/en-us/library/ms730305.aspx
• How to: Create a Federated Client - http://msdn2.microsoft.com/en-us/library/ms731690.aspx
• How to: Create a Secure Session - http://msdn2.microsoft.com/en-us/library/ms733783.aspx
• How to: Create a Security Token Service - http://msdn2.microsoft.com/en-us/library/ms733095.aspx
• How to: Create a Stateful Security Context Token for a Secure Session - http://msdn2.microsoft.com/en-us/library/ms731814.aspx
• How to: Create a Supporting Credential - http://msdn2.microsoft.com/en-us/library/ms734664.aspx
• How to: Create Temporary Certificates for Use During Development - http://msdn2.microsoft.com/en-us/library/ms733813.aspx
• How to: Create a WSFederationHttpBinding - http://msdn2.microsoft.com/en-us/library/aa347982.aspx
• How to: Create a Custom Reliable Session Binding with HTTPS - http://msdn2.microsoft.com/en-us/library/ms735116.aspx
• How to: Disable Encryption of Digital Signatures - http://msdn2.microsoft.com/en-us/library/aa738768.aspx
• How to: Disable Secure Sessions on a WSFederationHttpBinding - http://msdn2.microsoft.com/en-us/library/ms731827.aspx
• How to: Enable Message Replay Detection - http://msdn2.microsoft.com/en-us/library/ms733063.aspx
• How to: Exchange Messages Within a Reliable Session - http://msdn2.microsoft.com/en-us/library/ms733049.aspx
• How to: Impersonate a Client on a Service - http://msdn2.microsoft.com/en-us/library/ms731090.aspx
• How to: Make X.509 Certificates Accessible to WCF - http://msdn2.microsoft.com/en-us/library/aa702621.aspx
• How to: Obtain a Certificate (WCF) - http://msdn2.microsoft.com/en-us/library/aa702761.aspx
• How to: Restrict Access with the PrincipalPermissionAttribute Class - http://msdn2.microsoft.com/en-us/library/ms731200.aspx
• How to: Retrieve the Thumbprint of a Certificate - http://msdn2.microsoft.com/en-us/library/ms734695.aspx
• How to: Secure Messages within Reliable Sessions - http://msdn2.microsoft.com/en-us/library/aa702650.aspx
• How to: Secure a Service with Windows Credentials - http://msdn2.microsoft.com/en-us/library/ms734673.aspx
• How to: Secure a Service with an X.509 Certificate - http://msdn2.microsoft.com/en-us/library/ms788968.aspx
• How to: Set Up a Signature Confirmation - http://msdn2.microsoft.com/en-us/library/ms730328.aspx
• How to: Set a Max Clock Skew - http://msdn2.microsoft.com/en-us/library/aa738468.aspx
• How to: Specify the Certificate Authority Certificate Chain Used to Verify Signatures (WCF) - http://msdn2.microsoft.com/en-us/library/aa738659.aspx
• How to: Use the ASP.NET Authorization Manager Role Provider with a Service - http://msdn2.microsoft.com/en-us/library/ms734774.aspx
• How to: Use the ASP.NET Membership Provider - http://msdn2.microsoft.com/en-us/library/ms731049.aspx
• How to: Use the ASP.NET Role Provider with a Service - http://msdn2.microsoft.com/en-us/library/aa702542.aspx
• How to: Use a Custom User Name and Password Validator - http://msdn2.microsoft.com/en-us/library/aa702565.aspx
• How to: Use Multiple Security Tokens of the Same Type - http://msdn2.microsoft.com/en-us/library/bb885138.aspx
• How to: Use Transport Security and Message Credentials - http://msdn2.microsoft.com/en-us/library/ms789011.aspx
• How to: View Certificates with the MMC Snap-in - http://msdn2.microsoft.com/en-us/library/ms788967.aspx

Guides

Community

• dasblonde.net - WCF Security Fundamentals, by Michèle Leroux Bustamante - http://www.dasblonde.net/downloads/sessions/WCFSecurityFundamentals.pdf
• Server Side - WCF Security Learning Guide ,by Brent Sheets - http://www.theserverside.net/tt/articles/showarticle.tss?id=WCFSecurityLearningGuide

Posts

Microsoft

• Alexander Strauss - WCF - Let's Start The Dialogue - http://blogs.msdn.com/astrauss/archive/2006/10/27/wcf-let-s-start-the-dialogue.aspx
• Alik Levine - How To Consume WCF Using AJAX Without ASP.NET - - http://blogs.msdn.com/alikl/archive/2008/02/18/how-to-consume-wcf-using-ajax-without-asp-net.aspx

Community

• Dominick Baier - Using IdentityModel: Authorization Policies, Context and Claims Transformation - http://www.leastprivilege.com/UsingIdentityModelAuthorizationPoliciesContextAndClaimsTransformation.aspx
• Dominick Baier - Using IdentityModel: Creating Custom Claim Sets - http://www.leastprivilege.com/UsingIdentityModelCreatingCustomClaimSets.aspx
• Dominick Baier - Using IdentityModel: Typical Operations on Claim Sets - http://www.leastprivilege.com/UsingIdentityModelTypicalOperationsOnClaimSets.aspx
• Dominick Baier - Using IdentityModel: Windows and X509Certificate Claim Sets - http://www.leastprivilege.com/UsingIdentityModelWindowsAndX509CertificateClaimSets.aspx
• Dominick Baier - Using IdentityModel: Inspecting Claim Sets - http://www.leastprivilege.com/UsingIdentityModelInspectingClaimSets.aspx
• Dominick Baier - Using IdentityModel: Claim Sets - http://www.leastprivilege.com/UsingIdentityModelClaimSets.aspx
• Dominick Baier - Using IdentityModel: Claims - http://www.leastprivilege.com/UsingIdentityModelClaims.aspx
• Dominick Baier - Be careful with ServiceAuthorizationManager.CheckAccess() - http://www.leastprivilege.com/BeCarefulWithServiceAuthorizationManagerCheckAccess.aspx
• Dominick Baier - UserName SupportingToken in WCF - http://www.leastprivilege.com/UserNameSupportingTokenInWCF.aspx
• Paolo Pialorsi - WCF Custom Authentication and Impersonation - http://weblogs.asp.net/paolopia/archive/2005/12/08/432658.aspx
• Tomas Restrepo - WCF Configuration Complexity - http://www.winterdom.com/weblog/CommentView,guid,d8954fbc-3c04-441c-8d81-9e98e70a8580.aspx

patterns & practices

• WCF Security Guidance Package - http://www.codeplex.com/servicefactory/Release/ProjectReleases.aspx?ReleaseId=8814

Product Support Services (PSS)

• WCF Troubleshooting Quickstart - http://msdn2.microsoft.com/en-us/library/aa702636.aspx

Samples

Microsoft

• Basic Windows Communication Foundation Technology Samples - http://msdn2.microsoft.com/en-us/library/ms752239.aspx
• Windows Communication Foundation Samples - http://msdn2.microsoft.com/en-us/library/ms751514.aspx

Community

• WCF Security Full Demo - http://weblogs.asp.net/paolopia/archive/2007/12/16/wcf-security-full-demo.aspx

Videos

• MSDN TV - Windows Communication Foundation Bindings and Channels by Clemens Vastor - http://msdn.microsoft.com/seminar/shared/asp/view.asp?url=/msdntv/episodes/en/20060615wcfcv/manifest.xml&rate=2&WMPVer=10.0.0.3709
• MSDN Webcast: Windows Communication Foundation Top to Bottom (Part 10 of 15): Security Fundamentals (Level 200) - http://msevents.microsoft.com/CUI/WebCastEventDetails.aspx?culture=en-US&EventID=1032344349&CountryCode=US

Web Casts

MSDN Support WebCasts

• MSDN Support WebCast: Building distributed services on the Windows Communication Foundation - http://support.microsoft.com/kb/907388/en-us