Authentication with an SOA approach using C#

Question

I am doing a rebuild of a website and I'm trying to use an SOA approach. The current website is in .NET 2.0 and uses the out of the box SqlMembershipProvider.

We're trying to eliminate direct connections to the database and push everything through a WCF service layer. The approach we're using for this is to have everything separated - There's a library for models and interfaces, a library for the services, and then a library for the service proxies.

The biggest hurdle so far is figuring out how to manage user authentication and their session. What's the best way to do this with this approach.

Should we scrap the .NET membership model and go with something like OpenId, and just allow users to reconnect their data to the new account?

I've done some searching and can't find a lot on how to manage this, though I know it's been done before.

Answer 1

Here's what I ended up doing, in case anyone is interested. I started off using the WCF Authentication Services, but then realized it didn't give me everything I wanted. I could log on and off, but will still have to create my own methods for registration and getting the MembershipUser.

So I went in my ServiceContracts library and create an interface I called IMembership. At first, I created it as a class and inherited from MembershipProvider so that I could get all the method stubs generated for me. Once they were generated I modified the stubs and made it into an interface.

Then I went into my Services Library and created the implementation for the interface which was simple, because for the implementation I just used Membership.Provider....

Then in my Service Provider Clients library, I did the usual implementing of the IMembership interface, also inheriting from ClientBase<>. Right next to it I created a WCFMembershipProvider, which implemented MembershipProvider, and called the methods from the MembershipClient I just created.

In my WebApp that host the WCF Services I set up my SQL Membership provider in the web.config, and then created my svc file and endpoints for the service.

In the consuming web app, I just added the service client reference to the svc, and then set up the Membership Provider for my WCFMembershipProvider.

And viola - I'm in business.

A lot of repetitive code, but it works nice.