Best way to use and secure WCF on the Compact Framework?

Question

I am working on an app that has several clients - Desktop, Mobile Device, Web Portal. We're moving to an SOA kind of architecture and will be using WCF.

The WCF story is great when it comes to using netTcp+transport/message security+Windows authentication (or even UsernameToken and a custom UsernameValidator provider) on the Desktop and Web Portal side.

Where it totally breaks down is on the compact framework side...the subset of WCF it supports is so limiting. I was resigned to simply using basicHttp + Username/Password in the headers all over SSL, but it seems that you cannot add headers when on the compact framework stack (no OperationContextScope) - so that leaves me with including username/password as parameters for EVERY SINGLE operation method in the service.

Please tell me I am wrong and there is a better way.

Answer 1

Your best bet is going to be to expose a WCF end-point that conforms to the WS-Security standards.

You should then be able to use those standards for message based security (most likely using X.509). Here's the MSDN link to get started:

Messaging in the .NET Compact Framework