WCF in IIS, http basic authentication - Windows User "security" implications

Question

I created a WCF Service, using http Basic Authentication and SSL. (Temporary certificate in IIS atm)

Here is the relevant configuration.

<services>
  <service name="MyNamespace.MyService">
    <endpoint address="" binding="basicHttpBinding" bindingConfiguration="basicHttps"
      name="MyEndPoint" contract="MyNamespace.IMyService" />
  </service>
</services>
<behaviors>
  <serviceBehaviors>
    <behavior name="">
      <!-- These will be false when deployed -->
      <serviceMetadata httpsGetEnabled="true" />
      <serviceDebug includeExceptionDetailInFaults="true" />
    </behavior>
    <!-- This doesn't do anything in IIS -->
    <behavior name="CustomUsernameValidatorBehavior">
      <serviceCredentials>
        <userNameAuthentication userNamePasswordValidationMode="Custom"
          customUserNamePasswordValidatorType="MyNamespace.CustomUserNameValidator" />
      </serviceCredentials>
    </behavior>
  </serviceBehaviors>
</behaviors>
<bindings>
  <basicHttpBinding>
    <binding name="basicHttps">
      <security mode="Transport">
        <transport clientCredentialType="Basic" />
      </security>
    </binding>
  </basicHttpBinding>
</bindings>

Due to the fact I am hosting in IIS, I can't use my customUsernameValidator, and IIS Basic authentication tries the username and password against Windows.

I created a new user, disabled logon locally, and put it in a new group (without rights). The only purpose of the user is to ensure they are allowed to access the service, nothing else. The service will be online, not internal e.g. in an Intranet etc.

My question boils down to this, is there security risks/implications due to the fact I am using a real windows user? What can be done to secure this service/IIS if so?

Should something be done to prevent 'phishing' of information, could they for example try different usernames and passwords to find credentials?

Btw this is a working binding (minus some other endpoints etc.) for WCF using Http Basic Authentication in IIS and SSL. It requires IIS has Basic Authentication installed, as well as a Windows User to authenticate against. I would prefer not to authenticate against a Windows user.

Answer 1

IIS 5.0 and below version has IP address disclosure vulnerability if Basic Authentication (with no realm defined) is used. Please have a look at this site: http://www.juniper.net/security/auto/vulnerabilities/vuln1499.html