how to secure wcf services

Question

I am looking for some architecture advice on the following.

I have a set of WCF services that provide an interface to a SQL Server database. These services are not publically exposed and can only be accessed via a VPN. Up to this point the services were used only by an MVC application which was co located on the same server that the WCF services run on.

Now, certain operations of the WCF services need to be exposes to another system that will interact with the services. The system is within the VPN so the WCF services will not be exposed.

However I would like to add a security layer to the WCF services to authenticate the calling application, check that the calling application has permission to interact with the particular operation etc.

What is the recommended approach to achieving this with WCF services?

Answer 1

First you need to setup authentication. Mutual Certificate should work well for your case. Then if you want permissions to be in operation granularity you should use a service authorization manager.