0

I am working on a WCF Service that returns the Status for a Device.

A Device has multiple Status for different Companies. I need to develop a WCF Service that allows a Company to retrieve the Status for their Company (and only theirs).

What is the best way, to differentiate between this companies in WCF.

As far as i can see, i have 3 options here:

  1. use the calling username
  2. An Identifier needs to be passed to the Web service
  3. Different Web service for all Companies

What would be the preferred way to go, or are there any other options?

//edit: I found another option: Identify the caller by certificate.

|improve this question
  • Is security an issue? Should company A be allowed to read company B's device state? Should the general public be allowed to? – nvoigt Oct 3 '16 at 11:39
  • A company should be allowed to only request it's own status and should be hindered to request any other companies status. The general public should not be allwoed to access any status at all – TheJoeIaut Oct 3 '16 at 11:46
  • Then you need security either way. Being as simple as https/user/password or more complicated. Your service will know who called it. That kinda solves your problem already. Further details will depend on your needs for security. – nvoigt Oct 3 '16 at 11:47
1

You may want to look into token based authentication.

The process would be something like this.

  1. User sends credentials to an authentication endpoint. If successful, a token is returned.

  2. When user wishes to check the status of the device, they pass the token in the header.

  3. The receiving service verifies that the token is valid.

  4. Using the token it retrieves information about the customer, retrieves the relevant data and returns it to the client.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.