I am working on a WCF Service that returns the Status for a Device.

A Device has multiple Status for different Companies. I need to develop a WCF Service that allows a Company to retrieve the Status for their Company (and only theirs).

What is the best way, to differentiate between this companies in WCF.

As far as i can see, i have 3 options here:

  1. use the calling username
  2. An Identifier needs to be passed to the Web service
  3. Different Web service for all Companies

What would be the preferred way to go, or are there any other options?

//edit: I found another option: Identify the caller by certificate.

  • Is security an issue? Should company A be allowed to read company B's device state? Should the general public be allowed to?
    – nvoigt
    Commented Oct 3, 2016 at 11:39
  • A company should be allowed to only request it's own status and should be hindered to request any other companies status. The general public should not be allwoed to access any status at all
    – TheJoeIaut
    Commented Oct 3, 2016 at 11:46
  • Then you need security either way. Being as simple as https/user/password or more complicated. Your service will know who called it. That kinda solves your problem already. Further details will depend on your needs for security.
    – nvoigt
    Commented Oct 3, 2016 at 11:47

1 Answer 1


You may want to look into token based authentication.

The process would be something like this.

  1. User sends credentials to an authentication endpoint. If successful, a token is returned.

  2. When user wishes to check the status of the device, they pass the token in the header.

  3. The receiving service verifies that the token is valid.

  4. Using the token it retrieves information about the customer, retrieves the relevant data and returns it to the client.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.