How to: Use Windows Authentication to Secure a Service for Silverlight Applications

Change the binding configuration in the <bindings> element of the <system.serviceModel> section to support Windows authentication. The following example shows how to do this when configuring a CustomBinding binding.

       <customBinding>
          <binding name="myBinding">
            <binaryMessageEncoding/>
            <httpTransport authenticationScheme="Ntlm"/>
          </binding>
       </customBinding> 

The following example shows how to do this when configuring a standard BasicHttpBinding binding.

        <basicHttpBinding>
          <binding name="myBinding">
            <security mode="TransportCredentialOnly">
              <transport clientCredentialType="Ntlm"/>
            </security>
          </binding>
        </basicHttpBinding> 

NT LAN Manager (NTLM) authentication is a challenge-response scheme that uses Windows credentials to transform the challenge data instead of a user name and password. A full discussion of the proper server-side configuration is outside the scope of this topic. You might need to configure Internet Information Services (IIS) to support Windows authentication. For more information, see Understanding HTTP Authentication and Transport Security Overview.

On the target service, make sure that your service <endpoint> element in the <service> element of the <system.serviceModel> section in the Web.config file is configured with the binding configuration you defined above.

<endpoint address="" 
          binding="basicHttpBinding" 
          bindingConfiguration="myBinding" 
          contract="SilverlightApplication2.Web.Service1" />

At this point, you can use any of the usual WCF mechanisms for authorization outlined in Authorization. The following example shows how to use the OperationContext.Current.ServiceSecurityContext.PrimaryIdentity to access the current user’s identity.

  [OperationContract]
        public int GetAccountBalance()
        {
//Block unauthorized users. SecurityException will return the correct SOAP Fault for this situation.
            if (!OperationContext.Current.ServiceSecurityContext.WindowsIdentity. IsAuthenticated) throw new SecurityException();

//Retrieve the data for the current user.
            return Database.GetBalanceForUser(OperationContext.Current.ServiceSecurityContext.WindowsIdentity.Name);

        }

(Optional) Verify that there are no errors in the service configuration. A convenient way to do this in Visual Studio 2010 is to right-click the .svc file in the Solution Explorer and select View in Browser (or press CTRL + F5) to display a test page for the service. Many HTTPS-related and authentication-related configuration errors are easy to catch at this stage but difficult to debug directly from a Silverlight 4 application.

Tip:
You can also use the approach described in this section for Windows Communication Foundation (WCF) services that are hosted in ASP.NET but that are not running in ASP.NET Compatibility Mode, so that not all ASP.NET features are supported.

Go to the Tools menu in the browser, select Internet Options, click the Security tab, and select the Local Intranet zone.

To configure settings for this zone, click the Custom Level button near the bottom, find the Logon settings in the User Authentication section, and select Automatic logon only in Intranet zone.

Click OK to return to the Internet Options window.

Click the Advanced tab in the Internet Options window, and scroll down to the Security section at the bottom. Ensure that Enable Integrated Windows Authentication* is selected, and click OK to save the new settings.

Caution:
Using Windows credentials outside of your local intranet has serious security implications.