security - Authorization and Token Validation with WCF Service -
i working on internal test framework in 1 of requirements able allocate resource can used within test (e.g. allocate physical pc used part of test). resource has wcf service running on , test talks using proxy.
as part of framework, add level of authorization after allocating resource, token retrieved , presented service running on resource , must validated resource's service.
we've come 2 main options this:
1. *federated security* - proxy talks resource gets token security token service , presents resource's service validates it. seems cleanest solution, main issue revocation of token after device released. 1 option have token have timeout of few mintues , worst case resource unused few minutes - less ideal.
2. *validation token service in each call* - in solution, resource service uses token service validate token (instead of validating using public key in solution #1). solves issue of revocation, seems tons of overhead validate service each call.
what think? option better? there option 3 (4,5, etc.)? thanks!
Comments
Post a Comment