security - Authorization and Token Validation with WCF Service -


i working on internal test framework in 1 of requirements able allocate resource can used within test (e.g. allocate physical pc used part of test). resource has wcf service running on , test talks using proxy.

as part of framework, add level of authorization after allocating resource, token retrieved , presented service running on resource , must validated resource's service.

we've come 2 main options this:

1. *federated security* - proxy talks resource gets token security token service , presents resource's service validates it. seems cleanest solution, main issue revocation of token after device released. 1 option have token have timeout of few mintues , worst case resource unused few minutes - less ideal.

2. *validation token service in each call* - in solution, resource service uses token service validate token (instead of validating using public key in solution #1). solves issue of revocation, seems tons of overhead validate service each call.

what think? option better? there option 3 (4,5, etc.)? thanks!


Comments

Popular posts from this blog

python - Scipy curvefit RuntimeError:Optimal parameters not found: Number of calls to function has reached maxfev = 1000 -

c# - How to add a new treeview at the selected node? -

java - netbeans "Please wait - classpath scanning in progress..." -