title: Understanding WCF Windows Authentication
body: <p>I have a service with windows authentication. Using the following code, I can get the Windows Identity of the user who (by using the client) consumes the service.</p>
  
  <pre><code>String currentUser = OperationContext.Current.ServiceSecurityContext.WindowsIdentity.Name;
  </code></pre>
  
  <p>The configuration in the server is:</p>
  
  <pre><code>&lt;binding name="messageSecurity"&gt;
  &lt;security mode="Message"&gt;
  &lt;message clientCredentialType="Windows"/&gt;
  &lt;/security&gt;
  &lt;/binding&gt;
  </code></pre>
  
  <p>I also read that in the server, it is using Kerberos for this to work.</p>
  
  <p>Now, I am trying to understand its significance in our corporate network. In the office, users will be logging into their desktops using their active directory credentials. Our service is hosted in a windows server named “SERV1” .  </p>
  
  <ol>
  <li><p>Is only users who have access (to login)  to “SERV1” can access the service? Or all users who are able to login to the office network (suing active directory credentials) will be able to consume the service?</p></li>
  <li><p>Is there a way to ensure that only CIO approved applications will be accessing the service, keeping the service as windows authenticated?</p></li>
  <li><p>Does this authentication check happen for each service operation call or only for the first call?</p></li>
  <li><p>Is there any way the service will be able to know the windows credentials of the user?</p></li>
  </ol>
  
  <p>Note: What I understand is WindowsAuthentication can be compared to a Membership provider - providing username and password from a centralized location. It can be compared to ASP.Net Membership Provider or Active Directory Membership Provider. </p>
  
  <p>Further reading:</p>
  
  <ol>
  <li><p><a href="https://stackoverflow.com/questions/895002/asp-net-active-directory-membership-provider-and-sql-profile-provider">ASP.NET Active Directory Membership Provider and SQL Profile Provider</a></p></li>
  <li><p><a href="https://stackoverflow.com/questions/5051095/wcf-data-contracts-authorization/5136551#5136551">wcf data contracts authorization</a></p></li>
  <li><p><a href="http://www.theserverside.net/tt/articles/showarticle.tss?id=ClaimsBasedSecurityModel" rel="nofollow noreferrer">http://www.theserverside.net/tt/articles/showarticle.tss?id=ClaimsBasedSecurityModel</a></p></li>
  </ol>