title: WCF in a domainless setting
body: <p>I have a .NET client-server system, which uses WCF for communication.</p>
  
  <p>The communication must be secure. Up to now I used Windows Credentials for authentication.</p>
  
  <p>But now a new requirement emerged - the system must work in a situation, when client and server are located in different domains (or the client isn't in any domain).</p>
  
  <p>Windows Credentials authentication won't work in this setting. AFAIR, WCF supports following security mechanisms</p>
  
  <ul>
  <li>Windows Authentication</li>
  <li>X509 Certificates</li>
  <li>Issued Tokens</li>
  <li>Username and password.</li>
  </ul>
  
  <p>Which of them should I use, if</p>
  
  <ol>
  <li>I need to implement the fix with the least possible effort,</li>
  <li>client and server are located in different domains (therefore, Windows authentication is not an option) and</li>
  <li>the communication must be secure (the server must not process requests from unauthorized clients)</li>
  </ol>
  
  <p>?</p>