title: WCF authentication service
body: <p>I am relatively new to the WCF world so my applogies for the newbie question. I am currently designing a layer of WCF services. One of them is an authentication service, so I came up with the following authentication mechanism:</p>
  
  <pre><code>IUserService.TryAuthenticateUser(string username, string password, out string key)
  </code></pre>
  
  <p>Basicly the user tries to authenticate and if successful - he/she receives a sessionkey/securitykey/whateverkey... the key is then required for every other "WCF action" e.g.</p>
  
  <pre><code>IService.GiveMeMyFeatures(string key);
  IService.Method1(string key);
  </code></pre>
  
  <p>This mechanism looks extremely intuitive for me and is also very easy to implement, so what bothers me is why I cant find similar WCF examples? This unique key (which is practically a session key with wcf-side expiration and all) can then by used from the various applications, according to the application's architecture: for ASP.NEt it can be stored in a cookie, for Winform/WPF/Mobile I guess it can be stored in the form-class in a field and so on...</p>
  
  <p>So here comes question number 1: What do you think of this method?</p>
  
  <p>I also read, that I can use the build-in ASP.NET Authentication Services (with membership providers etc... if I understood correctly). From architecture point of view I dont really like this method, because when authenticating from an ASP.NET page the workflow will be like this:
  ASP.NET -> WCF -> ASP.NET Authentication Service -> Response</p>
  
  <p>In this scenario one could also bypass the WCF layer and call the auth. service methods directly from the asp.net page. I know that by going thru the WCF layer for every authentication request I will lose some performance, but it is important for me to have a nice, layered architecture...</p>
  
  <p>And here is question number 2: What are the advantages/disadvantages of this method over the first one, and why is it so popular, when from architecture point of view it is kinda wrong?</p>
  
  <p>I also read, that I can send user credentials for every WCF method call and use the built-in mechanism to authenticate and respond properly to the request.</p>
  
  <p>Q3: What do you think if this method?</p>
  
  <p>And to sum up - obviously there are many authentication methods, but which one do you think is best and most generic (considering that the WCF services will be called from asp.net/wpf/mobile/etc...)?</p>
  
  <p>Thanks is advance :)</p>