title: WCF security with load balancer
body: <p>We need to create a WCF service (.NET 4.0) that will be consumed by a client outside of our organization.</p>
  
  <p>The case is that we have two servers that are behind a load balancer which terminates the SSL. This is where it gets confusing for me. 
  How we could and should handle the authentication?  </p>
  
  <p>The previous experience about WCF is only about services for internal use. If I understood correctly we should use basicHttpBinding to guarantee interoperability with Java based client. I don't know if this is an issue with JAX-WS based client.</p>
  
  <p>There will only be this one client that is going to use the service.</p>
  
  <ul>
  <li>We need to somehow ensure that caller is authenticated to use the
  system </li>
  <li>Make sure the message is encrypted when moving in public network</li>
  </ul>
  
  <p>So far the best article that I found was
  <a href="http://devproconnections.com/net-framework/wcf-and-ssl-processing-load-balancers" rel="nofollow">http://devproconnections.com/net-framework/wcf-and-ssl-processing-load-balancers</a></p>
  
  <p>There were few suggestions how to do this. </p>
  
  <blockquote>
    <p>WCF services can be configured for basic authentication and receive credentials in the clear over HTTP. This can work; however, it precludes passing credentials in the message, and the use of more interesting credentials (such as issued tokens).</p>
  </blockquote>
  
  <p>We use forms authentication on our website under which the service will be hosted. I think it is not easy or even possible to make the service then use basic authentication.</p>
  
  <blockquote>
    <p>WCF services can be configured to fake the presence of transport security so that the runtime will allow receiving message credentials without transport or message protection</p>
  </blockquote>
  
  <p>Will this be the way to go and will this work with basicHttpBinding?</p>