如果要执行用户名和密码身份验证，则可以自定义验证器，如本MSDN文档中所示.

#如何:使用自定义用户名和密码验证器

http://msdn.microsoft.com/en-us/library/aa702565.aspx

您可以将Windows身份验证与Message Security一起使用，WCF将为您执行Windows身份验证，没有其他工作.

但是，如果您要对客户端使用基本身份验证，请在 传输安全性， 您需要 要做 验证 在 服务器端的http 级别 ， 如果 使用 IIS， 它将 帮助您 做好 ，，如果您没有 IIS， it 是 必要的 以 自己 .

***的问候.

>

Hey 

I want to understand how the authentication mechanism works. If an application is hosted on IIS and set to windows  or basic IIS will authenticate against the windows accounts. 

when basic it will use the user name/ password that comes with the request where as windows integrated will use the token this is my understanding if I am wrong please do point it out.

when a WCF service is hosted on windows service, where the authentication is happening? If I use basic authentication what happens when I request a method??

I wanted to propose a solution but I want to understand this before I suggest. Do I have to use custom authentication provider or I am seeing a sample application my team has the client makes a call to a ping method that has response as pong. but the client uses it to figure out the user is authorized user or not. 

I thought they might use some custom provider but in the code I dont see any. but the authentication is happening. so I wanted to understand what is exactly happening when a request that comes to WCF method that is hosted on windows service with basic authentication. 

Thanks 

Chamy07

Hi,

If you want to do User Name and Password authentication, you can custom a validator, as shown in this MSDN document.

#How to: Use a Custom User Name and Password Validator

http://msdn.microsoft.com/en-us/library/aa702565.aspx

You can use Windows authentication with Message security, WCF will do the Windows authentiaction for you, there are not additional work.

But if you want to use Basic authentication for the client, Basic authentication used in Transport security, you need to do the verification in the http level at the server side, if using IIS, it will help you do a good job, if you do not have IIS, it is necessary to it yourself.

Best Regards.