Exclude WCF Service from Forms Authentication?

Question

Hello all,

I've been trying unsuccessfully to exclude a .svc service endpoint from my application's forms authentication. It would appear that if I use the Visual Studio development server that forms authentication doesn't cover the .svc files, but as soon as I move it to IIS7 I get re-directed to the login page when I try and access the endpoint.

I already successfully exclude some files using the <location /> tag but for some reason the .svc ignores this and I still get redirected to the login page.

Anything I can do to remedy this?

Thanks in advance,

David

Answer 1

-> Anything I can do to remedy this?

How about creating a new virtual directory, and place the *.svc file there, is this an option for you?

Thanks

---

Another Paradigm Shift
http://shevaspace.blogspot.com

Answer 2

Thanks for your reply.

Your suggestion is how I managed to get it working, but this then means that I have to have another copy of the application's common DLLs in the bin directory of the sub application. This adds another piece of complexity as I now have another place I (or someone else) must remember when updating the application.

It works, but it's not the cleanest solution.

Regards,

David

Answer 3

-> Your suggestion is how I managed to get it working, but this then means that I have to have another copy of the application's common DLLs in the bin directory of the sub application.

Try installing the common DLLs into the GAC, then you could use them across different ASP.NET application.

-> This adds another piece of complexity as I now have another place I (or someone else) must remember when updating the application.

Yes, but this also adds the benefit such as fault isolation, independent host recycling etc etc, since the WCF web service will be runnning in different IIS worker process different from the ASP.NET code.

Hope this clears things up a little bit.

---

Another Paradigm Shift
http://shevaspace.blogspot.com

Answer 4

You are absolutely right.

Thanks.

Answer 5

You might also be interested in this:
Supporting HTTP Authentication and Forms Authentication in a Single ASP.NET Web Site
http://msdn.microsoft.com/en-us/library/aa479391.aspx

If this link ever dies, search for Mixed Authentication Disposition ASP.NET Module (MADAM), which is the HttpModule talked about in this MSDN article to handle mixed authentication.  In this case, it allows both forms authentication and basic/digest authentication to live together.