Please explain different modes of security in WCF? Or Explain the difference between Transport and Message Level Security.

In Windows Communication Foundation, we can configure to use security at different levels

•  Transport Level security.
•  Message Level Security

Transport Level security.:-

Transport Level security means providing security at the transport layer itself. When dealing with security at Transport level, we are concerned about integrity, privacy and authentication of message as it travels along the physical wire. It depends on the binding being used that how WCF makes it secure because most of the bindings have built-in security.


  <netTcpBinding>
         <binding name=”netTcpTransportBinding”>
                    <security mode=”Transport”>
                          <Transport clientCredentialType=”Windows” />
                    </security>
          </binding>
  </netTcpBinding>

Message Level Security.:-

For Tranport level security, we actually ensure the transport that is being used should be secured but in message level security, we actually secure the message. We encrypt the message before transporting it.

   <wsHttpBinding>
            <binding name=”wsHttpMessageBinding”>
                          <security mode=”Message”>
                                     <Message clientCredentialType=”UserName” />
                          </security>
             </binding>
     </wsHttpBinding>



It totally depends upon the requirements but we can use a mixed security mode also as follows:

  <basicHttpBinding>
             <binding name=”basicHttp”>
                          <security mode=”TransportWithMessageCredential”>
                               <Transport />
                               <Message clientCredentialType=”UserName” />
                          </security>
              </binding>
       </basicHttpBinding>




In this above post I explained  how to use security at different levels in WCF service. I hpe you enjoyed it so please send your feedback and queries. Thnak You.

What is transaction in WCF?

What is transaction and committed transaction in WCF?

A transaction is a collection or group of one or more units of operation executed as a whole. It provides way to logically group multiple pieces of single work and execute them as a single unit. In addition, WCF allows client applications to create transactions and to propagate transactions across service boundaries.

A transaction that executes successfully and manages to transfer the system from the consistent state A to the consistent state B is called a committed transaction.

What is Two-phase commit protocol in WCF? Why is it needed?

Consider for example client calling multiple service or service itself calling another service, this type of system are called as Distributed Service-oriented application. Now the questions arise that which service will begin the transaction? Which service will take responsibility of committing the transaction? How would one service know what the rest of the service feels about the transaction? Service could also be deployed in different machine and site. Any network failure or machine crash also increases the complexity for managing the transaction. This problem is resolved by using two phase protocol.

All the transactions in WCF complete using two phase commit protocol. It is the protocol which enables transactions in a distributed environment. This protocol mainly consist of two phases:

Prepare phase: In this phase the client application performs the operations of a WCF service. WCF service determines whether the requested operation will be successful or not and notify the client about the same.
Commit Phase: In the commit phase the client checks for the responses it got from the prepare phase and if all the responses are indicating that the operation can be carried out successfully the transaction is committed. If the response from any one of the operations indicates failure then the transaction will be rolled back. The actual operation on the service end will happen in the commit phase.
WCF service will have to send the notification of whether the operation will succeed or fail to the client application. It means that the One way operations can never support transactions. The operations that support transactions have to follow the Request-Response MEP. Also the applied binding should support WS-Atomic Transaction protocol like wsHttpBinding.

What is Transaction Propagation in WCF? Explain with example.

Suppose that there are two services CreditService and DebitService. CreditService has operation Credit(int accountId, double amount) and DebitService has operation Debit(int accountId, double amount). If you want to transfer amount from one account to another account, you need to call both the services. You also need to ensure that both the services should either succeed or fail together. You can achieve this by propagating the transaction of first service call to the second service call. Transaction Propagation is supported by WCF. You can propagate transaction across the service boundaries. It enables multiple services to participate in same transaction.

You can enable/disable transaction propagation using configuration as below:


<bindings>
   <netTcpBinding>
     <binding transactionFlow="true"></binding>
   </netTcpBinding>
</bindings>

Above configuration ensures that transaction can be propagated. However it does not force the transaction propagation until you specify for particular operation. You need to enable transaction flow for the operations whom you want to be part of transaction as below:


[OperationContract]
[TransactionFlow(TransactionFlowOption.Allowed)]
bool Credit(int accountId, double amount);
[OperationContract]
[TransactionFlow(TransactionFlowOption.Allowed)]
bool Debit(int accountId, double amount);

Note: You can have single operation as which can do credit and debit. However I have separated as two for illustrating about transaction.

transactionFlow and TransactionFlowOption together enables the transaction flow for particular operation. If you enable only one of these two, transaction flow can not be enabled.

There are 3 possible values for TransactionFlowOption:

1. TransactionFlowOption.Mandatory: specifies that this function can only be called within a transaction.
2. TransactionFlowOption.Allowed: specifies that this operation can be called within a transaction but its not mandatory.
3. TransactionFlowOption.NotAllowed: specifies that this operation can not be called within a transaction.

How to create WCF transaction?

There are some steps you need to follow to enable transaction for a WCF service as below:

Step 1: Decorate the operation contract with TransactionFlow attribute for enabling the transaction.


<code>[OperationContract]
[TransactionFlow(TransactionFlowOption.Allowed)]
bool Debit(int accountId, double amount);

Step 2: Create the service class which implements the service contract and set the operation behavior with TransactionScopeRequired = true. This attribute is used to enable the service transaction when the client transaction is not available.


<code>[OperationBehavior(TransactionScopeRequired = true)]
public bool Debit(int accountId, double amount)
{
  // Debit logic goes here
}


Step 3: Enable transaction flow in configuration file.

<bindings>
      <wsHttpBinding>
        <binding name="myTransactionBinding" transactionFlow="true" ></binding>
      </wsHttpBinding>
    </bindings>





In this above post I explained What is transaction  in WCF. I hpe you enjoyed it so please send your feedback and queries. Thnak You.