1. Basics of Securing Workflow Services Introducing the Workflow Services Security Pack (WFSP)

2. 2

3. 3

6. Securing for Windows Principals Use to secure at operation scope Wrap Receive and related sequence in Principal PermissionScope PrincipalPermission Scope Receive Activity …Other Activities … Send Reply Activity Username Role Name Delegation supported When Receive’s Principal doesn’t match user or role, exception thrown Can deny anonymous by setting both User and Role to Null Windows Username (domain\user) or Windows Group web.config web.config

7. Securing for Username / Password Set up ASP.NET membership & role providers in service config Can use any membership and role provider Use AppFabric to configure certificate for Username / Password secured services PrincipalPermission Scope Receive Activity …Other Activities … Send Reply Activity Username Role Name Membership Username or Role name web.config SqlMembershipProvider, SqlRoleProvider & Connection String wsHttpContextBinding message client credential type = “UserName” ServiceAuthorization behavior (principalPermissionMode = “UseAspNetRoles”) ServiceCredentials behavior Service certificate userNameAuthentication (usernamePasswordValidationMode = “MembershipProvider”) web.config SqlMembershipProvider, SqlRoleProvider & Connection String wsHttpContextBinding message client credential type = “UserName” ServiceAuthorization behavior (principalPermissionMode = “UseAspNetRoles”) ServiceCredentials behavior Service certificate userNameAuthentication (usernamePasswordValidationMode = “MembershipProvider”) No access to supplied password

9. Securing Workflow Services