title: WCF: Authentication Service or token-based security?
body: <p>There's a <strong>Dynamic CRM</strong> instance on a server ("on-premises"). It will be used by <strong>a few sites</strong> that run on distant machines (another domain, another Active Directory). The communication between those sites and the CRM instance is done via a <strong>CRM proxy</strong>, a WCF service that sits near it (near CRM), handles requests, queries CRM etc.</p>
  
  <p>That WCF service is facing the Internet. Although secured communication channels aren't that necessary, authentication is. We cannot let random clients to use the services provided by the CRM proxy.</p>
  
  <p>So, Authentication Service (cookies?) / hand-coded token passing (as a parameter for each service operation) / <a href="https://stackoverflow.com/questions/1861868/token-based-authentication-in-wcf">this solution - on stackoverflow</a>.</p>
  
  <p>Thank you in advance!</p>
  
  <p>PS: hand-coded tokens would be "time-sensitive" and hashed a few times with some secret keys. Man-in-the-middle might not be such a big problem, as a token can be invalidated after a request.</p>