title: UI Service ~ Main Service Authentication
body: <p>I am designing(yes just about still <em>designing</em>) an architecture whereby we have a main service that does stuff. Authenticates users, imports data and gets results etc. We also have a ASP MVC3 UI module that interacts with it. The key here is that in future it might be SharePoint or just a bulk importer app using the service so it has to be mindful but for now it is a ASP MVC3.</p>
  
  <p>What I am struggling to decide/get my head around is authentication. I like MembershipProvider more over I like SqlProvider. We are a M$ house so I am happy to go down that road. What I want to do is tie in the authentication of the user logging into the UI with the authentication on the actual service calls. Broadly there are 2 types of user 'normal' and 'admin' and I can't decide the most elegant way to handle authentication.</p>
  
  <p>I really like what I have. SqlProvider offered by the WCF Service and the access on the service calls are all tied into it as well (i need to tidy this up tho as currently all service calls are locked down by config rather than per service contract).</p>
  
  <p>The problem with this is you have to pass user name and password over clear text and to prevent that you are in the world of certificates - My research here indicates that dev certificates are bad and real ones are expensive so if true neither are an option.</p>
  
  <p>The question is: what is the best approach? I want
  A Service that
  i) Authenticates on each call so you can't call something your not allow to - handled as elegantly as possible
  ii) Is stateless so I can scale/cluster the service.
  iii) is not control on the client side so it can be replaced.</p>
  
  <p>The alternative to the certificates I thought of what a login call to the service that returns a token of some kind that is subsequently passed along with the other calls and authenticated using a custom Principal provider. The pros to this are I can use windows encyptions between the UI and service and pass along authentication for the roles along side. What I want to avoid doing is passing u/n details in the parameters for each call as that seems ugly.</p>
  
  <p>Please help!</p>