SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've created several WCF services USING CKS:DEV to be hosted in SharePoint and accessed on SharePoint pages using SharePoint. I'm using the MultipleBaseAddressWebServiceHostFactory for hosting purpose and I've set up general security on the service by setting up the web.config with:

  <allow users="SomeGroup" />
  <deny users="*"/>

This works fine, so that if an user without access permissions hits the URL an http 401 error is returned.But I want to be able to secure the individual methods in the service. I added

[PrincipalPermission(SecurityAction.Demand, Role = "myDomain\somegroup")]

to one of the methods, and it does definitely block the users access. But in this case it returns a 500 server error, which I'm sure will be misunderstood by others calling this web service in the future. I really want it to return a 401.

I tried adding entries to the web config like:

 <location path="MuServicName/MyServe.svc/GetStuff">
    <deny users="*"/>

But none of the permutations I tried had any effect.

Is there a good way to secure the individual methods of a WCF Service that will return a 401 if the user is not authorized?

share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.