I've created several WCF services USING CKS:DEV to be hosted in SharePoint and accessed on SharePoint pages using SharePoint. I'm using the MultipleBaseAddressWebServiceHostFactory for hosting purpose and I've set up general security on the service by setting up the web.config with:
<system.web> <authorization> <allow users="SomeGroup" /> <deny users="*"/> </authorization>
This works fine, so that if an user without access permissions hits the URL an http 401 error is returned.But I want to be able to secure the individual methods in the service. I added
[PrincipalPermission(SecurityAction.Demand, Role = "myDomain\somegroup")]
to one of the methods, and it does definitely block the users access. But in this case it returns a 500 server error, which I'm sure will be misunderstood by others calling this web service in the future. I really want it to return a 401.
I tried adding entries to the web config like:
<location path="MuServicName/MyServe.svc/GetStuff"> <system.web> <authorization> <deny users="*"/> </authorization> </system.web>
But none of the permutations I tried had any effect.
Is there a good way to secure the individual methods of a WCF Service that will return a 401 if the user is not authorized?