0

We are using UserNamePasswordValidator and an IAuthorizationPolicy to load custom role data into an IPrincipal object for authentication and some business level rights on our server side.

Thus, we are using Thread.CurrentPrincipal inside our service operations to test rights etc. At the risk of getting more technical than I should, this is a static property on the Thread class which means that it has instance scope global scpope (duh, thanks Thilak). Should I change my InstanceContextMode in future for performance reasons to Single, this scheme will surely break? I am aware that Single requires you to write thread-safe code so in itself isn't just a config change.

Would you also please share any links to authoritative texts on exactly what kind of instance load WCF should be able to handle before I need to concern myself with this problem?

Andre Luus
  • 3,692
  • 3
  • 33
  • 46

1 Answers1

0

Here's a link

http://msdn.microsoft.com/en-us/magazine/cc948343.aspx

Here's my 2 cents:

Thread.CurrentPrincipal is static. Which means it has global scope not instance scope. However, it also happens to have thread affinity ... i.e. The property is marked [ThreadStatic] ... which means it has global scope, only for the current thread. And that's excellent news in your scenario, because your code using Thread.CurrentPrincipal shouldn't need to change whether youre on singleton mode or not.

p.s. Do check on the Thread context that IAuthorizationPolicy runs in. I do distinctly recall pain points with setting the Thread.CurrentPrincipal in some crazy, injected, security policy in the past. Make sure your The thread running in your IAuthorizationPolicy is the same thread your Service methods are invoked on.

Thilak Nathen
  • 1,333
  • 1
  • 8
  • 13
  • Thanks a lot Thilak! I didn't know that you could have Thread-scoped static properties... I'll have to put that in my mental toolbox. – Andre Luus Aug 12 '11 at 05:05
  • The IAuthorizationPolicy class gets called by WCF and the trick there is that I can't actually load the roles there. I just replace the principal with a custom type that can get roles loaded at a later point in time. – Andre Luus Aug 12 '11 at 05:08