In a previous entry, I brought up the challenge of preserving the original caller’s identity across tiers. Sure, this can be solved in a half-a-dozen ways, but which is the right way for the given situation? When designing a real software system, it’s all about the tradeoffs.

And the tradeoff I faced is that I want to know the identity of the caller even after I cross from the presentation tier to the application service tier to the database tier. But I don’t want to incur the cost of authenticating a second or third time (at each tier). Remember, my callers’ identities are not guaranteed to be in Active Directory, so a service invocation would mean an extra trip to my own authentication service and database.

My solution is to pass the caller’s identity, out-of-band, as I cross from the presentation tier to the application service tier. Note, I said the caller’s identity, not credentials (by identity, mean all of the information that is required to construct a custom Principal). On the application service tier, I’ll use an HttpModule to pull the identity out of a SOAP header, reconstruct a principal, and attach it to the current request. Now, I can perform role-based authorization in the application service tier.

Of course, passing identity information around the network, even within the external firewall, is dicey. I’ll use IPSec to preserve the integrity of the data that moves between these two tiers.

So, I get the benefit of a trusted-subsystem authentication model, without loosing the ability to perform role-based authorization based on the original caller.