System.ServiceModel 4.0.0.0 System.Object

The data is part of the for a message.

Use this class to obtain information about a remote security context at runtime. A security context is created when a client is successfully authenticated and authorized to access a method. When a message is successfully authenticated and authorized, the security information from the client and for the current service instance can be obtained from an instance of this class.

You can retrieve an instance of the from the property of the class, or use it from within a service operation method, as shown in the following example.

## Parsing a ClaimSet

A common use of the class is to retrieve the current set of claims for the purpose of identifying or authorizing a client when accessing a method. The class contains a collection of objects, and each can be parsed to determine whether a specific claim is present. If the specified claim is provided, authorization can be granted. This functionality is provided by overriding the method of the class. For a complete example, see the Authorization Policy Sample.

## Cookie Mode and IsAuthenticated

Note that under some circumstances, the property of the interface returns true even if the remote client is authenticated as an anonymous user. (The property returns an implementation of the interface.) The following circumstances must be true for this to occur:

The service uses Windows authentication.

The service allows anonymous logons.

The binding is a customBinding Element.

The custom binding includes a <security> element.

The <security> element includes a secureConversationBootstrap element with the requireSecurityContextCancellation attribute set to false.

Represents the security context of a remote party. On the client, represents the service identity and, on the service, represents the client identity.

- Constructor
  4.0.0.0

  This constructor uses the default policy-chaining engine.

  Initializes a new instance of the class with the collection of policies object.

  A of type that contains the authorization policies.
- Constructor
  4.0.0.0

  This constructor is typically used in scenarios where an application runs its own policy-chaining engine, which results in an . For the default policy engine, use the constructors that take a collection of as parameter.

  Initializes a new instance of the class with the specified authorization parameters.

  An that contains authorization information.
- Constructor
  4.0.0.0
  To be added.

  Initializes a new instance of the class with the specified authorization parameters and collection of policies.

  An that contains authorization settings.
  A of type that contains the authorization policies.
- Property
  4.0.0.0
  System.ServiceModel.ServiceSecurityContext To be added. To be added.

  Returns an instance of the class that contains an empty collection of claims, identities, and other context data that is usually used to represent an anonymous party.

- Property
  4.0.0.0
  System.IdentityModel.Policy.AuthorizationContext To be added. To be added.

  Gets the authorization information for an instance of this class. The contains a collection of that the application can interrogate and retrieve the information of the party.

- Property
  4.0.0.0
  System.Collections.ObjectModel.ReadOnlyCollection<System.IdentityModel.Policy.IAuthorizationPolicy> To be added. To be added.

  Gets the collection of policies associated with an instance of this class.

- Property
  4.0.0.0
  System.ServiceModel.ServiceSecurityContext To be added. To be added.

  Gets the current .

- Property
  4.0.0.0
  System.Boolean To be added. To be added.

  Gets a value that indicates whether the current client has provided credentials to the service.

- Property
  4.0.0.0
  System.Security.Principal.IIdentity To be added.

  The primary identity is obtained from the credentials used to authenticate the current user. If the credential is an X.509 certificate, the identity is a concatenation of the subject name and the thumbprint (in that order). The subject name is separated from the thumbprint with a semicolon and a space. If the subject field of the certificate is null, the primary identity includes just a semicolon, a space, and the thumbprint.

  When a duplex message exchange pattern is used with Kerberos direct authentication, this property becomes empty on the callback and the claimset is also empty. This does not happen when SspiNegotiated is used instead of Kerberos.

  The Kerberos Requester Token is used only on the client to represent the service. The authorization policy that it generates contains one claim, an SPN; hence, no identity in the claim. In most cases there is no problem, because is not used on the client. In a duplex scenario during callback, if the callback inspects this property, it gets an anonymous identity.

  Gets the primary identity associated with the current setting.

- Property
  4.0.0.0
  System.Security.Principal.WindowsIdentity To be added.

  If the remote party cannot be associated with a Windows account, the property is set to true.

  Gets the Windows identity of the current setting.