Security

Microsoft Dynamics AX services rely on WCF for security. You can change the
WCF configuration to make necessary security settings that are required by
Microsoft Dynamics AX services. WCF is responsible for authenticating the
user.

A service operation performs a specific action on the document such as read,
update, or delete. All service operations are performed in the context of a valid
Microsoft Dynamics AX user. When the AOS receives a service call, the services
framework (AifMessageInspector) retrieves the Windows identity by using the
ServiceSecurityContext class. This Windows identity is used to initialize a valid
Microsoft Dynamics AX session. This Microsoft Dynamics AX session is used
for all X++ operations and is released when the call is completed.

Each service operation causes a Microsoft Dynamics AX logon and logoff.
Microsoft Dynamics AX uses session pooling to reduce the overhead of creating
and destroying a session on every call.

By default, all external WCF service calls are made in the context of the
Microsoft Dynamics AX identity of the caller. WCF allows for client credentials
to be specified in WCF configuration or in the code. Configuration based
credentials (such as certificates) can be specified in the WCF client configuration
for the service.

Some of the client credential values cannot be set using the WCF configuration
file such as the user name and password or the Windows user name and
password. Such credential values must be specified in the code. 

Regards,
Hossein Karimi