title: Restricting access to internal WCF services
body: <p>We have a couple of WCF services hosted in an asp.net application on IIS. We are getting more and more services used for internal communication(between our own systems, where the client can be located on the same server or on other servers). Now we need to secure these services by some means. </p>
  
  <p><strong>In short: The purpose is to stop other people from calling our services. Only applications under our control should be able to communicate with these services</strong>  </p>
  
  <p>Our current thought:
  We already have SSL enabled and we have a public cert for the server. Our current plan is to enable to security by using: clientCredentialType="UserName" where we have a custom validator that simply checks against a username/password we have defined(much like an API key).</p>
  
  <p>Question #1: Is there any better way? The scenario sound simple and I feel we are missing some obvious solution.  </p>
  
  <p>Question #2: If we do it this way will the SSL cert we already have be enough or must we create any other certs?</p>
  
  <p>Some context: .net 4, IIS 7, We have access to the server. The clients/services might be located on different servers. </p>
  
  <p><strong>Update 1:</strong> The client might be located on a completly different network. We have some other systems hosted elsewhere that also need to be able to call these services.</p>