Re: How to call Web Service Securely

Thanks. Maybe I am complicating WSE too much - can you point me to a simple
example of WSE used with a WebMethod?

"Dominick Baier [DevelopMentor]" wrote:

Hi,

ok - as i said - you have two options:

--- #1 you create Windows users for your client on the IIS machine

you could provide a logon screen in the client app and create a NetworkCredential
from that - then use SSL and basic auth to access the web service


--- #2 you don't want the user accounts in Windows but rather some database

you could handroll some headers or use WSE (e.g. if you can't use SSL) -
you would have to provide your own authorization architecture then -

WSE3 is the first version which supports an <authorization> element for security
tokens - but that is tied to .NET 2.0


so i guess the easiest option might be #1

---------------------------------------
Dominick Baier - DevelopMentor
http://www.leastprivilege.com

Dominick,

I looked at handrolling WS* but the problem I had was I didn't like
having to hardcode lookups on the server side - I was just hoping I
could create some token on the desktop side and when making the call
it the service's method woul allow or disallow.

The design is a stand-alone exe (could be on your machine) needs to
make a web method via dialup to my IIS Web Service.

I can create a User Account on the IIS server but not on the user's
desktop - the networks are unrelated. I can create my own logon
screen locally of course to get the userid and password I'll need to
somehow to receive on the other side.

Is there a way I can create a token from that userid/password and use
integrated security without having to have the standard windows login
scrdeen popoup each method call?

"Dominick Baier [DevelopMentor]" wrote:

Hi,

you can use IIS/integrated auth with SSL or WS:Security

Does your user have a Windows account? if yes you could simply use
integrated/basic/digest over SSL

If you want some kind of custom authentication scheme - you could
handroll it using headers or have a look at UsernameTokens in WSE3
which is a standard implementation of passing identity information
with SOAP packets.

ping me if you need more help

---------------------------------------
Dominick Baier - DevelopMentor
http://www.leastprivilege.com
I love Web Apps in ASP.NET 2.0 because you can easily deny users
access to pages by role or user.

But for desktop client to webservice methods, I am not sure what to
do....

I am looking for the simplest and safest method or pattern to have
my Desktop client be able to call a web services securely.

Assume my webservice proxy has 15 methods. By securely, I want the
Client
desktop app to pass some kind of simple username/password token --
something
- but not in plain text - so that acces to the web call either
immediately
succeeds or fails. I don't know where to start - what is the
simplest and
easiest way to accomplish this and maintain it.
Thanks for any simple answers.



.

Relevant Pages

  • Can Web Service modify SOAP Header parameters?
    ... I built a test web service project in VS2005 and I'm tring to ... Public Username as String ... client is able to populate grid with received dataset ... I thought that most logical place to have tokens located is a SOAP ...
    (microsoft.public.dotnet.framework.aspnet.webservices)
  • WSE3 web farm problem: "Key not valid for use in specified state"
    ... I have a web service in ASP.NET 2.0 and WSE 3.0. ... server1, and the actual request went to server2, like the following ... Client output: RST ...
    (microsoft.public.dotnet.framework.webservices.enhancements)
  • Re: Web Services, Security, X.509
    ... We have a smart client application which consumes an internet-facing ... (At this time the web service and the client use ... WSE 3.0 and it is working ... Finally, if a X.509 certificate is required, which certificate is the ...
    (microsoft.public.dotnet.framework.webservices.enhancements)
  • Re: Can Web Service modify SOAP Header parameters?
    ... find if web service can modify SOAP Header variables and return them ... client is able to populate grid with received dataset ... I thought that most logical place to have tokens located is a SOAP ... In the code you are trying to implement Direct Authentication pattern ...
    (microsoft.public.dotnet.framework.aspnet.webservices)
  • had to elevate ASPNET account user rights assignment
    ... I have a client running in our office and asp.net web service ... I finally got the wse 2.0 enabled asp.net web service ... authenticate my username and password as cleartext? ...
    (microsoft.public.dotnet.framework.webservices.enhancements)