Security design question

I am in search of some suggestions regarding how I should emplement security
in a system being developed.

System architecture:
A web application is exposed to the internet. Behind a firewall is a series
of web services. The web services communicate with a SQL server 2000
database through stored procedures. Users access the web application over
an SSL connection, and the web application accesses the web services over an
SSL connection. We limit access to the web application through forms
authentication.

My design dilemna:
There should be some authentication mechanism between the web application
and the web services. In the future we may develop other applications or
allow other vendors to use our web services. So my question is, are there
recommended ways to authenticate an application to a web service?

I'm not inclined to use WSE because I'm not aware of toolkits for much
beyond .net development and we want a relatively easy method of using the
web services with technologies other than .net.

I am searching for some sort of standard mechanism that can be relatively
easily implemented. I could role my own solution but in the event that 3rd
party vendors will use my web services, they will need to understand my
implementation details where as sdks are probably already available for
standard approaches.


.

Relevant Pages

  • Re: Windows Authentication, Single sign on and Active Directory
    ... your web server is probably a workgroup mode machine. ... Co-author of "The .NET Developer's Guide to Directory Services ... web service proxy client fails to connect due to authentication failure ... Windows authentication on the web services. ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Windows Authentication, Single sign on and Active Directory
    ... web service proxy client fails to connect due to authentication failure ... the web services anyway, as it is generally important to protect any ... web server is also a member of the domain). ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Architecture Advice
    ... WSE3 is only a framework that adds WS-* support to the Web services stack. ... WS-Federation with SAML has the following benefits over Kerberos: ... Could you point out the benefits of sts over Kerberos authentication in ...
    (microsoft.public.dotnet.framework.webservices.enhancements)
  • Re: Trying to determine best strategy for web service security
    ... I would check out the Hands On Labs for WSE 2.0. ... > I have a group of web services which provide a facade for a COM+ ... The only clients of the web services will be ASP.NET ... > What I would like to have is an authentication web service that would ...
    (microsoft.public.dotnet.framework.webservices.enhancements)
  • Re: Windows Authentication, Single sign on and Active Directory
    ... Co-author of "The .NET Developer's Guide to Directory Services Programming" ... your web server is probably a workgroup mode machine. ... web service proxy client fails to connect due to authentication failure ... Windows authentication on the web services. ...
    (microsoft.public.dotnet.framework.aspnet.security)