Re: authentication best practices

Yes, all are domain users while at work but they also work from home and
they need a similar behavior as using a web site through HTTPS. In other
words they don't want VPN in just to use this app.

Perry


"Dominick Baier [DevelopMentor]" <dbaier@xxxxxxxxxxxxxxxxxxxxxxxxxxxxx>
wrote in message news:4580be631978f18c80ce523b930fd@xxxxxxxxxxxxxxxxxxxxx
Do you have a Windows domain and are your clients domain users?

---------------------------------------
Dominick Baier - DevelopMentor
http://www.leastprivilege.com

I have a "click-once" windows forms application distributed to many
clients.
This app uses web services behind the scenes to populate sensitive
company
data. I want to make this application behave similarly to a web
application
in the following ways:
1. User needs to authenticate before use
2. There needs to be a time out similar to web forms
3. Some method to see if user is still authenticated before each web
service
request
What is the best approach from a security stand point to accomplish
this with a web service? Is there some token that gets passed between
requests? If so how do I know when such a token expires? Do I generate
such token or is there some built in process for this?

Thanks
Perry




.

Relevant Pages

  • Re: authentication best practices
    ... Do you have a Windows domain and are your clients domain users? ... This app uses web services behind the scenes to populate sensitive ... User needs to authenticate before use ...
    (microsoft.public.dotnet.security)
  • authentication best practices
    ... User needs to authenticate before use ... Some method to see if user is still authenticated before each web service ...
    (microsoft.public.dotnet.security)
  • Re: Need to share data asynchronously between ASP.NET and Legacy S
    ... Otherise I would use the client side async web sevice stuff to some ... > would get the results of a specific request based on the request ... >> callbacks to communicate back to clients. ... >> very nicely and is fully based on Web Services and is transport agnostic. ...
    (microsoft.public.dotnet.distributed_apps)
  • Re: simple mock web service
    ... not able to find the end of the request - and I don't have any control over what the request might be. ... What it is is that there are many client components, each wrapped in a JUnit test; but the real web services are live, and contain data which anyone can alter. ... The urls to the web services are soft, and so as the tests run during the build, the clients are pointed at the mock web services. ...
    (comp.lang.java.help)
  • The underlying connection was closed - Remoting.Channels.Http.HttpClientTransportSink
    ... My problem _is_ with the webservices and with ... Web Services Client: ... >closed: The request was c ... >>the problem I use remoting and not webservie. ...
    (microsoft.public.dotnet.framework)