Groups | Blog | Home
all groups > asp.net webservices > january 2007 >

asp.net webservices : Web Services and SSL


AndyBrew
1/30/2007 8:48:01 AM
Hi

We are currently embarking upon a project to develop a suite of web services
to allow the integration of a PDA application with our data server. Our
current thoughts are to setup an SSL certificate on the server and use a
custom username/password authentication mechanism for authentication.

I have reviewed the MSDN documentation with regards security etc. but
haven't found many practical examples, so my questions are: -

1. Do we need to do anything different with regards the development of the
web service to support SSL or does it just work.

2. Are there any good links to documents I have missed?

Thanks in advance

Mariano Omar Rodriguez
1/30/2007 8:00:26 PM
You don't need to do anything diferent in development to publish a Web
Service in SSL.

You can use WSE 3 with UserNameToken assertion to validate the username and
password http://msdn2.microsoft.com/en-us/library/aa480575.aspx

[quoted text, click to view]
WishMaster
1/30/2007 8:28:43 PM
On Jan 31, 10:00 am, "Mariano Omar Rodriguez" <mrodr...@yahoo.com>
[quoted text, click to view]

Hi Andy:

For SSL you don't need to do anything.
For Username and Pwd, you can use SOAP Headers Authentication in your
web service.
Have a look at http://aspalliance.com/805

Cheers,
Amer
MCSD.Net
ITIL Certified
AndyBrew
2/1/2007 5:53:01 AM
Hi Guys

Many thanks for that, a further question what is the benefit of using the
SOAP header method against passing through your own username/password/pin
number combination in the method signature???

Can SOAP header authentication handle a pin number as well as username and
password?

Many thanks

WishMaster
2/1/2007 1:14:30 PM
On Feb 2, 12:53 am, AndyBrew <AndyB...@discussions.microsoft.com>
[quoted text, click to view]

Andy,

I haven't try but use username and pwd only but technically it is
possible because as you can see at (http://aspalliance.com/805) your
class AuthSoapHd is inherited from SoapHeader and you can specify the
fields whatever you want.

....
....
public class AuthSoapHd: SoapHeader
{
public string strUserName;
public string strPassword;
}
.....

you can have like...
public class AuthSoapHd: SoapHeader
{
public string strPIN;
}
....

I thnik should work.

Cheers,
Amer
WishMaster
2/1/2007 1:21:15 PM
On Feb 2, 12:53 am, AndyBrew <AndyB...@discussions.microsoft.com>
[quoted text, click to view]

Hi Andy, Sorry forgot ur fist question, I would say it is a standard
to implement security and right use of protocal.
on the top of that it a one of SOA security pattern.

If you want to go advance or try some more options please see WSE 3.0
and X.509 at
http://msdn2.microsoft.com/en-us/library/aa480581.aspx

Cheers,
Amer
AddThis Social Bookmark Button