all groups > dotnet web services > november 2006 >
You're in the

dotnet web services

group:

securing a web service: options?



securing a web service: options? KJ
11/30/2006 8:34:10 AM
dotnet web services: Hello All,

I have to secure my first real B2B web service. Could you please
provide some guidance as to which method of security I should use. One
caveat is that we will not be using SSL on the server side as per the
networking department. Windows authentication is also probably not an
option, as this web service will be interacting between two separately
located companies. I have read a little bit about passing credentials
in SOAP headers, but the MSDN documentation seems to be sparse on this
topic. Any suggestions and/or links would be appreciated. Also, if you
could point me to the docs on web services sessions, that would be
helpful too. Thanks.

p.s. This is a Visual Studio 2005 Web Site
Re: securing a web service: options? Pablo Cibraro [MVP]
11/30/2006 4:40:50 PM
Hi,

Take a look to the Web Services Security Guide (Microsoft Patterns &
Practices), http://msdn2.microsoft.com/en-us/library/aa480545.aspx
It is best place to go regarding security for web services.

Regards,
Pablo Cibraro.


[quoted text, click to view]

Re: securing a web service: options? Pablo Cibraro [MVP]
11/30/2006 4:40:50 PM
Hi,

Take a look to the Web Services Security Guide (Microsoft Patterns &
Practices), http://msdn2.microsoft.com/en-us/library/aa480545.aspx
It is best place to go regarding security for web services.

Regards,
Pablo Cibraro.


[quoted text, click to view]

Re: securing a web service: options? KJ
12/1/2006 7:07:44 AM
Hi Pablo, the documentation is quite dense. Could you possibly give me
an offhand recomendation for a simple way to secure a web service
between two businesses?

[quoted text, click to view]
Re: securing a web service: options? Pablo Cibraro [MVP]
12/5/2006 12:00:00 AM
Hi,

You basically have two options, transport security (Securing the message at
transport level) or message security (Adding security metadata to the soap
message).
You can find a summary here,
http://weblogs.asp.net/cibrax/archive/2006/08/23/Securing-web-services.aspx

Thanks
Pablo Cibraro.

[quoted text, click to view]

AddThis Social Bookmark Button