Testing Routine for WSE 2.0 -- dotnet web services enhancements

dotnet web services enhancements : Testing Routine for WSE 2.0

Microsoft
9/26/2005 12:00:00 AM

Hi All,

I have almost completed the first stage of our security upgrades for our web
services. So far I have implemented Authentication, Authorization, Signing &
Encryption from client to server. The first 2 of these I can test very
simple. However, I am uncertain how to test the latter 2 subjects (short of
becoming a fulltime hacker who can intercept the SOAP message and change
it!).

Does anyone have any proven methods for testing the integrity of the
messages?

As background, I am using UsernameToken object as my SecurityToken model; I
have implemented my own UsernameTokenManager that assigns Roles to the
authenticated token.

Many thanks,

Chris

William Stacey [MVP]
9/26/2005 2:37:12 PM

I would first question the use of UsernameTokens. How are you sending the
password (hash, none, clear). I would tend to favor SCTs over UT if
security is important.

--
William Stacey [MVP]

[quoted text, click to view]

Chris Arnold
9/26/2005 6:41:43 PM

BTW, I'm not from Microsoft - I was just a little lazy with the setting up
of this newsgroup :)

William Stacey [MVP]
9/27/2005 10:37:52 AM

The only thing is send hashed is easy to dictionary attack off the wire -
especially if users have simple passwords. If they have totally random 6-10
char passwords, then propabably ok. However, as your talkin about security
upgrades, I would use SCTs instead of UTs. Even MS recommends not using UTs
unless they protected with a secure channel or security token such as an
SCT.

--
William Stacey [MVP]

[quoted text, click to view]

Chris Arnold
9/27/2005 11:37:54 AM

I am using UTs with passwords sent Hashed. I am happy with the model that I
have constructed for this part of the process.

[quoted text, click to view]

Got something to say? Click here to post a reply to this thread.

Don't see what you're looking for? Try a search.

View other messages about dotnet web services enhancements

home · blog · groups

Questions? Comments? Contact the dn