I'm looking for a nudge in the right direction.

We have an order processing system that currently has a simple ASP.NET web
interface. Various clients who want to place orders already have a userID
and password specified within our application (i.e., not Windows
authentication) that they must supply in order to logon to their 'account'
and submit orders for themselves. They communicate from a browser over the
public internet. The browsers/server utilize SSL for encrypting the web
traffic.

We'd now like to implement this functionality as a web service to interact
with some desktop applications that can generate orders. We'd like to have
the remote app simply transfer the data, presumably in an XML format that we
already have defined, over the public internet, providing their userID and
password.

My question is: if we just add the userID and password in the XML
schema/data, is the SSL layer sufficient to ensure that anyone who might
intercept the traffic en route would not be able to determine the UserID and
password? Once we have the XML data in our app, it would be a trivial matter
to determine if the data is coming from a source that had a legitimate,
active UserID and a valid password. And that's pretty much all we'd need.

I read about WSE, WS-Security, etc. and it all seems like so much overkill
for my needs -- but I can't locate a single, simple scenario that looks like
what I have in mind here.

Any direction would be greatly appreciated!

Rob Schripsema
DeWaard and Jones Company
Bellingham, WA