Hi,

Im setting up a win32 based client/server aplication in C#. (Not a
webservice)

The server (a pc) must perfrom an action when the client (pc or pocket
pc device) sends it a message via TCP/IP communication.

Because of company policy I can not use IIS. So I must do my own user
authentication to ensure the server is comunicating with a genuine
client.

I setup a server side remoting object to act as a comunications
channel, The object is a kinda message queue. Clients enque to it,
server dequeues from it.

The clients use Activator.GetObject to hook up with the server and send
messages to the sso(server side object).

The server monitors the sso and when a command is available it deques
it and performs the command it dequeues.

My question is how can I secure this so that only a client with correct
username/password can create messages which will be acepted by the
server. The idea is that each message has some challange response setup
so that people can't impersonate the client.

The message also needs to be securly authenticated so that the server
can recognise if the message it recived was altered in any way since it
left the client.

Every article I read says use IIS, but I'm not allowed to .... I tried
to find a C# implementation of kerberos v5 or something but no luck.

I could set up my own challange response system using tokens, hashing,
salt ect, but I feel that it would be much better to adopt a tried and
tested solution.

Any pointers or  sugestions?