SoapClient authentication

Thread view:

Enable EMail Alerts

Start New Thread

Thread rating:

LucasC - 29 Sep 2005 22:48 GMT

Hi,
I'm trying to use WSE through a Proxy class generated with WseWsdl2 in order
to be independent from the transport protocol. My service is implemented
through a ASP.Net Web Service (with WSE).
I'm trying to authenticate users (like I used to do with Intergrated
Security in IIS and Network Credentials in the client for the standard Web
Services).
Is there any way to do that? Ijust want to allow only Windows authenticated
users to use my service but without loosing the flexibility of the trsnaport
protocol independence.

Thanks a lot

Signature

LucasC

Reply to this Message

Pablo Cibraro - 30 Sep 2005 14:36 GMT

Hi Lucas,
The answer is yes. First all, your service must derive from SoapService in
order to make it independent from the transport protocol as well.
Regarding to the authentication question, you can do that using an
UsernameToken as client token.
The default UsernameTokenManager shipped in WSE authenticates user against a
valid windows account (Using the API "LogonUser" ),
so in that case it works as Windows authentication.

Regards,
Pablo Cibraro
www.lagash.com

> Hi,
> I'm trying to use WSE through a Proxy class generated with WseWsdl2 in
[quoted text clipped - 11 lines]
>
> Thanks a lot

Reply to this Message

LucasC - 30 Sep 2005 16:06 GMT

Hi Pablo,
Thanks for the answer. I have some doubts about that.
My application doesn't know the username and password (everything works with
Integrated Security) so I don't have the password to create the
UserNameToken. Is there any way to use it without requesting the user
password to the user?

If I derive my service from SoapService, is it possible to implement it as
ASMX (standard Web Service)? or Do I have to make mayor changes?

Thanks a lot.

Signature

LucasC

> Hi Lucas,
> The answer is yes. First all, your service must derive from SoapService in
[quoted text clipped - 24 lines]
> >
> > Thanks a lot

Reply to this Message

Pablo Cibraro - 30 Sep 2005 17:25 GMT

Hi Lucas,
If you don't have the password, you might create a usernametoken without a
password. (You will have to implement a custom UsernameTokenManager to
accept tokens without a password)
In that case, to avoid "non-repudiation" attacks, you will need to encrypt
and sign the message with a X509 Cert and only accept messages protected
with that certificate.
Yes, it's possible to publish a SoapService as an ASMX , you will have to
configure it as a HttpHandler.

Regards,
Pablo Cibraro
www.lagash.com

> Hi Pablo,
> Thanks for the answer. I have some doubts about that.
[quoted text clipped - 41 lines]
>> >
>> > Thanks a lot

Reply to this Message

LucasC - 30 Sep 2005 20:03 GMT

Hi Pablo,
Is there any way to use something like Intergrated Security in the same way
you set default Network Credentials?
Thanks a lot

Signature

LucasC

> Hi Lucas,
> If you don't have the password, you might create a usernametoken without a
[quoted text clipped - 55 lines]
> >> >
> >> > Thanks a lot

Reply to this Message

Pablo Cibraro - 03 Oct 2005 01:20 GMT

Sorry Lucas,
I forgot to mention something, you can use a kerberos token instead (The
current user's credentials will flow to the server).
It will work as Integrated Security in that way.

Regards,
Pablo.

> Hi Pablo,
> Is there any way to use something like Intergrated Security in the same
[quoted text clipped - 67 lines]
>> >> >
>> >> > Thanks a lot

Reply to this Message

SoapClient authentication

Free Magazines