It seems that we are talking about and referring to things that are worlds
apart ;-)

What you just described has nothing to do with Web Services at all. What you
are referring to are just web server and network security settings.

Hi Sumaira,

You can place all resumes in one directory on the server and protect it using Basic Authentication. This way the files will not be accessible by URL. In the web service you can check who has access to which files and take an appropriate action.

Regards,

Martin Kulov
www.codeattest.com

Another thing you could do is to make the web service and the web server
run under different identities, and then protect the directory using simple
file security settings at the directory level.

Hope this helps

Dan Rogers
Microsoft Corporation
--------------------
From: sumaira.ahmad@gmail.com (Sumaira Ahmad)
Newsgroups: microsoft.public.dotnet.framework.webservices.enhancements
Subject: Re: Securing files stored in virtual directory
Date: 1 Dec 2004 08:42:11 -0800
Organization: http://groups.google.com
Lines: 38
Message-ID: <1627c5ae.0412010842.46e65876@posting.google.com>
References: <1627c5ae.0412010001.ce6c0a0@posting.google.com>
<O6Yi6p51EHA.2788@TK2MSFTNGP15.phx.gbl>
NNTP-Posting-Host: 67.169.120.54
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 8bit
X-Trace: posting.google.com 1101919331 21448 127.0.0.1 (1 Dec 2004 16:42:11
GMT)
X-Complaints-To: groups-abuse@google.com
NNTP-Posting-Date: Wed, 1 Dec 2004 16:42:11 +0000 (UTC)
Path:
cpmsftngxa10.phx.gbl!TK2MSFTNGXA01.phx.gbl!TK2MSFTNGP08.phx.gbl!news-out.cwi
x.com!newsfeed.cwix.com!border1.nntp.dca.giganews.com!nntp.giganews.com!news
.glorb.com!postnews.google.com!not-for-mail
Xref: cpmsftngxa10.phx.gbl
microsoft.public.dotnet.framework.webservices.enhancements:4970
X-Tomcat-NG: microsoft.public.dotnet.framework.webservices.enhancements

Thanks for your reply..But can u tell me that if I have files stored
in the virtual directory of my Web Server is there anyway of securing
those files so that they cannot be viewed from the browser.. For
instance if I am storing Job Appplicants resumes on the Web Server in
its virtual direcrtory I do not want anybody else to view it except
the Employer who has posted the job.
but if i just give the entire path in the browser I am able to view
those files which I basically want to secure..Any idea??
Please let me know..
Thanks,
Sumaira

Hi Sumaria,

Rather than save them as files, you may want to save them as BLOB's in a
database, key them, and then retrieve a list of keys based on the
Employer's request.  Then create a new web method, perhaps called something
like "Fetch" and have that look up the key passed, pull back the BLOB and
attach that blob to the response using DIME/Soap attachments.

This would solve the HTTP access issue nicely and eliminate the inevitable
day when your web server falls over because its disk is full.

I hope this helps

Dan Rogers
Microsoft Corporation

--------------------
From: sumaira.ahmad@gmail.com (Sumaira Ahmad)
Newsgroups: microsoft.public.dotnet.framework.webservices.enhancements
Subject: Re: Securing files stored in virtual directory
Date: 2 Dec 2004 10:06:41 -0800
Organization: http://groups.google.com
Lines: 57
Message-ID: <1627c5ae.0412021006.2d95c58d@posting.google.com>
References: <1627c5ae.0412010001.ce6c0a0@posting.google.com>
<OFW#SK61EHA.3392@TK2MSFTNGP10.phx.gbl>
NNTP-Posting-Host: 67.169.120.54
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 8bit
X-Trace: posting.google.com 1102010801 23520 127.0.0.1 (2 Dec 2004 18:06:41
GMT)
X-Complaints-To: groups-abuse@google.com
NNTP-Posting-Date: Thu, 2 Dec 2004 18:06:41 +0000 (UTC)
Path:
cpmsftngxa10.phx.gbl!TK2MSFTNGXA03.phx.gbl!TK2MSFTNGP08.phx.gbl!newsfeed00.s
ul.t-online.de!t-online.de!news.glorb.com!postnews.google.com!not-for-mail
Xref: cpmsftngxa10.phx.gbl
microsoft.public.dotnet.framework.webservices.enhancements:4992
X-Tomcat-NG: microsoft.public.dotnet.framework.webservices.enhancements

Hi Thank you so much for all your responses.. I am really very new to
.NET and to WSE and it is taking me time to understand how to
understand your replies.:-)..

Let me explain my scenario a little bit more..
I was implementing WS Secure conversation in an ASP.NET Application.
I have anonynous access to the Web Service and in each method I check
to see if the user has a valid security context token, and if yes he
is allowed access to the web service.
As a part of my project, i am storing Resumes of job applicants in the
virtual directory of the web service running IIS. Within the
application I am checking that if the Employer is authenticated and is
authorized then he will be showed links to all the resumes such as
http://localhost/Service/resume1.pdf.
Later I realized that this link can be viewed directory from the
browser too and that disturbed me..(little that I know of web services
and WSE and ASP.NET).. All my users are authenticated against ADAM and
authentication is checked in the CustomUsernameTokenManager..

Now can someone please how can I avoid this issue.If I try and resolve
it the way told, I fear it may disrupt my application.. or maybe
not..I am not sure..
Please tell me how to go about it..I sincerely request help, and a
little detailed response to a newbie will be highly appreciated.
I appreciate the time that you'll have already put in it and hope for
some more to resolve this issue..which maybe really very minor and
stupid for you'll..

Thanks,

Sumaira Ahmad

Martin Kulov <kulov@bezbokluk.abv.bg> wrote in message
news:<OFW#SK61EHA.3392@TK2MSFTNGP10.phx.gbl>...

release of WSE. You can either wait for it or implement your own way of
securing the attachements.

b7445