Web Method Level Security

Thread view:

Enable EMail Alerts

Start New Thread

Thread rating:

John Jenkins - 19 Feb 2005 17:37 GMT

Hi,
I have a web service that has ten web methods associated with it. It
uses WSE2.0 implementation. I have a custom usernametoken manager. I want to
restrict which users use which method, without using WS-Policy (unless it is
simple to use). Any help greatly appreciated.

many thanks.

Reply to this Message

William Stacey [MVP] - 19 Feb 2005 21:48 GMT

Are you using a custom user database or AD? Either way, you would want to
verify via group membership.

Signature

William Stacey, MVP
http://mvp.support.microsoft.com

> Hi,
> I have a web service that has ten web methods associated with it. It
[quoted text clipped - 3 lines]
>
> many thanks.

Reply to this Message

Ronnie - 21 Feb 2005 16:20 GMT

WS-Policy is easy to use if you are going to be restricting access to
the methods based on roles/groups. Of course in your UsernameToken
manager you will need to create a GenericPrincipal and attach it to
your UsernameToken, but this is very simple.

Reply to this Message

John Bristowe - 23 Feb 2005 17:25 GMT

John,

I would recommend using the WSE Security Settings Tool (in the Configuration
Editor) to construct a policy document. It will allow you to specify
role-based authorization for services.

John

> Hi,
> I have a web service that has ten web methods associated with it. It
[quoted text clipped - 5 lines]
>
> many thanks.

Reply to this Message

Sidd - 16 Mar 2005 18:41 GMT

Hi John,

Have you received the answer to this question, or are you still
struggling with this scenario?

Thanks,

Sidd [MSFT]

> Hi,
> I have a web service that has ten web methods associated with it. It
[quoted text clipped - 3 lines]
>
> many thanks.

Reply to this Message

Web Method Level Security

Free Magazines