Hi,

I would like some advice on the best option to take for securing my web
services. My situation is this. I have a number of services which will be
called by domain users. I must be able to authenticate them in the default
way (using windows authentication I guess) OR using LDAP depending on the
particular implementation. It is also essential that I have access to the
authenticated users details (i.e. username) inside the service once
validation has been achieved by whatever method.  

My guess is that I should use a username token. But I have a couple of
problems with this. Firstly, if the client (a web site) uses windows
authentication how can my code get access to the password in order to create
the username token? Secondly, it seems to be a requirement of this technique
to send the password in clear text. How can this be a good idea?

Given these difficulties with username token, would I be better off with
kerberos or kerberos2? In this case, would I still be able to authenticate
using LDAP? Also would this impose any restrictions on the operating system
of the domain controller?

Sorry of any of these questions are naive or unlcear, but I really want to
get the right solution rather than just the first one I can get to work.

Thanks.

Julian Jelfs.