Hi,
I am sending username and pwd in usernametoken in SendHashed format,
While in web service, i am getting Nothing in that UsernameToken's
Password.
If send it as SendPlainText, then in my web service, i get a hashed pwd.
Why this is So?
How to get Hashed pwd stored in UsernamToken in web service?
My web service code is,
Try
If IsNothing(ctxt) Then
Throw New ApplicationException("Only SOAP requests are
permitted."
End If
flg = False
For Each tkn In RequestSoapContext.Current.Security.Tokens
If TypeOf tkn Is UsernameToken Then
Dim user As UsernameToken = CType(tkn, UsernameToken)
Dim pwd As String =
FormsAuthentication.HashPasswordForStoringInConfigFile("Admin1", "SHA1")
If user.Password = pwd Then
flg = True
Return "Hello " & user.Username
End If
End If
Next
If flg = False Then
Return "Hello Liar"
End If
Catch ex As SoapException
Throw ex
Catch ex As Exception
Throw ex
End Try
Hernan de Lahitte - 05 Jul 2005 01:05 GMT
You can find the password hash in the user.PasswordHash property as a byte
array.
Notice that this value won't be the value that you set on the client in the
Password property.
It will actually be the SHA1(created+password+once) of that value called a
one-time hash value.
In your web service you should implement a custom UsernameTokenManager that
derives from that class an overrride the AuthenticateToken method where you
should return the same value that you put on the password property at the
client side. The base class will recalculate the hash for the returned
password and verify against the value sent by the client.

Signature
Hernan de Lahitte
http://clariusconsulting.net/hdl
> Hi,
>
[quoted text clipped - 40 lines]
>
> *** Sent via Developersdex http://www.developersdex.com ***
William Stacey [MVP] - 05 Jul 2005 15:42 GMT
Before settling on hashed pwds, you may want to take a look at:
http://spaces.msn.com/members/staceyw/Blog/cns!1pnsZpX0fPvDxLKC6rAAhLsQ!178.entry
Myself, I would use SCTs instead.

Signature
William Stacey [MVP]
> Hi,
>
[quoted text clipped - 40 lines]
>
> *** Sent via Developersdex http://www.developersdex.com ***