How can I use authentication with Web Services?

From a security standpoint, web services have similar issues as any interactive Web site. However, a Web service may not have interactive users connecting and entering their security credentials. Instead, your "users" may be applications.

Web services will need to accept user credentials in some manner. If the service is non-interactive, it will need to either obtain the security token of the caller, or it will need to expose the appropriate methods to allow credentials to be supplied.

You can provide a "login" method- the login method would return some sort of authentication token (similar to a session token with traditional ASP.NET), and the client would then return that token to you when a Web Service was accessed. They could also provide their authentication information with each use (username and password, for example).

Using the login method and authentication token as an example, the token might be passed into a protected Web Service through either a SOAP Header or as an input parameter to the Web Service method itself.

In short here are some possible Custom authentication solutions for Web services:

• Accept a user name and password as a parameter to your method calls.
• Provide a login method that must be called before any other calls to other methods. You can use the cookie functionality of the Microsoft .NET Framework to verify calls have been made to the logon method.
• Use the SOAP header or SOAP body to store the credentials.
• Create a custom HTTP header or body to store the credentials.

Back

 

Advertisement

Free Magazine