Click here to Skip to main content
Click here to Skip to main content

Web Services Security using Username and Kerberos Tokens

, 19 Sep 2005
Rate this:
Please Sign up or sign in to vote.
This project shows a simple implementation of Username and Kerberos Tokens in Web Services using C# (Microsoft Visual Studio 2003 using WSE 2.0).

Introduction

The following article deals with the implementation of security in Web Services. It briefs about how to make Web Services allow only those requests which have been validated for user name or binary tokens. The following article shows how to create such a service and how to invoke such a service. The platform used for development is Windows XP. Username tokens can be validated against built-in accounts. But for the implementation of Kerberos tokens, the machine needs to belong to a domain and should have the logged-in user listed in the Active Directory. The Kerberos key Distribution Center (KDC) issues tickets on validation.

Using the code

  1. Make sure you have Microsoft Web Services Enhancements (WSE) 2.0 installed.
  2. Create a blank solution.
  3. Add two C# projects to the blank solution.
    • ASP.NET Web Service (C#). Name it "service".
    • Windows Application (C#). Name it "client".
  4. Enable WSE on both the projects. This can be done by right clicking on the projects and clicking on WSE 2.0 Settings.
    • Make sure that the ASP.NET service has both the WSE enhancements and the SOAP Extensions enabled.
    • The client only needs to have WSE enabled.
  5. There are two parts in the project:
    • UserName Token
    • Kerberos Token
  6. Creating the service that will accept a UserName or a Kerberos Token and after validating will execute the WebMethod.

The code

  1. Namespaces used:
    using Microsoft.Web.Services2;
    using Microsoft.Web.Services2.Security;
    using Microsoft.Web.Services2.Security.Tokens;
  2. A method ValidateToken() is called before actually executing the web method.
    [WebMethod]
    public long perform(long a,long b)
    {
        //check whether the request is from a valid source or not.
        if (ValidateToken())
            return a+b;
        else
            return long.MinValue;
    }
  3. Extracting and verifying the token from the SOAP context:

    Copy all the elements from the SOAP context into a collection.

    //The Security elements are extracted from
    // the SOAP context and stored in a collection
    SecurityElementCollection e = 
       RequestSoapContext.Current.Security.Elements;

    Now iterate through the elements to find the message signature.

    //The collection containing the SOAP Context 
    //is iterated through to get the message signature
    foreach( ISecurityElement secElement in e ) 
    {

    Now find the MessageSignature if present in the SOAP context.

    //The collection containing the SOAP Context 
    //is iterated through to get the message signature
    foreach( ISecurityElement secElement in e ) 
    { 
        if( secElement is MessageSignature ) 
        {

    Now check whether it is a Username token or a Kerberos token and do the needful if validated.

            SecurityToken sigTok = msgSig.SigningToken; 
            //check whether the signature contains a username or a kerberos token
            if( sigTok is UsernameToken ) 
            {
                //This checks against the BuiltIn Users
                return sigTok.Principal.IsInRole( @"BUILTIN\Users" );
            }
            else if( sigTok is KerberosToken )
            {
                //The logged in user is checked against 
                //the Kerberos Key Distribution Center(KDC).
                return sigTok.Principal.Identity.IsAuthenticated;
            }
  4. Creating the client.
    1. Namespaces used are:
      using Microsoft.Web.Services2.Security;
      using Microsoft.Web.Services2.Security.Tokens;
    2. Add a web proxy for the service that we just created.

    3. UserName Token -- the following code creates a UserName Token:
      //declare any Security Token
      SecurityToken token=null;
      switch (option)
      {
          case "UserName":
          {
              try
              {
                  //create a username Token.
                  UsernameToken unToken=new UsernameToken(textBox1.Text, 
                            textBox2.Text,PasswordOption.SendPlainText);
                  //assign the any SecurityToken an Username Token.
                  token=unToken;
              }
              catch(Exception ex)
              {
                  MessageBox.Show(ex.Message);
                  return;
              }
              break;
          }
    4. Kerberos Token -- The following code creates a Kerberos Token:
          case "Kerberos":
          {
              try
              {
                  //create a kerberos Token.
                  KerberosToken kToken = 
                    new KerberosToken(System.Net.Dns.GetHostName() );
                  //assign the any SecurityToken an Username Token.
                  token=kToken;
              }
              catch(Exception ex)
              {
                  MessageBox.Show(ex.Message);
                  return;
              }
              break;
          }
  5. Now check whether the security token could be obtained or not. If yes then we create a class from the proxy that has been generated and we add the token acquired to the RequestSoapContext of the call.
    if (token == null)
        throw new ApplicationException( "Unable to obtain security token." );
    
    // Create an instance of the web service proxy that has been generated.
    SecureServiceProxy.Service1Wse proxy = 
       new client.SecureServiceProxy.Service1Wse();
    
    //set the time to live to any value.
    proxy.RequestSoapContext.Security.Timestamp.TtlInSeconds = 60;
    
    
    // Add the SecurityToken to the SOAP Request Context.
    proxy.RequestSoapContext.Security.Tokens.Add( token );
    
    // Sign the SOAP message with a signatureobject.
    proxy.RequestSoapContext.Security.Elements.Add(new 
                          MessageSignature( token ) );
  6. Finally call the service.
    // Create and Send the request
    long a=long.Parse(textLong1.Text);
    long b=long.Parse(textLong2.Text);
    //call the web service.
    long result=proxy.perform(a,b);
    //Display the result.
    MessageBox.Show(a + " + " + b + " = " + result.ToString());

Points of Interest

I had forgotten to add the Web Service Enhancements to the WSE 2.0 service and that ate a lot of my time.

License

This article has no explicit license attached to it but may contain usage terms in the article text or the download files themselves. If in doubt please contact the author via the discussion board below.

A list of licenses authors might use can be found here

About the Author

Abhishek Chatterjee
Web Developer
India India
Abhishek is working as part of the Web Services COE (Center of Excellence) for Infosys Technologies Ltd., a global IT consulting firm, and has substantial experience in publishing papers, presenting papers at conferences, and defining standards for SOA and Web services.
 
Abhishek Chatterjee 's Home Page

Comments and Discussions

 
QuestionWCF Service PinmemberMember 255600326-Apr-11 20:51 
QuestionWhere is ....Wse class ????? PinmemberFKazi18-Feb-10 0:24 
GeneralUsing Windows Login/Kerboros Authentication between client and server PinmemberAditya P Gupta25-Nov-07 23:01 
QuestionEXception while executing USerName Token PinmemberAbhishek Chatterjee30-May-07 14:29 
AnswerRe: EXception while executing USerName Token PinmemberAbhishek Chatterjee30-May-07 14:31 
Generalserver without IIS Pinmemberfrohwein27-Mar-07 10:48 
GeneralRe: server without IIS PinmemberAbhishek Chatterjee27-Mar-07 17:38 
QuestionWSE 3.0 PinmemberBernhard Hofmann26-Mar-07 22:54 
AnswerRe: WSE 3.0 PinmemberAbhishek Chatterjee26-Mar-07 23:01 
GeneralRe: WSE 3.0 PinmemberBernhard Hofmann27-Mar-07 1:20 
GeneralRe: WSE 3.0 PinmemberAbhishek Chatterjee27-Mar-07 17:36 
QuestionI get an error... Pinmembersroche16-Oct-06 6:54 
AnswerRe: I get an error... [modified] PinmemberAbhishek Chatterjee16-Oct-06 17:31 
QuestionHow to setup the Kerberos Key Distribution Center(KDC)? Pinmemberbbgal14-Feb-06 0:54 
GeneralValidating against a database Pinmembereeehhh27-Sep-05 3:02 
GeneralRe: Validating against a database PinmemberAbhishek Chatterjee27-Sep-05 3:27 
GeneralGreat Article! PinmemberAndries Olivier26-Sep-05 21:18 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.

| Advertise | Privacy | Mobile
Web02 | 2.8.140709.1 | Last Updated 19 Sep 2005
Article Copyright 2005 by Abhishek Chatterjee
Everything else Copyright © CodeProject, 1999-2014
Terms of Service
Layout: fixed | fluid