The following article deals with the implementation of security in Web Services. It briefs about how to make Web Services allow only those requests which have been validated for user name or binary tokens. The following article shows how to create such a service and how to invoke such a service. The platform used for development is Windows XP. Username tokens can be validated against built-in accounts. But for the implementation of Kerberos tokens, the machine needs to belong to a domain and should have the logged-in user listed in the Active Directory. The Kerberos key Distribution Center (KDC) issues tickets on validation.
using Microsoft.Web.Services2;
using Microsoft.Web.Services2.Security;
using Microsoft.Web.Services2.Security.Tokens;
ValidateToken() is called before actually executing the web method. [WebMethod]
public long perform(long a,long b)
{
//check whether the request is from a valid source or not.
if (ValidateToken())
return a+b;
else
return long.MinValue;
}
Copy all the elements from the SOAP context into a collection.
//The Security elements are extracted from
// the SOAP context and stored in a collection
SecurityElementCollection e =
RequestSoapContext.Current.Security.Elements;
Now iterate through the elements to find the message signature.
//The collection containing the SOAP Context
//is iterated through to get the message signature
foreach( ISecurityElement secElement in e )
{
Now find the MessageSignature if present in the SOAP context.
//The collection containing the SOAP Context
//is iterated through to get the message signature
foreach( ISecurityElement secElement in e )
{
if( secElement is MessageSignature )
{
Now check whether it is a Username token or a Kerberos token and do the needful if validated.
SecurityToken sigTok = msgSig.SigningToken;
//check whether the signature contains a username or a kerberos token
if( sigTok is UsernameToken )
{
//This checks against the BuiltIn Users
return sigTok.Principal.IsInRole( @"BUILTIN\Users" );
}
else if( sigTok is KerberosToken )
{
//The logged in user is checked against
//the Kerberos Key Distribution Center(KDC).
return sigTok.Principal.Identity.IsAuthenticated;
}
using Microsoft.Web.Services2.Security;
using Microsoft.Web.Services2.Security.Tokens;
//declare any Security Token
SecurityToken token=null;
switch (option)
{
case "UserName":
{
try
{
//create a username Token.
UsernameToken unToken=new UsernameToken(textBox1.Text,
textBox2.Text,PasswordOption.SendPlainText);
//assign the any SecurityToken an Username Token.
token=unToken;
}
catch(Exception ex)
{
MessageBox.Show(ex.Message);
return;
}
break;
}
case "Kerberos":
{
try
{
//create a kerberos Token.
KerberosToken kToken =
new KerberosToken(System.Net.Dns.GetHostName() );
//assign the any SecurityToken an Username Token.
token=kToken;
}
catch(Exception ex)
{
MessageBox.Show(ex.Message);
return;
}
break;
}RequestSoapContext of the call. if (token == null)
throw new ApplicationException( "Unable to obtain security token." );
// Create an instance of the web service proxy that has been generated.
SecureServiceProxy.Service1Wse proxy =
new client.SecureServiceProxy.Service1Wse();
//set the time to live to any value.
proxy.RequestSoapContext.Security.Timestamp.TtlInSeconds = 60;
// Add the SecurityToken to the SOAP Request Context.
proxy.RequestSoapContext.Security.Tokens.Add( token );
// Sign the SOAP message with a signatureobject.
proxy.RequestSoapContext.Security.Elements.Add(new
MessageSignature( token ) );
// Create and Send the request
long a=long.Parse(textLong1.Text);
long b=long.Parse(textLong2.Text);
//call the web service.
long result=proxy.perform(a,b);
//Display the result.
MessageBox.Show(a + " + " + b + " = " + result.ToString());I had forgotten to add the Web Service Enhancements to the WSE 2.0 service and that ate a lot of my time.
| You must Sign In to use this message board. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
