Click here to Skip to main content
13,193,590 members (48,935 online)
Click here to Skip to main content
Add your own
alternative version


56 bookmarked
Posted 19 Sep 2005

Web Services Security using Username and Kerberos Tokens

, 19 Sep 2005
Rate this:
Please Sign up or sign in to vote.
This project shows a simple implementation of Username and Kerberos Tokens in Web Services using C# (Microsoft Visual Studio 2003 using WSE 2.0).


The following article deals with the implementation of security in Web Services. It briefs about how to make Web Services allow only those requests which have been validated for user name or binary tokens. The following article shows how to create such a service and how to invoke such a service. The platform used for development is Windows XP. Username tokens can be validated against built-in accounts. But for the implementation of Kerberos tokens, the machine needs to belong to a domain and should have the logged-in user listed in the Active Directory. The Kerberos key Distribution Center (KDC) issues tickets on validation.

Using the code

  1. Make sure you have Microsoft Web Services Enhancements (WSE) 2.0 installed.
  2. Create a blank solution.
  3. Add two C# projects to the blank solution.
    • ASP.NET Web Service (C#). Name it "service".
    • Windows Application (C#). Name it "client".
  4. Enable WSE on both the projects. This can be done by right clicking on the projects and clicking on WSE 2.0 Settings.
    • Make sure that the ASP.NET service has both the WSE enhancements and the SOAP Extensions enabled.
    • The client only needs to have WSE enabled.
  5. There are two parts in the project:
    • UserName Token
    • Kerberos Token
  6. Creating the service that will accept a UserName or a Kerberos Token and after validating will execute the WebMethod.

The code

  1. Namespaces used:
    using Microsoft.Web.Services2;
    using Microsoft.Web.Services2.Security;
    using Microsoft.Web.Services2.Security.Tokens;
  2. A method ValidateToken() is called before actually executing the web method.
    public long perform(long a,long b)
        //check whether the request is from a valid source or not.
        if (ValidateToken())
            return a+b;
            return long.MinValue;
  3. Extracting and verifying the token from the SOAP context:

    Copy all the elements from the SOAP context into a collection.

    //The Security elements are extracted from
    // the SOAP context and stored in a collection
    SecurityElementCollection e = 

    Now iterate through the elements to find the message signature.

    //The collection containing the SOAP Context 
    //is iterated through to get the message signature
    foreach( ISecurityElement secElement in e ) 

    Now find the MessageSignature if present in the SOAP context.

    //The collection containing the SOAP Context 
    //is iterated through to get the message signature
    foreach( ISecurityElement secElement in e ) 
        if( secElement is MessageSignature ) 

    Now check whether it is a Username token or a Kerberos token and do the needful if validated.

    SecurityToken sigTok = msgSig.SigningToken;
    //check whether the signature contains a username or a kerberos token
    if( sigTok is UsernameToken )
        //This checks against the BuiltIn Users
        return sigTok.Principal.IsInRole( @"BUILTIN\Users" );
    else if( sigTok is KerberosToken )
        //The logged in user is checked against
        //the Kerberos Key Distribution Center(KDC).
        return sigTok.Principal.Identity.IsAuthenticated;
  4. Creating the client.
    1. Namespaces used are:
      using Microsoft.Web.Services2.Security;
      using Microsoft.Web.Services2.Security.Tokens;
    2. Add a web proxy for the service that we just created.

    3. UserName Token -- the following code creates a UserName Token:
      //declare any Security Token
      SecurityToken token=null;
      switch (option)
          case "UserName":
                  //create a username Token.
                  UsernameToken unToken=new UsernameToken(textBox1.Text, 
                  //assign the any SecurityToken an Username Token.
              catch(Exception ex)
    4. Kerberos Token -- The following code creates a Kerberos Token:
      case "Kerberos":
              //create a kerberos Token.
              KerberosToken kToken =
                new KerberosToken(System.Net.Dns.GetHostName() );
              //assign the any SecurityToken an Username Token.
          catch(Exception ex)
  5. Now check whether the security token could be obtained or not. If yes then we create a class from the proxy that has been generated and we add the token acquired to the RequestSoapContext of the call.
    if (token == null)
        throw new ApplicationException( "Unable to obtain security token." );
    // Create an instance of the web service proxy that has been generated.
    SecureServiceProxy.Service1Wse proxy = 
       new client.SecureServiceProxy.Service1Wse();
    //set the time to live to any value.
    proxy.RequestSoapContext.Security.Timestamp.TtlInSeconds = 60;
    // Add the SecurityToken to the SOAP Request Context.
    proxy.RequestSoapContext.Security.Tokens.Add( token );
    // Sign the SOAP message with a signatureobject.
                          MessageSignature( token ) );
  6. Finally call the service.
    // Create and Send the request
    long a=long.Parse(textLong1.Text);
    long b=long.Parse(textLong2.Text);
    //call the web service.
    long result=proxy.perform(a,b);
    //Display the result.
    MessageBox.Show(a + " + " + b + " = " + result.ToString());

Points of Interest

I had forgotten to add the Web Service Enhancements to the WSE 2.0 service and that ate a lot of my time.


This article has no explicit license attached to it but may contain usage terms in the article text or the download files themselves. If in doubt please contact the author via the discussion board below.

A list of licenses authors might use can be found here


About the Author

Abhishek Chatterjee
Web Developer
India India
Abhishek is working as part of the Web Services COE (Center of Excellence) for Infosys Technologies Ltd., a global IT consulting firm, and has substantial experience in publishing papers, presenting papers at conferences, and defining standards for SOA and Web services.

Abhishek Chatterjee 's Home Page

You may also be interested in...


Comments and Discussions

QuestionGetting Error Pin
giri_chandu6-Jan-16 16:47
membergiri_chandu6-Jan-16 16:47 
QuestionWCF Service Pin
Member 255600326-Apr-11 20:51
memberMember 255600326-Apr-11 20:51 
QuestionWhere is ....Wse class ????? Pin
FKazi18-Feb-10 0:24
memberFKazi18-Feb-10 0:24 
GeneralUsing Windows Login/Kerboros Authentication between client and server Pin
Aditya P Gupta25-Nov-07 23:01
memberAditya P Gupta25-Nov-07 23:01 
QuestionEXception while executing USerName Token Pin
Abhishek Chatterjee30-May-07 14:29
memberAbhishek Chatterjee30-May-07 14:29 
AnswerRe: EXception while executing USerName Token Pin
Abhishek Chatterjee30-May-07 14:31
memberAbhishek Chatterjee30-May-07 14:31 
Generalserver without IIS Pin
frohwein27-Mar-07 10:48
memberfrohwein27-Mar-07 10:48 
GeneralRe: server without IIS Pin
Abhishek Chatterjee27-Mar-07 17:38
memberAbhishek Chatterjee27-Mar-07 17:38 
QuestionWSE 3.0 Pin
Bernhard Hofmann26-Mar-07 22:54
memberBernhard Hofmann26-Mar-07 22:54 
AnswerRe: WSE 3.0 Pin
Abhishek Chatterjee26-Mar-07 23:01
memberAbhishek Chatterjee26-Mar-07 23:01 
GeneralRe: WSE 3.0 Pin
Bernhard Hofmann27-Mar-07 1:20
memberBernhard Hofmann27-Mar-07 1:20 
GeneralRe: WSE 3.0 Pin
Abhishek Chatterjee27-Mar-07 17:36
memberAbhishek Chatterjee27-Mar-07 17:36 
QuestionI get an error... Pin
sroche16-Oct-06 6:54
membersroche16-Oct-06 6:54 
AnswerRe: I get an error... [modified] Pin
Abhishek Chatterjee16-Oct-06 17:31
memberAbhishek Chatterjee16-Oct-06 17:31 
QuestionHow to setup the Kerberos Key Distribution Center(KDC)? Pin
bbgal14-Feb-06 0:54
memberbbgal14-Feb-06 0:54 
GeneralValidating against a database Pin
eeehhh27-Sep-05 3:02
membereeehhh27-Sep-05 3:02 
GeneralRe: Validating against a database Pin
Abhishek Chatterjee27-Sep-05 3:27
memberAbhishek Chatterjee27-Sep-05 3:27 
GeneralGreat Article! Pin
Andries Olivier26-Sep-05 21:18
memberAndries Olivier26-Sep-05 21:18 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.

Permalink | Advertise | Privacy | Terms of Use | Mobile
Web02 | 2.8.171018.2 | Last Updated 19 Sep 2005
Article Copyright 2005 by Abhishek Chatterjee
Everything else Copyright © CodeProject, 1999-2017
Layout: fixed | fluid