Click here to Skip to main content
15,870,297 members
Articles / Web Development / ASP.NET
Article

Web Services Security using Username and Kerberos Tokens

Rate me:
Please Sign up or sign in to vote.
4.58/5 (9 votes)
19 Sep 20052 min read 149.6K   2K   56   21
This project shows a simple implementation of Username and Kerberos Tokens in Web Services using C# (Microsoft Visual Studio 2003 using WSE 2.0).

Image 1

Introduction

The following article deals with the implementation of security in Web Services. It briefs about how to make Web Services allow only those requests which have been validated for user name or binary tokens. The following article shows how to create such a service and how to invoke such a service. The platform used for development is Windows XP. Username tokens can be validated against built-in accounts. But for the implementation of Kerberos tokens, the machine needs to belong to a domain and should have the logged-in user listed in the Active Directory. The Kerberos key Distribution Center (KDC) issues tickets on validation.

Using the code

  1. Make sure you have Microsoft Web Services Enhancements (WSE) 2.0 installed.
  2. Create a blank solution.
  3. Add two C# projects to the blank solution.
    • ASP.NET Web Service (C#). Name it "service".
    • Windows Application (C#). Name it "client".
  4. Enable WSE on both the projects. This can be done by right clicking on the projects and clicking on WSE 2.0 Settings.
    • Make sure that the ASP.NET service has both the WSE enhancements and the SOAP Extensions enabled.
    • The client only needs to have WSE enabled.
  5. There are two parts in the project:
    • UserName Token
    • Kerberos Token
  6. Creating the service that will accept a UserName or a Kerberos Token and after validating will execute the WebMethod.

The code

  1. Namespaces used:
    C#
    using Microsoft.Web.Services2;
    using Microsoft.Web.Services2.Security;
    using Microsoft.Web.Services2.Security.Tokens;
  2. A method ValidateToken() is called before actually executing the web method.
    C#
    [WebMethod]
    public long perform(long a,long b)
    {
        //check whether the request is from a valid source or not.
        if (ValidateToken())
            return a+b;
        else
            return long.MinValue;
    }
  3. Extracting and verifying the token from the SOAP context:

    Copy all the elements from the SOAP context into a collection.

    C#
    //The Security elements are extracted from
    // the SOAP context and stored in a collection
    SecurityElementCollection e = 
       RequestSoapContext.Current.Security.Elements;

    Now iterate through the elements to find the message signature.

    C#
    //The collection containing the SOAP Context 
    //is iterated through to get the message signature
    foreach( ISecurityElement secElement in e ) 
    {

    Now find the MessageSignature if present in the SOAP context.

    C#
    //The collection containing the SOAP Context 
    //is iterated through to get the message signature
    foreach( ISecurityElement secElement in e ) 
    { 
        if( secElement is MessageSignature ) 
        {

    Now check whether it is a Username token or a Kerberos token and do the needful if validated.

    C#
    SecurityToken sigTok = msgSig.SigningToken;
    //check whether the signature contains a username or a kerberos token
    if( sigTok is UsernameToken )
    {
        //This checks against the BuiltIn Users
        return sigTok.Principal.IsInRole( @"BUILTIN\Users" );
    }
    else if( sigTok is KerberosToken )
    {
        //The logged in user is checked against
        //the Kerberos Key Distribution Center(KDC).
        return sigTok.Principal.Identity.IsAuthenticated;
    }
    
  4. Creating the client.
    1. Namespaces used are:
      C#
      using Microsoft.Web.Services2.Security;
      using Microsoft.Web.Services2.Security.Tokens;
    2. Add a web proxy for the service that we just created.

      Image 2

    3. UserName Token -- the following code creates a UserName Token:
      C#
      //declare any Security Token
      SecurityToken token=null;
      switch (option)
      {
          case "UserName":
          {
              try
              {
                  //create a username Token.
                  UsernameToken unToken=new UsernameToken(textBox1.Text, 
                            textBox2.Text,PasswordOption.SendPlainText);
                  //assign the any SecurityToken an Username Token.
                  token=unToken;
              }
              catch(Exception ex)
              {
                  MessageBox.Show(ex.Message);
                  return;
              }
              break;
          }
    4. Kerberos Token -- The following code creates a Kerberos Token:
      C#
      case "Kerberos":
      {
          try
          {
              //create a kerberos Token.
              KerberosToken kToken =
                new KerberosToken(System.Net.Dns.GetHostName() );
              //assign the any SecurityToken an Username Token.
              token=kToken;
          }
          catch(Exception ex)
          {
              MessageBox.Show(ex.Message);
              return;
          }
          break;
      }
      
  5. Now check whether the security token could be obtained or not. If yes then we create a class from the proxy that has been generated and we add the token acquired to the RequestSoapContext of the call.
    C#
    if (token == null)
        throw new ApplicationException( "Unable to obtain security token." );
    
    // Create an instance of the web service proxy that has been generated.
    SecureServiceProxy.Service1Wse proxy = 
       new client.SecureServiceProxy.Service1Wse();
    
    //set the time to live to any value.
    proxy.RequestSoapContext.Security.Timestamp.TtlInSeconds = 60;
    
    
    // Add the SecurityToken to the SOAP Request Context.
    proxy.RequestSoapContext.Security.Tokens.Add( token );
    
    // Sign the SOAP message with a signatureobject.
    proxy.RequestSoapContext.Security.Elements.Add(new 
                          MessageSignature( token ) );
  6. Finally call the service.
    C#
    // Create and Send the request
    long a=long.Parse(textLong1.Text);
    long b=long.Parse(textLong2.Text);
    //call the web service.
    long result=proxy.perform(a,b);
    //Display the result.
    MessageBox.Show(a + " + " + b + " = " + result.ToString());

Points of Interest

I had forgotten to add the Web Service Enhancements to the WSE 2.0 service and that ate a lot of my time.

License

This article has no explicit license attached to it but may contain usage terms in the article text or the download files themselves. If in doubt please contact the author via the discussion board below.

A list of licenses authors might use can be found here


Written By
Web Developer
India India
Abhishek is working as part of the Web Services COE (Center of Excellence) for Infosys Technologies Ltd., a global IT consulting firm, and has substantial experience in publishing papers, presenting papers at conferences, and defining standards for SOA and Web services.

Abhishek Chatterjee 's Home Page

Comments and Discussions

 
QuestionGetting Error Pin
giri_chandu6-Jan-16 16:47
giri_chandu6-Jan-16 16:47 
QuestionWCF Service Pin
Member 255600326-Apr-11 20:51
Member 255600326-Apr-11 20:51 
QuestionWhere is ....Wse class ????? Pin
K. Feroz18-Feb-10 0:24
K. Feroz18-Feb-10 0:24 
GeneralUsing Windows Login/Kerboros Authentication between client and server Pin
Aditya P Gupta25-Nov-07 23:01
Aditya P Gupta25-Nov-07 23:01 
QuestionEXception while executing USerName Token Pin
Abhishek Chatterjee30-May-07 14:29
Abhishek Chatterjee30-May-07 14:29 
AnswerRe: EXception while executing USerName Token Pin
Abhishek Chatterjee30-May-07 14:31
Abhishek Chatterjee30-May-07 14:31 
Generalserver without IIS Pin
frohwein27-Mar-07 10:48
frohwein27-Mar-07 10:48 
GeneralRe: server without IIS Pin
Abhishek Chatterjee27-Mar-07 17:38
Abhishek Chatterjee27-Mar-07 17:38 
QuestionWSE 3.0 Pin
Bernhard Hofmann26-Mar-07 22:54
Bernhard Hofmann26-Mar-07 22:54 
AnswerRe: WSE 3.0 Pin
Abhishek Chatterjee26-Mar-07 23:01
Abhishek Chatterjee26-Mar-07 23:01 
GeneralRe: WSE 3.0 Pin
Bernhard Hofmann27-Mar-07 1:20
Bernhard Hofmann27-Mar-07 1:20 
GeneralRe: WSE 3.0 Pin
Abhishek Chatterjee27-Mar-07 17:36
Abhishek Chatterjee27-Mar-07 17:36 
QuestionI get an error... Pin
sroche16-Oct-06 6:54
sroche16-Oct-06 6:54 
AnswerRe: I get an error... [modified] Pin
Abhishek Chatterjee16-Oct-06 17:31
Abhishek Chatterjee16-Oct-06 17:31 
QuestionHow to setup the Kerberos Key Distribution Center(KDC)? Pin
bbgal14-Feb-06 0:54
bbgal14-Feb-06 0:54 
GeneralValidating against a database Pin
Member 110423927-Sep-05 3:02
Member 110423927-Sep-05 3:02 
GeneralRe: Validating against a database Pin
Abhishek Chatterjee27-Sep-05 3:27
Abhishek Chatterjee27-Sep-05 3:27 
GeneralGreat Article! Pin
Andries Olivier26-Sep-05 21:18
professionalAndries Olivier26-Sep-05 21:18 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.