Web Service and ASP.NET Forms Authentication

[Henrik Skak Pedersen]

Hi,

Is it possible to use ASP.NET Forms Authentication in Web Services? or
should I use WSE 3.0 UserNameTokens?

I have to call the web service from a Web App, a Windows App and a
SmartPhone app.

Thanks

Henrik Skak Pedersen

 

[Dominick Baier [DevelopMentor]]

Hi Henrik,

FormsAuth relies on cookies - this is very unnatural for web services - you
would have to create a login method, the client needs a cookie container
(bit of a problem for asp.net) etc...

Well - you could use WSE3 username tokens with SSL or basic authentication
with SSL (which are both very similar)

basic auth would be against windows accounts only unless you implement your
own basic auth module that authenticates against a custom user store.
WSE3 has the concept of UsernameTokenManagers where you can implement custom
authentication but has to be installed on every client

HTH

 

[Henrik Skak Pedersen]

Hi Dominick,

Again, thank you for your reply

Ok, so FormsAuth is out, the same is WSE because it is not supported on the
Compact Framework. All my users are custom users and not Windows accounts,
so that leaves me with implementing my own basic auth module. Do you have
any examples of how to do that?

I guess that is supported on all three platforms?

Thanks
henrik.

 

[Henrik Skak Pedersen]

Hi Dominick,

I just got a link in a reply from the Compact Framework forum, which is a
discussion similar to mine:
http://forums.microsoft.com/MSDN/ShowPost.aspx?PostID=325044&SiteID=1

I think that I will go for this solution:
http://www.code-magazine.com/articleprint.aspx?quickid=0307071&printmode=true

Again thank you for your reply.

Cheers Henrik

 

[Dominick Baier [DevelopMentor]]

for which solution??

I personally would go for basic auth over SSL with a custom basic auth module
in ASP.NET - i can help you implement that...

 

[Henrik Skak Pedersen]

I was thinking of implementing a solution like the guy in this example:
http://www.code-magazine.com/articleprint.aspx?quickid=0307071&printmode=true

he is creating a custom SOAP header containing a user name and a password.
Try to take a look at the SecureCalculator class.

But I you think that your idea is better I would really appreciate your
help.

Cheers
Henrik.

for which solution??

I personally would go for basic auth over SSL with a custom basic auth
module in ASP.NET - i can help you implement that...

---------------------------------------
Dominick Baier - DevelopMentor
http://www.leastprivilege.com

Hi Dominick,

I just got a link in a reply from the Compact Framework forum, which
is a discussion similar to mine:
http://forums.microsoft.com/MSDN/ShowPost.aspx?PostID=325044&SiteID=1

I think that I will go for this solution:
http://www.code-magazine.com/articleprint.aspx?quickid=0307071&printmo
de=true
Again thank you for your reply.

Cheers Henrik

Hi Dominick,

Again, thank you for your reply

Ok, so FormsAuth is out, the same is WSE because it is not supported
on the Compact Framework. All my users are custom users and not
Windows accounts, so that leaves me with implementing my own basic
auth module. Do you have any examples of how to do that?

I guess that is supported on all three platforms?

Thanks
henrik.
"Dominick Baier [DevelopMentor]"

Hi Henrik,
FormsAuth relies on cookies - this is very unnatural for web
services -
you would have to create a login method, the client needs a cookie
container (bit of a problem for asp.net) etc...
Well - you could use WSE3 username tokens with SSL or basic
authentication with SSL (which are both very similar)

basic auth would be against windows accounts only unless you
implement
your own basic auth module that authenticates against a custom user
store.
WSE3 has the concept of UsernameTokenManagers where you can
implement
custom authentication but has to be installed on every client
HTH

---------------------------------------
Dominick Baier - DevelopMentor
http://www.leastprivilege.com
Hi,

Is it possible to use ASP.NET Forms Authentication in Web Services?
or should I use WSE 3.0 UserNameTokens?

I have to call the web service from a Web App, a Windows App and a
SmartPhone app.

Thanks

Henrik Skak Pedersen

 

[Dominick Baier [DevelopMentor]]

mail me...

---------------------------------------
Dominick Baier - DevelopMentor
http://www.leastprivilege.com

I was thinking of implementing a solution like the guy in this
example:
http://www.code-magazine.com/articleprint.aspx?quickid=0307071&printmo
de=true

he is creating a custom SOAP header containing a user name and a
password. Try to take a look at the SecureCalculator class.

But I you think that your idea is better I would really appreciate
your help.

Cheers
Henrik.

for which solution??

I personally would go for basic auth over SSL with a custom basic
auth module in ASP.NET - i can help you implement that...

---------------------------------------
Dominick Baier - DevelopMentor
http://www.leastprivilege.com

Hi Dominick,

I just got a link in a reply from the Compact Framework forum, which
is a discussion similar to mine:
http://forums.microsoft.com/MSDN/ShowPost.aspx?PostID=325044&SiteID=
1

I think that I will go for this solution:
http://www.code-magazine.com/articleprint.aspx?quickid=0307071&print
mo
de=true
Again thank you for your reply.
Cheers Henrik
Hi Dominick,

Again, thank you for your reply

Ok, so FormsAuth is out, the same is WSE because it is not
supported on the Compact Framework. All my users are custom users
and not Windows accounts, so that leaves me with implementing my
own basic auth module. Do you have any examples of how to do that?

I guess that is supported on all three platforms?

Thanks
henrik.
"Dominick Baier [DevelopMentor]"
Hi Henrik,
FormsAuth relies on cookies - this is very unnatural for web
services -
you would have to create a login method, the client needs a cookie
container (bit of a problem for asp.net) etc...
Well - you could use WSE3 username tokens with SSL or basic
authentication with SSL (which are both very similar)
basic auth would be against windows accounts only unless you
implement
your own basic auth module that authenticates against a custom
user
store.
WSE3 has the concept of UsernameTokenManagers where you can
implement
custom authentication but has to be installed on every client
HTH
---------------------------------------
Dominick Baier - DevelopMentor
http://www.leastprivilege.com
Hi,

Is it possible to use ASP.NET Forms Authentication in Web
Services? or should I use WSE 3.0 UserNameTokens?

I have to call the web service from a Web App, a Windows App and
a SmartPhone app.

Thanks

Henrik Skak Pedersen