Web Service Security

[Ron Vecchi]

Can someone point me in the right direction to securing soap messages to a
webservice. I have found and read a lot about WS-Security but am having
trouble finding ways to implement it in code.

Thanks!

 

[Joe H]

https + basic authentication not good enough?

 

[DalePres]

If you have Kalani's 70-320 study guide available, read chapter 11. It has
a great section that really simplifies the discussion of using
Windows.Principal and demand security. Demand security works great for web
services.

Dale

 

[[MSFT]]

Hi Ron,

You may consider WSE 2.0 with your web service. It supports WS-Security:

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnwse/html/
programwse2.asp

Luke
Microsoft Online Support

Get Secure! www.microsoft.com/security
(This posting is provided "AS IS", with no warranties, and confers no
rights.)

 

[Ron Vecchi]

Thanks all,

 

[Gerald Brose]

Can someone point me in the right direction to securing soap messages to a
webservice. I have found and read a lot about WS-Security but am having
trouble finding ways to implement it in code.

If you don't want to code to a security API such as WSE 2.0 and
thus hard-code the security loic and policy into your application,
then a better way is to use a security gateway aka XML firewall,
such as Xtradyne's Web Services DBC (WS-DBC).

The WS-DBC sits in the path of the messages and performs authen-
tication, authorization, transport security, auditing, and
content inspection (XPath filters, XML schema validation, virus
scanning of SOAP attachments). It supports security standards such
as WS-Security, SAML, XACML, XML encryption and digital signature,
etc. Policies are centrally managed using a powerful GUI, rather
than hard-wired in the code. Due to its excellent performance,
scalability and high-availability feature it is especially
suitable for enterprise settings.

Regards, Gerald.

 

[Ron Vecchi]

Interesting, Thanks

If you don't want to code to a security API such as WSE 2.0 and
thus hard-code the security loic and policy into your application,
then a better way is to use a security gateway aka XML firewall,
such as Xtradyne's Web Services DBC (WS-DBC).

The WS-DBC sits in the path of the messages and performs authen-
tication, authorization, transport security, auditing, and
content inspection (XPath filters, XML schema validation, virus
scanning of SOAP attachments). It supports security standards such
as WS-Security, SAML, XACML, XML encryption and digital signature,
etc. Policies are centrally managed using a powerful GUI, rather
than hard-wired in the code. Due to its excellent performance,
scalability and high-availability feature it is especially
suitable for enterprise settings.

Regards, Gerald.
--
Dr. Gerald Brose mailto:[email protected]
Xtradyne Technologies http://www.xtradyne.com
Schoenhauser Allee 6-7, Phone: +49-30-440 306-27
D-10119 Berlin, Germany Fax : +49-30-440 306-78