wse vs "windows integrated"

[yonido]

hello,

i would like to implement a secure web service based on the active
directory, without using HTTPS / SSL, using the Kerberos mechanism.

As documentation mentions - Checking "Windows Integrated" & attaching
CredentialCache.DefaultCredentails to the web service will suffice
(will use the kerberos mechanism).

On the other hand, lots of articles mentions that i must use WSE2.0 and
MANUALLY add the token.
examples:
- http://www.codeproject.com/cs/webservices/SecurityTokens.asp
- http://www.15seconds.com/issue/040602.htm

is "Windows Integrated" enough?

thanks.

 

[Henning Krause [MVP]]

Hello,

WSE is transport independent, so you can build Web Services via raw TCP or
even SMTP if you like. In this case you must attach the Kerberos token
yourself. .NET Web Services (.ASMX files) hosted by the IIS rely on the HTTP
protocol instead. In this case, Kerberos authentication is done on the HTTP
Level, and not on the SOAP level, so using
CredentialCache.DefaultCredentials is sufficient.

Greetings,
Henning Krause