XML Web Service Authentication

[John.Arthur]

Hi,

I need to build Web Service that allows me to create some methods that
are not public and other that are public. I need something like logging
to the Web Service with username and password. Only successfully logged
uses can use some of the methods.

Any ideas?

Thanks

 

[Brock Allen]

Use SoapHeaders to pass the credentials form the client to the server. Check
for them in your implementation. Log all access. Deny those who are not allowed.
Here are some docs on using them in your server code:

http://msdn.microsoft.com/library/d.../en-us/cpguide/html/cpconUsingSOAPHeaders.asp

 

[John.Arthur]

Thank you fir the answer Brock.

I was reading about the session object in the Web Services, is it a
good idea if I put something in the Web Service Session and if it does
not exist that means the use is not logged.

 

[Brock Allen]

No, don't use the Session object in WebServices as it's a hack. It replies
upon cookies and an out of band (outside of WSDL) agreement with the client
to use them. It also ties you to HTTP. Use the header I mentioned and require
the credentials on every request.