WS-Security vs. IIS authentication

[Morten Overgaard]

Hi Sirs.

When using WS-Security instead of IIS authentication I see a potential
problem letting ALL people access my webService. ie. if I have a little bug
in the code that checks for validity of the user I'm really exposing
my-self.

If using IIS authentication I'm sure that only IIS authenticated users are
allowed access to my webService. So doesen't WS-Security and IIS security
come hand in hand or am I missing something here.?


Regards Morten

 

[Pete Wood]

A good point. I think the difference is that WS-Security merely provides
the "framework" for performing authorisation, the **actual** check (eg.
UsenameToken) is done somewhere else - against an LDAP, IIS - so you do have
to assume that you use your LDAP API etc correctly so as not to expose your
entire enterprise - but that is true for any security policy. WS-Security
merely provides a standard way of exposing which ever way you have chosen to
implement security.

I hope that helps...
http://www.webserviceshelp.org/wsh/Overview+of+WS-Security.htm