Re: WSE 3.0 cert question

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

Hi Jeff,

Since you are using SSL (Https), the username token will be encrypted
without any additional configuration. When you use SSL, the entire messages
are encrypted using the certificate configured in the server, you only have
to configure the client application and service application to use the
turn-key scenario "UsernameOverTransportSecurity".

Regards,
Pablo Cibraro
http://weblogs.asp.net/cibrax


"jeff" <jeffr76@xxxxxxxxx> wrote in message
news:uqFo8chxGHA.2264@xxxxxxxxxxxxxxxxxxxxxxx
Hello all
so i have a web-service that will be ran over SSL and it has a custom
UsernameToken that can validate my users with a db now i would like to
encrypt this UsernameToken so using an X509 cert sounds like the logical
action. now management doesn't not want anything installed on the clients
boxes (click-once install only) so making the client install a cert into
there computer is not an option(if i can do the install via click once
that might work) anyway the web service will be over SSL so i should have
access to the public key of the web server. how would i go about getting
the public key from the web server and using that to encrypt the
UsernameToken or if any has better idea or suggestions i would be happy to
hear
thanks
jeff


.

Relevant Pages

  • Re: WSE 3.0 + UserNameToken without X.509 Cert/Kerberos + Signing + Encryption How?
    ... message security and thefore it does not encrypt the message. ... You need to combine this assertion with a secure transport like SSL if you ... between client and server using a UserNameToken that passes the UserName ...
    (microsoft.public.dotnet.framework.webservices.enhancements)
  • Re: SSL question
    ... It has some methods which are accessible by some client applications. ... I have developed this web service with the use of SSL in my head, ... > SSL will encrypt this information. ...
    (microsoft.public.inetserver.iis.security)
  • Re: WSE 2.0 SP2: UsernameTokens must be encrypted to request SCT?
    ... William Stacey, MVP ... > The SecurityTokenServiceClient class will now automatically encrypt any ... > Username tokens included in a request. ...
    (microsoft.public.dotnet.framework.webservices.enhancements)
  • Re: Encrypt a UsernameToken Authenticated WSE Response
    ... username and passwort und the data is symmetric encrypted, ... >> Decrypt) a SOAP Message by Using a Username and Password". ... But when I start my Client Application and call my ... >>> so that is used to generate a key to encrypt with. ...
    (microsoft.public.dotnet.framework.webservices.enhancements)
  • Password security
    ... choosing relies on AES ecryption, where the password is converted to a ... key, and the key is used to encrypt a text, which is compared to see if ... The user name is written in the section of the most signifigant bits ... however, depending on the size of the username and password, these 2 ...
    (sci.crypt)