How to pass a password to a network service
- From: "ssg31415926" <newsjunkmail@xxxxxxxxx>
- Date: 6 Sep 2005 04:25:58 -0700
I administer a Server 2003/XP network. A developer has come to me with
a proposal to put in a web service-based application. The workstations
will be XP and the servers 2003 but he can't use Integrated Windows
authentication with the logged-on account because some of the
workstations are shared and have a "department" account (with minimum
access*), so the user will be signing in to the application. They all
have Windows accounts which he wants to pass to the web service so that
it can authenticate the user.
My concern is network security. He's looking at using
System.Net.NetworkCredential to pass the account. I dabble in .NET
myself so I had a look at MSDN. The example code starts with this:
NetworkCredential myCred = new NetworkCredential(
SecurelyStoredUserName, SecurelyStoredPassword,
SecurelyStoredDomain);
but I can't find how the strings are stored securely. Am I right in
thinking that if you put plain text strings in here, that they'd be
passed in plain text across the network? How do you avoid the security
risk? Is SSL the only route? Or am I barking up the wrong tree?
* Yes, I know this is a bad idea but these users don't have time to log
on and off each time they use the shared workstations so we came to
this locked-down workstation compromise.
.
- Follow-Ups:
- RE: How to pass a password to a network service
- From: Prakash M
- Re: How to pass a password to a network service
- From: Ollie Riches
- RE: How to pass a password to a network service
- Prev by Date: Re: RequestElementName is being changed
- Next by Date: RE: DIME - Alive or Dead?
- Previous by thread: RequestElementName is being changed
- Next by thread: Re: How to pass a password to a network service
- Index(es):
Relevant Pages
|
