How to secure a webservice - could some expert advise?

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

Hi everybody,

Here is the scenario: webservice and a windows client application.

Requirements:
1. Only authenticated and authorized users shall be able to call web
methods.
2. User names or passwords shall never be sent over http.

Constraints:
3. Webservice cannot use Windows or LDAP authentication - users and their
passwords are stored in a SQL database.
4. The use of x.509 certificates is not an option - too expensive,
distribution impractical. Does this eliminate WSE? Perhaps, but this level
of security is NOT necessary.

Note: although that would be nice, communication does NOT have to be
encrypted. When really need, meaning when I have to start transmitting
credit card numbers etc, this perhaps could be accomplished using https.

Again, the solution does NOT have to be absolutely secure - it only has to
be "good enough".

I, of course, have some solutions in mind, but I would appreciate if some
expert who has REAL experience in implementing similar solutions could
provide advice or share some thoughts.

Thank you,

Tomasz


.

Relevant Pages

  • Re: File Upload Web Service
    ... As for the "a web service can accept http get and post, not just SOAP/XML." ... The HTTP POST /GET or SMTP are the actual transport protocal the webservice ... as for implementing authentication mechanism ...
    (microsoft.public.dotnet.framework.aspnet)
  • How to secure a webservice - could some expert advise?
    ... webservice running on IIS with .Net Framework 2.0 and ... a windows client application. ... User names or passwords shall never be sent over http. ... Webservice cannot use Windows or LDAP authentication - users and their ...
    (microsoft.public.dotnet.framework.aspnet.webservices)
  • Call Web Service using proxy and http authentication
    ... I am trying to call a webservice which requires an http ... authentication. ... I must pass from a proxy http. ...
    (comp.lang.python)
  • Re: HTTP Statuscode 401 (unauthorized) when accessing secured webservice
    ... The 3rd party webservice is hosted on linux. ... Using the CredentialCache to specify basic authentication didn't help. ... you can use CredentialCache class to construct client credentials and specify authenticaiton type. ... We welcome your comments and suggestions about how we can improve the support we provide to you. ...
    (microsoft.public.dotnet.framework.webservices)
  • RE: HTTP Statuscode 401 (unauthorized) when accessing secured webservice
    ... \par From your description, you're encountering some problem when accessing an external/3rdparty webservice in your .net application, the error is specific to security authentication, correct? ... \par ** that's the external webservice's authenticatino mode(integrated windows or basic authentication) or whether it is hosted on IIS server ot not? ... \par From: Anton ...
    (microsoft.public.dotnet.framework.webservices)