Improving Web Application Security: Threats and - CGISecurity

Chapter 12: Building Secure Web Services 333To call a Web service configured for Integrated Windows authentication, theconsumer must explicitly configure the Credentials property on the proxy.To flow the security context of the client’s Windows security context (either from animpersonating thread token or process token) to a Web service you can set theCredentials property of the Web service proxy toCredentialCache.DefaultCredentials as follows.proxy.Credentials = System.Net.CredentialCache.DefaultCredentials;You can also use an explicit set of credentials as follows:CredentialCache cache = new CredentialCache();cache.Add( new Uri(proxy.Url), // Web service URL"Negotiate",// Kerberos or NTLMnew NetworkCredential(userName, password, domain));proxy.Credentials = cache;If you need to specify explicit credentials, do not hard code them or store them inplaintext. Encrypt account credentials by using DPAPI and store the encrypted dataeither in an element in Web.config or beneath a restricted registry key.For more information about platform level authentication, see the “Web ServicesSecurity” section in “Microsoft patterns & practices Volume I, Building SecureASP.NET Applications: Authentication, Authorization, and Secure Communication” athttp://msdn.microsoft.com/library/en-us/dnnetsec/html/secnetlpMSDN.asp?frame=true.Message Level AuthenticationYou can use WSE to implement a message level authentication solution thatconforms to the emerging WS-Security standard. This approach allows you topass authentication tokens in a standard way by using SOAP headers.Note When two parties agree to use WS-Security, the precise format of the authentication tokenmust also be agreed upon.The following types of authentication token can be used and are supported by WSE:●●●●User name and passwordKerberos ticketX.509 certificateCustom token