0

I built a webservice using WCF and decided to use message security(wshttpbinding) with custom authentication( my own database) and X.509 certificate. I want to know how does client call a webservice using SOAP message in order to authenticate and use my service. I want to know what should I have to add in soap header section in order to call to my service because I have to call this webservice from Non-WCF client.

any helps would be appreciated

regards

Apichart Thanomkiet
  • 148
  • 4
  • 17

1 Answers1

1

It depends on the way how you want to use the certificate. You can use message or transport security where transport means HTTPS and it is highly interoperable and message means WS-Security where your clients usually needs to use some special API (manually implementing WS-Security and related protocols is huge task). So it mainly depends on the type of Non-WCF client. There are many APIs for Java or C++ and some for PHP but I'm not aware of any API providing WS-Security features for Android, iOS or Windows Mobile.

User name and password can be also transported either in message or by transport headers. The former approach is usually achieved by standardized UserName Token profile which is only set of predefined SOAP headers (WCF will do this for you). There is nothing special about these headers so even Non-WCF clients without WS-Security API should be able to easily consume the service. The later approach is usually achieved by Basic HTTP authentication and together with HTTPS it can be the most interoperable solution (but there can be some challenges on WCF site if you host the service in IIS and you don't want to use Windows accounts for authentication).

Community
  • 1
  • 1
Ladislav Mrnka
  • 360,892
  • 59
  • 660
  • 670
  • Thanks for your quick answer. I used message security with username and password and X509 certificate as I already mentioned in the question but I am asking how to write for example Soap client calling webservice using HTTP Request in C#? – Apichart Thanomkiet Sep 12 '11 at 09:18
  • It will be really hard - you must correctly use XML encryption and XML signing (both has separate namespaces with supporting classes in .NET), you must correctly include tokens and format SOAP envelope. You are going to reimplement big part of WCF. – Ladislav Mrnka Sep 12 '11 at 10:23