Securing a web service

[Paul]

Hi.

Whats the best practice to secure a webserivce, basically I have already
secured the webservice with XHEO however I need the webservice to only talk
to a specific caller.

 

[Jan Tielens]

You could use HTTPS and SSL for this. You'll need a certificate for your
client and your server, so they'll be sure they are talking to eachother.

--
Greetz

Jan Tielens
________________________________
Read my weblog: http://weblogs.asp.net/jan

 

[Gerald Brose]

Whats the best practice to secure a webserivce, basically I have already
secured the webservice with XHEO however I need the webservice to only talk
to a specific caller.

The best (=most secure) approach to securing Web Services is
by using an appplication-level firewall between the SOAP
sender and the service, i.e. using a SOAP gateway such as
Xtradyne's Web Services Domain Boundary Controller (WS-DBC).

The big advantage of such a gateway is that your code remains
free of any security checks because security is provided at
the SOAP protocol level rather than the API level.

<commercial>
In addition to the 4As (AuthN, AuthZ with RBAC, Audit,
centralized Admin) it offers advanced content inspection
features (filtering) and XML security features such as SAML,
XML DSig. Services can be securely exposed by importing WSDL
and managing policies in a GUI. Details can be found at
http://www.xtradyne.de/products/ws-dbc/ws-dbc.htm
</commercial>

Regards, Gerald Brose.