Web Services Authentication & Session Management

[Toby Riley]

Need some advice,

I have a GUI client and a web service that performs various functions. I
would be like to be able to log in a user once and create an authentication
ticket for that session.

Then every web method called would check the session has been authenticated
and the ticket is still valid otherwise you would get nothing - or an error.

Once the GUI is closed or user logs out the auth ticket is recinded and a
the session closed. (or time out after certain period of inactivity).

The way i do this at the moment is to authorise every method call and it
feels clumsy.

Any help appreciated.

Thanks

Toby

 

[John Bristowe]

Toby,

Take a look WS-SecureConversation [1] support in WSE v2.0 [2].

Cheers,

John
http://www.bristowe.com/

[1] http://msdn.microsoft.com/ws/2002/12/ws-secure-conversation/
[2]
http://www.microsoft.com/downloads/details.aspx?familyid=21fb9b9a-c5f6-4c95-87b7-fc7ab49b3edd

 

[Toby Riley]

Thanks but this is too new. Plus it clearly states The technology preview of
WSE 2.0 is unsupported and is not licensed for production use.

I believe i can get this done using session state and authentication tickets
but not sure how to go about this from a GUI client prospective.

Regards

Toby.

Toby,

Take a look WS-SecureConversation [1] support in WSE v2.0 [2].

Cheers,

John
http://www.bristowe.com/

[1] http://msdn.microsoft.com/ws/2002/12/ws-secure-conversation/
[2]
http://www.microsoft.com/downloads/details.aspx?familyid=21fb9b9a-c5f6-4c95-87b7-fc7ab49b3edd

Need some advice,

I have a GUI client and a web service that performs various functions. I
would be like to be able to log in a user once and create an authentication
ticket for that session.

Then every web method called would check the session has been authenticated
and the ticket is still valid otherwise you would get nothing - or an error.

Once the GUI is closed or user logs out the auth ticket is recinded and a
the session closed. (or time out after certain period of inactivity).

The way i do this at the moment is to authorise every method call and it
feels clumsy.

Any help appreciated.

Thanks

Toby

 

[Jacob Yang [MSFT]]

Hi Toby,

I have reviewed your issue. Due to the nature of your issue I need to do
additional research to determine the best way to provide assistance. I will
contact you as soon as possible.

Best regards,

Jacob Yang
Microsoft Online Partner Support
Get Secure! ¨C www.microsoft.com/security
This posting is provided "as is" with no warranties and confers no rights.

 

[John Bristowe]

Toby,

Thanks but this is too new.

I would be interested to hear why you feel this way. Are you referring to
the technology (i.e. WSE v2.0) or the specification (WS-SecureConversation)?

I believe i can get this done using session state and authentication tickets
but not sure how to go about this from a GUI client prospective.

Are you implying HTTP with session state? Have you considered the
possibility of using other transfer/transport protocols?

Cheers,

John
http://www.bristowe.com/

Thanks but this is too new. Plus it clearly states The technology preview of
WSE 2.0 is unsupported and is not licensed for production use.

I believe i can get this done using session state and authentication tickets
but not sure how to go about this from a GUI client prospective.

Regards

Toby.

Toby,

Take a look WS-SecureConversation [1] support in WSE v2.0 [2].

Cheers,

John
http://www.bristowe.com/

[1] http://msdn.microsoft.com/ws/2002/12/ws-secure-conversation/
[2]

http://www.microsoft.com/downloads/details.aspx?familyid=21fb9b9a-c5f6-4c95-87b7-fc7ab49b3edd and

a

 

[MSFT]

Hi Toby,

You may take a look at following article to see if it will help:

HOW TO: Use CookieContainer to Maintain a State in Web Services When You
Use Visual C# .NET
http://support.microsoft.com/default.aspx?scid=KB;EN-US;Q816637

Regards,

Luke
Microsoft Online Support

Get Secure! www.microsoft.com/security
(This posting is provided "AS IS", with no warranties, and confers no
rights.)

 

[Toby Riley]

Seems that this is web based. Does the CookieContainer work on a GUI

thks.

Toby.

 

[MSFT]

Yes, You can use it in a Windows appliaction project. The code in
Button1_Click and Button2_Click are most import.

Luke
Microsoft Online Support

Get Secure! www.microsoft.com/security
(This posting is provided "AS IS", with no warranties, and confers no
rights.)