Customize authentication and authorization using SOAP Headers in Web Services

Use the SOAP header to customize authentication and authorization

Windows authentication is very suitable for the Intranet solution. In this case, you verify the identity of users in your own domain. However, on the internet, you may need to perform custom authentication and authorization on the SQL database. In this case, you should pass custom creden。 (such as usernames and passwords) to the service and allow the Service to handle authentication and authorization.

An easy way to pass additional information together with the request to the XML Web Service is through the SOAP header. Therefore, you need to defineSoapheaderThen declare the public fields of the service as this type. This is made public in the public contract of the Service and can be used by the client when a proxy is created from webserviceutil.exe, as shown in the following example:

Using System. Web. Services;
Using System. Web. Services. Protocols;

// Authheader class extends from soapheader
Public   Class Authheader: soapheader {
Public StringUsername;
Public StringPassword;
}

Public   Class Headerservice: WebService {
PublicAuthheader sheader;

}

EachWebmethodAll can be usedSoapheaderCustom Attributes define a set of associated headers. By default, headers are required, but optional headers can also be defined.SoapheaderAttribute specifies the name of a public field orClientOrServerClass attributes (calledHeadersAttribute ). Before calling a method for the input header,WebServiceSetHeadersAttribute value. When the method returns an output header,WebServiceSearch for this value. For more information about the output or optional headers, see. NET Framework SDK documentation.

[Webmethod (Description = " This method requires a custom SOAP header set by the caller " )]
[Soapheader ( " Sheader " )]
Public   String Securemethod () {

If (Sheader =   Null )
Return   " Error: Please supply Credentials " ;
Else
Return   " User: "   + Sheader. Username;

}

Then, the client directly sets the header on the proxy class before calling the method that requires the header, as shown in the following example:

 

Headerservice H =   New Headerservice ();
Authheader myheader =   New Authheader ();
Myheader. Username =   " Johndoe " ;
Myheader. Password =   " Password " ;
H. authheader = Myheader;
String result = H. securemethod ();

 

See http://chs.gotdotnet.com/quickstart/aspplus/doc/secureservices.aspx