What is the best way for authenticating web methods in a web service? Is it right having authentication for every web method and verify user name and password for each web method? Is there a way to authenticate just once not for every web method? something like using sessions and etc?
View 2 RepliesI'm using Asp.net c# language programming. What is the best way for authenticating web methods in a web service? Is it right having authentication for every web method and verify user name and password for each web method? Is there a way to authenticate just once not for every web method? something like using sessions and etc?
View 2 RepliesI am trying to implement webservice authentication using SOAP Header. how to provice single authentication which applied to all the methoads of webservice.
Example :
public class Service:System.Web.Services.WebService
{
public AuthSoapHd spAuthenticationHeader;
public Service()
[code]....
On this sample it has only one method and based on the username and password mataches it provides access. As like this there are plenty of web methoad's in my webservice and i don't want to check the username and password on all the methoads. instead i wanted to checkonce and provide access to all the methods.
I have an ASMX Web Service set up to use the HTTP GET method. Simple methods which take basic String and Int parameters are working ok, and I can call MyService.asmx/MethodName?Param=Value and get a response back in XML.
However, when I have a method which has a nullable Int (i.e. int?), I get this error:
< Method Name > Web Service method name is not valid.
The error message is confusing, as the method does exist, just not in the GET scope. I presume this is because a nullable type is too complex to be passed via the URL, but I can't find any documentation or SO posts on this.
I appreciate that complex types like Lists or custom classes etc will not work using GET, but I would have assumed that a simple nullable int or nullable datetime could be handled natively, simply by detecting whether it was omitted from the URL. Guess it's not that simple!
We have a customer who are using HP Web Inspect to test for vulnerabilities in our software.
The web inspect tool is complaining about about error messages being returned when a request such as the following is made [URL].
The ASP.Net framework returns a page with the following text content and a 500 status code.
System.IndexOutOfRangeException: Index was outside the bounds of the array.
[code]....
but the error seems not be an unhandled error and so neither 500 page is shown.
I have an asp.net app. It has a page that requires authentication. The authenticated user can view the page because he/she is authenticated. The page makes a jQuery Ajax call to a WCF service. The WCF service checks that the user is authenticated via HttpContext. I have a user that is using WinXP and IE8. This user can authenticate to the page, but when the Ajax call is made from the page to the wb service, the user recieves my "session not authenticated" message on the page, generated by the service and displayed on the page. When I use the same OS/browser combo, the page and service work just fine, as expected; no errors.
What option in this user's IE settings would cause this behavior?
I have an application that exposes a number of ASP.NET web services at an internet location. For security reasons, I want to be able to authenticate clients, and reject any that are not authorised. The authorised clients in question will be ASP.NET web applications,
but I do not have guaranteed access to their IIS configuration, nor to their local certificate stores, therefore the solution must not involve any of these items.
However, authorised clients, will always make calls to the web services using wrapper methods provided by an assembly that I
do have control over. My idea is to digitally sign that assembly, and use that signature as the basis for authenticating the client.For that to work, the assembly will need to be able to construct an X509Certificate object from itself, and to attach it to the call to the web service:
X509Certificate cert = X509Certificate.CreateFromSignedFile(Assembly.GetExecutingAssembly().Location);
_webService.ClientCertificates.Add(cert);
Then the web service must be able to compare the incoming request certificate to its own signing certificate to authenticate the client:
X509Certificate requestCert = new X509Certificate(Context.Request.ClientCertificate.Certificate);
X509Certificate signingCert = X509Certificate.CreateFromSignedFile(Assembly.GetExecutingAssembly().Location);[code]...
The documentation for the method doesn't help much, other than remarking that ASN.1 DER is the only certificate format supported by the method. if I am signing the assembly incorrectly, misunderstanding the method itself etc.? Or more generally if the approach I am taking will work or is flawed?
I have a web service set up on an IIS server. When I navigate to the page in a web browser it asks me for my user name an password, as desired. However I want to consume the service in a .NET application (C#). What do I need to do to provide a user name and password programmatically so that I can consume the service? Or is there some other way I should be authenticating a user?
View 1 RepliesI need to send a X.509 client certificate to a web service in byte array (not attached to request). Besides the certificate, the caller will also send data and signed data. From the web service I can verify if the signature is ok but I don't know what is required to verify that the certificate is ok. I have the client certificate issuer CA trusted in Server (where the web service runs).
More specifically, how can I verify if a X.509 certificate itself is valid? I need to do it in web service not from IIS.
how to authenticate a user using the central authentication service?
I created a login page to enter the user name etc. I have the server for the authentication.
I am having difficulty deploying a Silverlight 4 RIA services Web app to IIS 6 on Windows Server 2003. The application works fine when running on the development server. However, when deployed to a production server, all the Web service calls redirect to the login page.
Here are the details:
The site uses forms authentication. Login is via an ASP.NET Web page; the Silverlight application does not have its own version of the login page. Login is working correctly.
I was trying to overload two web methods by adding the MessagName descriptor.
[WebMethod(MessageName =
"GetFiles")]
public
[Code]....
But I am getting the following Server Error
Server Error in '/Test.Service' Application.
Service 'TestService' does not conform to WS-I Basic Profile v1.1. Please examine each of the normative statement violations below. To turn off conformance check set the ConformanceClaims property on corresponding WebServiceBinding attribute to WsiClaims.None.R2304: Operation name overloading in a wsdl:portType is disallowed by the Profile. A wsdl:portType in a DESCRIPTION MUST have operations with distinct values for their name attributes. Note that this requirement applies only to the wsdl:operations within a given wsdl:portType. A wsdl:portType may have wsdl:operations with names that are the same as those found in other wsdl:portTypes.
- Operation 'GetFiles' on portType 'TestServiceSoap' from namespace 'http://www.Test.com'.
Description:
An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.
Exception Details: System.InvalidOperationException: Service 'TestService' does not conform to WS-I Basic Profile v1.1. Please examine each of the normative statement violations below. To turn off conformance check set the ConformanceClaims property on corresponding WebServiceBinding attribute to WsiClaims.None.R2304: Operation name overloading in a wsdl:portType is disallowed by the Profile. A wsdl:portType in a DESCRIPTION MUST have operations with distinct values for their name attributes. Note that this requirement applies only to the wsdl:operations within a given wsdl:portType. A wsdl:portType may have wsdl:operations with names that are the same as those found in other wsdl:portTypes.
- Operation 'GetnFiles' on portType 'TestServiceSoap' from namespace 'http://www.test.com'.
To make service conformant please make sure that all web methods belonging to the same binding have unique names.
Source Error:
[Code]....
Stack Trace:
[Code]....
I have an ASP.NET 3.5 web application that uses ASMX web services that are called synchronously. I want to see if I can call them asynchronously because some of the web methods take a long time to process and I'm concerned that this is affecting scalability.
I found this article that explains how to use Asychronous web methods, from 2002: http://msdn.microsoft.com/en-us/library/aa480516.aspx. It says:
For asynchronous requests, during reflection the ASMX handler looks for Web methods with a certain kind of signature that it recognizes as being asynchronous. In particular, it looks for a pair of methods that have the following rules:
There is a BeginXXX and EndXXX Web method where XXX is any string that represents the name of the method you want to expose. The BeginXXX function returns an IAsyncResult interface and takes as its last two input parameters an AsyncCallback, and an object respectively. The EndXXX function takes as its only parameter an IAsyncResult interface. Both must be flagged with the WebMethod attribute. When I create the reference to my web service, I don't see any BeginXXX and EndXXX methods. I only see a XXXAsynch method and the article doesn't mention that method. I've done further research and every other article I've found also mentions the BeginXXX and EndXXX web methods.
if i have the web application with many pages like add order page, edit order page, and delete order page actually they also interact with the Sql Server 2008 and i also create web service page call Sales_Service.asmx. i know just i need to put something like query into Web Method in Sales_Service.asmx but i have a lot of queries, i don't know which query i should put into it and how the web page call the Sales_Services.asmx
View 2 RepliesA customer reported that our asmx web service is continually increasing in memory (mem usage as well as private bytes). We are able to reproduce the problem in our lab with Windows 2003 Server SP2 (fully patched) on some of the machines. The customer is using Windows 2008.
We created a Hello World web service targeting the 2.0 framework built under VS2005 SP1 and a test client that continues to call it. The memory increases steadily - approximately 40K per client request. If the test app is paused, the memory remains the same. When it is closed, the memory drops. Explicit calling of GC.Collect does not drop the memory.
We have run the memory profiler on the service and the leak is all native memory. We have uninstalled/re-installed the Framework on one of the machines but no difference. To our knowledge all of the security and IIS settings are not modified. We have compared app pool, default web site and virtual directory properties to machines that have no problem and they are identical.
On my local machine with the default ASP web server I am able to browse my web service's methods, which have with prompts and an invoke button.But when I deploy this same code to an IIS server and I browse the asmx page I just get a descritpion of the methods.
The web server is running windows 7 and IIS 6.
I am using GetMethods() method to get the list of all the available methods in WCF. But it returns everything, how can I only show the methods that I exposed to client.
[Code]....
How can I filter the methods only to WCF Servicecontracts?
given a url that references an asmx how would i go about displaying all of their method names? if assembly="http://.../something/something.asmx" and i was trying to display the method names of that service what should i do now that i have gotten myself this far? i cant seem to find a solution among the hundreds of examples ive looked at
public TestReflection(string assembly)
{
Assembly testAssembly = Assembly.LoadFrom(assembly);[code]....
[WebMethod(EnableSession = true)]
View 5 Repliesi have created a simple WCF webserivce and it is running at http://localhost:2699/WCFServiceClient/myService.svc
with method
[Code]....
i have tested it from a wcftestclient it is working fine.
but when i try to call this method from jquery, it doesn't response.
my jquery code
$.ajax({ type: "POST", url: "http://localhost:2699/WCFServiceClient/myService.svc/GetData", data: { 'value': 5 }, contentType: "application/json; charset=utf-8", dataType: "text/xml; charset=utf-8",
success: function (msg) { alert$(msg.d); }, error: function (e) { alert("Unavailable"); } }); }
I need to run 5 different WCF methods but within a transaction. Is this possible in WCF? How can I do this in WCf, if it's possible?
The WCF methods will be called from the web service client, which could be an ASP.Net app or Winfoms app.
it may sound a bit newbish question.We have a web service that comunicates with the database and exposes web methods that enables the application to access the database. Each method does only one operation (Insert, Update or Delete). What I need to do is create a transaction that will be consisted of multiple calls to the database, meaning multiple calls of more then one web methods. Can I do that? (I read that if the web method does not throw exception - or ContextUtil.SetAbort() is not called - the transaction will be commited automatically when the web method finishes executing, which I don't want to happen because I want to call another web method in the same transaction, and then manually commit the transaction)
View 2 RepliesI have a .net app developed in .net 4.0 version. And I implemented an asmx web service in this. Now I want to call one of the webservice method in another classis ASP application java script function.
View 2 RepliesI have a WCF service with two operations GetLoan and GetBalance
I want GetBalance to be exposed to all the clients but GetBalance tobe exposed to specific clients
How can this be done?
Is it possible to run a web service as a particular user/service account in the same way a Windows service can?I have a service account used for connecting to the DB and want to run the webservice under this account as the users using the webservice won't have DB access.The way I see to do it is to include the Impersonate option in the Web.config file, but is there any better way to do this?
View 1 Replies