I'm examining moving our app to a more formally SOA architecture.  Right now authentication / Authorization is done in a mish-mash of ways all of which revolve around picking up the login cookie.  Does anyone have advice on how to structure our services with security in mind?  How do I get credential information into the service etc?

For ASMX webservices, you can use WSE, here are some links:

http://www.codeproject.com/KB/webservices/KerberosAuthenticationPOC.aspx

http://www.codeproject.com/KB/cpp/authforwebservices.aspx

For WCF based services (recommended), here are some links:

http://nayyeri.net/blog/custom-username-and-password-authentication-in-wcf-3-5/

http://msdn.microsoft.com/en-us/security/aa570351.aspx (Geneva framework)

HTH,

Vivek

Hi there,

There's already quiet a few information on MSDN about it also vivek has already posted very useful information to get you started.

I will also recommend you to have a quick look through the security best practices by patterns and practices group http://msdn.microsoft.com/en-us/library/aa302428.aspx

If you are planning to head down WCF path (which i strongly recommend you should consider) then you can have a look at WCF specific information http://msdn.microsoft.com/en-us/library/ms732362.aspx

Hope this helps

Sunny

 One other note to add here- you didn't really elude to the type of service you were planning on creating. IMO there is no question to use WCF if you are starting from scratch.  Here is a good magazine article on WCF Authorization:

Authorization In WCF-Based Services:

http://msdn.microsoft.com/en-us/magazine/cc948343.aspx

I have used both .asmx web services with WSE 3.0 and WCF, and I need to point out that using WSE 3.0 is not the way to go if starting new.  The reason is that WSE will not be further enhanced by Microsoft and is viewed as becoming obsolete in route to the more robust WCF services and the associated securtiy model.

In fact, if you are using VS.NET 2008, WSE 3.0 does not even directly integrate.  There are work arounds I have used to get it integrated but they are incosistient in success of working in my experience.  So the best advice, move to WCF if possible.