Question

I am developing Soap based web services using Java. Can anyone please let me know how to authenticate the client who is consuming the web services?

Thanks.

Answer 1

Probably the best but most complex is WS-Security with various authentication method. But it is most complex and its good for enterprise enviroment. It allows you to create end-to-end auth and there are lots of options. You can in simple case e.g. use Web Services Security UsernameToken Profile

    <S12:Envelope xmlns:S11="..." xmlns:wsse="..." xmlns:wsu= "...">
  <S12:Header>
  ...
    <wsse:Security>
      <wsse:UsernameToken>
        <wsse:Username>NNK</wsse:Username>
        <wsse:Password Type="...#PasswordDigest">weYI3nXd8LjMNVksCKFV8t3rgHh3Rw==</wsse:Password>
        <wsse:Nonce>WScqanjCEAC4mQoBE07sAQ==</wsse:Nonce>
        <wsu:Created>2003-07-16T01:24:32</wsu:Created>
      </wsse:UsernameToken>
    </wsse:Security>
  ...
  </S12:Header>
...
</S12:Envelope>

I don’t know what library you use, but here is a nice article how to install Rampart into Axis2 and implement UsernameToken handling.

But in some, simplified cases you can simply make HTTP Basic Authentication to web server (through SSL). This may be worst solution but sometimes could be easiest to implement. Another solution, not connected with soap can be mutual authenticated SSL (with client auth).