Question

I am planning to write a .net web application using SOA, which means data operations are made using web methods. There will be many, many methods so I got the next questions:

1. how should i handle security?
2. should i split them into more services?
3. call them using reflection?

Any tips will help because i am new to SOA..

Answer 1

As you can imagine, that’s not a simple subject. So I would partition it this way: minimally, your question comprises two aspects of security:

• Authentication: knowing who your calling party is
• Authorization: knowing what that calling part is allowed to do

You have different options for both. For ex. you can handle authentication through multiple standards like WS-{Security|Trust|etc} and, in the other end, authorization through AzMan roles (which BTW doesn’t scale very well).

With respect to technology, I agree with other posts, you should opt for WCF. That allows you to leverage those standards and present you more options for the different aspects of security, including auditing.