Question

I want to write a web service using Visual Studio. The service needs to support some type of authentication, and should be able to receive commands via simple HTTP GET requests. The input would only be a method call with some parameters, and the responses will be simple status/error codes. My instinct would be to go with an ASP.NET Web Service, but this isn’t an option in C# 4.0 and it makes me wonder if I should be using something that’s more up-to-date. I’ve looked into WCF, but it seems like this requires a running application on the client-side – is there a way to query a WCF host by just accessing a URL?

The authentication is also an important piece. Developing my own little authentication system seems like a bad idea – I’ve read that it’s too easy to mess up. What would be the standard way of authenticating with a web service like this?

I’d love to look up all of the specifics on this and learn it myself, but I really don’t even know where to begin. Some direction would be greatly appreciated!

Answer 1

For a simple HTTP service that takes commands via GET (you should actually consider using POST…) I would use straight ASP MVC, not a true
‘web service’. WCF wants to guide you down the path of SOAP and your clients will curse you forever. RESTful WCF is also an alternative, but it still seem overkill imho.

As for authentication, you have two viable authentication schemes:

• Windows Integrated security, which will work only if client is inside intranet or connected with a VPN or DirectAccess solution
• HTTP Digest, which is poorly supported by the ASP authentication modes (only support authenticating against a Active Directory forest user base).

With Windows authentication you don’t do anything on the server side code, simply mark the the web.config <authentication mode="Windows" />. ‘Windows’ authentication is understood by most user agents. Is trivial to program clients of your service to use Windows authentication too, simple set the request’s Credentials to the current user DefaultCredentials.

With Digest authentication the server will challenge the user agent to authenticate, but the ASP validation unfortunately, as I said, only works for validating a trusted NT domain. The client though does not need to be in the intranet (there is no NTLM SSPI exchange between client and server). Programming a client is faily easy, in .Net simply set the requet Credentials to a properly initialized CredentialsCache:

CredentialCache myCache = new CredentialCache();
myCache.Add(new Uri("http://www.contoso.com/"),"Digest", new NetworkCredential(UserName,SecurelyStoredPassword,Domain));
...

request.PreAuthenticate = true;
request.Credentials = myCache;

It is important to reuse the cache between requests, otherwise the client will do two round-trips with each call.

In theory you can also have a third authentication path: full duplex SSL. But the ‘trivial’ problem of client certificate deployment makes this alternative a dead end for anybody short of a fully pre-installed enterprise PKI.