Question

I’m working on a project where we have several SOAP Web Services developed on different programming languages, like Java, Perl and Python.
I need to authenticate users that will use each Web Service, denying users that we do not want.

I have already seen OAuth, but I didn’t found any documentation that helped me on this way. And with OAuth, I have to program each Web Service (with different programming languages) to work with it.

I want to know what is the best way to accomplish this requirements.

There’s any way to make what I want using HTTP Digest Authentication? And which one is a better solution? OAuth or WS-Security?

Thanks in advance,
Ukrania

Answer 1

You’ve got quite a bit of research ahead of you.

You’ll want to learn about Federated Security:

Definition of Federated Security

Federated security allows for clean
separation between the service a
client is accessing and the associated
authentication and authorization
procedures. Federated security also
enables collaboration across multiple
systems, networks, and organizations
in different trust realms.

WCF provides support for building and
deploying distributed systems that
employ federated security.

For WCF information on that, see Federation and Issued Tokens. You may also be interested in the MSDN Magazine article, “Geneva Framework, A Better Approach For Building Claims-Based WCF Services.

FYI, the search I used to find these is http://social.msdn.microsoft.com/Search/en-US/?Refinement=117&Query=federated+security+in+wcf.