Question

We build web services that are for consumption by known third-parties.

We tend to implement very basic security that involves:

• A known token ID which we communicate to both parties
• Restrict access to known subset of IP addresses
• Secure the transport layer via SSL

I’m not comfortable with this, but implementing Federated Security (using WIF/ADFS 2) is VERY complex! How can I justify using this tech – what is fundamentally wrong with the above approach?

I realise that the web service (which might expose sensitive data) is now only as secure as the token, but so would a username/password combo.

Thanks
Duncan

Answer 1

To improve or replace the common token i would use some client/server certificate authentification. You will use SSL anyway and client certificate gives some more features