XML Web Servivces AUTHENTICATION

Question

Hi guys. I created a XML Web Service called BugTraker and I have the usernames, passwords and roles stored into SQL server tables called tUsers and tRoles. How can I configure my web server to authenticate users, passwords and roles from SQL Server using the information stored in SQL server? If somebody has some examples I'll appreciate. Thanks Ali Hidalgo

S_Kiryazov · Answer

I almost forgot. The DbUtils is small class wrapping the .net data access that I wrote to save code. Here's the method referenced: /// /// Executes the SqlCommand passed and returns an untyped dataset /// with the values returned. /// // // Exceptional return values: // // null - if the statement causes an exception to be thrown // empty dataset - if no data is returned public static DataSet GetDataSet( SqlCommand sqlCmd ) { DataSet dataSet = new DataSet(); sqlCmd.Connection = new SqlConnection( ConnectionString ); SqlDataAdapter dataAdapter = new SqlDataAdapter( sqlCmd ); try { dataAdapter.Fill( dataSet ); } catch( Exception x ) { return null; } return dataSet; }

S_Kiryazov · Answer

I read that since .net 1.1 web services security is basically the same as asp.net security i.e. etc. Doesn't seem very reasonable to me as long as WebMethod calling often happens behind the hood and the client isn't supposed to know that so it's useful only in some scenarios. If you're asking for validation code against SQL Server database here's a little example. It's not commented but I hope it's clear. The thing that may cause confusion is that I have 4 user types - Admin Specialist Worker Client. Take a look: public enum LoginResult { Admin = 1 Specialist = 2 Worker = 3 Client = 4 WrongPwd = 5 NoUser = 6 Failure = 7 } .... public static LoginResult GetUser( string loginID string pwd ref User u ) { LoginResult login = LoginResult.Failure; String CheckUser = @ SELECT UserID Password UserRoleID UserName FROM Users WHERE UserLogonID=@UserLogonID; SqlCommand cmdCheckUser = new SqlCommand(); cmdCheckUser.CommandText = CheckUser; SqlParameter paramUsr = new SqlParameter( @UserLogonID SqlDbType.VarChar ); paramUsr.Value = loginID.ToString(); cmdCheckUser.Parameters.Add( paramUsr ); DataSet users = new DataSet(); try { users = DbUtils.GetDataSet( cmdCheckUser ); } catch ( Exception e ) { login = LoginResult.Failure; return login; } if ( users.Tables[0].Rows.Count==0 ) { login = LoginResult.NoUser; } login = LoginResult.WrongPwd; foreach ( DataRow row in users.Tables[0].Rows ) { if ( row[Password].ToString() == pwd ) { // use stored procedure to get organisation name // instead of user name if user is organization Int32 userID; String userName; UserRole role; try { userID = Convert.ToInt32( row[UserID] ); userName = row[userName].ToString(); role = (UserRole)( Convert.ToInt32( row[UserRoleID] ) ); } catch ( Exception e ) { return LoginResult.Failure; } switch ( (UserRole)(Convert.ToInt32(row[UserRoleID])) ) { case UserRole.Client: u = new Client(); return LoginResult.Client; case UserRole.Specialist: u = new Specialist( userID userName role ); return LoginResult.Specialist; case UserRole.Worker: u = new Worker( userID userName role ); return LoginResult.Worker; case UserRole.Admin: u = new Admin(); return LoginResult.Admin; default: return LoginResult.Failure; } } } return login; }