UserName Authentication web services

Question

I need to implement UserName authentication for my web service.

Currently I am considering these two approaches

1. SOAPHeader: http://www.codeproject.com/KB/cpp/authforwebservices.aspx
2. UserNameToken: WSE 3.0: http://msdn.microsoft.com/en-us/library/aa480575.aspx

Can anyone tell me pros-cons of these approaches?

One of the major doubt is regarding client being able to consume the service. Client is using Java, would it be possible for them to pass UserNameToken implemented using WSE or are there any integration issues?

EDIT: Also please suggest if there are any better ways (ASMX Services) to implement UserName/Password authentication.

Answer 1

Why not use HTTP basic access authentication ? link text

cheers

Answer 2

I would like to warn you against using WSE 3.0. Unless you are involved in a large enterprise federated system, stay well clear. It's way too much, overly complicated and we are still trying to rid it from one of our major systems.

If you just need to use username authentication then use the soap header approach.

MSDN Link: Building Secure ASP.NET Applications: Authentication, Authorization, and Secure Communication