Secure connection using SOAP

Question

I need to call a .NET SOAP webservice in a secure way. It must be secure in such a way that others can't call the WebService methods, and also it should not be possible for "the middle man" to understand the content of the messages.

The caller will also be a .NET webapplication installed on another IIS. I can design the webservice methods as I want, so no restrictions there.

I have been researching HTTPS/SSL with certificates, but I don't know if it actually solves my problems in a good way? For example, it would be anoying if the certificates has an expiration date, although it's not a showstopper in any way.

So how would I go about this in a good way..?

Thanks for any help.

Answer 1

Assuming you control the infrastructure then keeping the server that is providing the web services behind a firewall so it's accessible only from the web servers and implementing IPSec should provide the necessary security.

From the software point of view, this article contains all you need to know about protecting the service interactions.

Answer 2

HTTPS/SSL works fine. Just make sure to renew your certificate in time to avoid warnings and messages for your client.

Answer 3

I need to call a .NET SOAP webservice in a secure way. It must be secure in such a way that others can't call the WebService methods, and also it should not be possible for "the middle man" to understand the content of the messages.

HTTPS/SSL only solves the "middle man" part of what you want to achieve. You would still need proper authentication in place on your web service. You could do this i.e by using the built in Forms authentication and providing a Login method that returns your authentication ticket.

Answer 4

As @BrokenGlass said, SSL only encrypts the traffic between points. It doesn't handle securing individual functions from usage without authorization. Here is a good article on just such a topic using SOAP headers:

How to: Perform Custom Authentication Using SOAP Headers

This can be mixed with any form of authentication except Windows Integrated. To use Windows authentication, you'll need to have a separate library which accesses the Active Directory through the DirectoryServices namespace.