views:

563

answers:

2

I currently have a suite of .Net web services that are developed in ASP.Net 2.0. They don't utilize any WS-E extensions, rather they implement security at the application level. They are fairly straightforward data retrieval/update features. I am interested in re-factoring these web services gradually over time into WCF services, mostly to future-proof them against the deprecation of old framework versions. My main concern is the amount of re-coding that will need to be done in the client applications to re-connect with these services.

  1. Has anyone gone down this road already?
  2. Was it worth it?
  3. Can you recommend any reading materials that I can use to continue my research in this area?
+1  A: 

Your concerns are valid. I've been taking the approach of 'if it ain't broke, don't fix it' and leaving existing 'legacy' web services alone until they need work. For new development we have been adopting WCF the solution to communication problems big and small. The most tangible benefit is the ease of integration if you have a nice clean object model. The most tangible negative is that (relatively speaking) there are much more configuration headaches, especially when you start trying to secure things.

I find it interesting you mentioned the WS-* spec as that is where we had the most problems integrating WCF with a Java system. The security features are just plain missing right now, and we ended up using Microsoft.Web.Services3 (WSE3) for that one piece of the .NET side of things.

I would highly recommend reading through these articles even if you don't do security with WCF right now, you probably will have to at some point.

slf
Could you elaborate on which security features are missing from WCF? I didn't know it was missing any at all.
John Saunders
Specifically when dealing with UsernameToken on a custom binding we couldn't find a way to set MustUnderstand to false. After a couple of days of troubleshooting WCF we found WSE3 supported this out of the box and used it simply out of respect to the project schedule.
slf
A: 

It is quite possible that your clients won't need to change at all.

On the server side, I've recently seen an ASMX service that was turned into a WCF service simply by placing [ServiceContract] on the [WebService] class, and [OperationContract] on the [WebMethod] methods, and by turning the non-primitive types it returned into [DataContract] and [DataMember].

John Saunders