Retrieving SOAP password

Question

I am developing web services in C# using WCF and I want to create a custom way of handling security. I have found this way to retrieve the username out of the soap message that was sent to web service:

String username = System.ServiceModel.ServiceSecurityContext.Current.PrimaryIdentity.Name;

I was wondering if there was a similar way to retrieve the password from the SOAP message?

Thanks

Answer 1

Depending on which bits of WS-Security get used, the password may not be in the message. There might be a hash of the password or something like a kerberos token.

Unless the message is passed over a secure channel, e.g., SSH, you don't want the message to include the password.