Hi,
I'm developing a web service that needs to communicate with a custom
application on an intranet. There is also a configuration utility which may
be run on a different server machine for setting up and altering parameters
on the service. This configuration web application may be browsed to via
intranet or internet.
This is the first work I've done with web services, so sorry for any
incorrect terminology or nonsense statements.
The basic interface seems to be working, but I'm not sure how to secure
communication to/from the service. The web service will be deployed to
customers for internal use, so we don't have control over IIS settings and
network setup (active directory, etc.) is unknown. Right now I have been
testing with a custom SOAP extension that parses the response/requests and
encrypts the body using a symmetric key. But this doesn't seem like a great
solution since the key has to be stored somewhere on client and server
machines or hardcoded. Also, the configuration utility can be accessed from
a browser on a machine where this information is not stored. So is this a
dead-end approach?
SSL is attractive because of it's relative simplicity, but I'm not sure if
this is an option. If I understand it correctly, server certificate request
and IIS setup would have to be done on the eventual install machine aside
from just installing the web service. Is there any way to use SSL without
requiring this additional setup? For example, to make a package where it
could all be configured during install?
Are there any accepted best practice type approaches for securing web
services in this type of situation? I've been looking, but most examples seem
to be where the web service is hosted internally, so all that configuration
can be taken care of.
Any advice or references would be welcome.
Jon
I'm developing a web service that needs to communicate with a custom
application on an intranet. There is also a configuration utility which may
be run on a different server machine for setting up and altering parameters
on the service. This configuration web application may be browsed to via
intranet or internet.
This is the first work I've done with web services, so sorry for any
incorrect terminology or nonsense statements.
The basic interface seems to be working, but I'm not sure how to secure
communication to/from the service. The web service will be deployed to
customers for internal use, so we don't have control over IIS settings and
network setup (active directory, etc.) is unknown. Right now I have been
testing with a custom SOAP extension that parses the response/requests and
encrypts the body using a symmetric key. But this doesn't seem like a great
solution since the key has to be stored somewhere on client and server
machines or hardcoded. Also, the configuration utility can be accessed from
a browser on a machine where this information is not stored. So is this a
dead-end approach?
SSL is attractive because of it's relative simplicity, but I'm not sure if
this is an option. If I understand it correctly, server certificate request
and IIS setup would have to be done on the eventual install machine aside
from just installing the web service. Is there any way to use SSL without
requiring this additional setup? For example, to make a package where it
could all be configured during install?
Are there any accepted best practice type approaches for securing web
services in this type of situation? I've been looking, but most examples seem
to be where the web service is hosted internally, so all that configuration
can be taken care of.
Any advice or references would be welcome.
Jon
Comment