File APIs for Java Developers
Manipulate DOC, XLS, PPT, PDF and many others from your application.
http://aspose.com/file-tools
The moose likes Web Services and the fly likes Web service Security Big Moose Saloon
  Search | Java FAQ | Recent Topics | Flagged Topics | Hot Topics | Zero Replies
Register / Login
JavaRanch » Java Forums » Java » Web Services
Bookmark "Web service Security" Watch "Web service Security" New topic
Author

Web service Security

Shruti Sharma
Ranch Hand

Joined: Mar 25, 2010
Posts: 55
Hi,

I am new to web services. I would like to know if it is required or optional to do authentication while invoking a web service.

Thank you,
-Shruti
Ivan Krizsan
Ranch Hand

Joined: Oct 04, 2006
Posts: 2198
    
    1
Hi!
It depends on the web service you are trying to call. If the web service require authentication, then the client must supply authentication credentials.
It is optional to implement authentication in a web service - you can have web services without any kind of authentication. Authentication may not be necessary if the web service is published to a private network.
Best wishes!


My free books and tutorials: http://www.slideshare.net/krizsan
Shruti Sharma
Ranch Hand

Joined: Mar 25, 2010
Posts: 55
Thanks a lot for the reply! How does client know about the credentials? Are these credentials provided by the web service we want to connect to? Where are these credentials stored?

Thanks again,
-Shruti
Lester Burnham
Rancher

Joined: Oct 14, 2008
Posts: 1337
The credentials are stored on the server where the WS runs. Of course the WS does not give them out - the client must know them beforehand. Wouldn't be much security otherwise, would it?
win llen
Greenhorn

Joined: Aug 18, 2010
Posts: 18
Hi,

just a follow up question. if the the WS-Security implementation uses Keys. how would the service know which client is accessing him. I mean if each of the client has different key (unique for everyone) and the service has only one service.key to signed all the clients. please enlighten.

thanks.
Ivan Krizsan
Ranch Hand

Joined: Oct 04, 2006
Posts: 2198
    
    1
Hi!
There are two options available (as far as I know) concerning keys:
- If you use a symmetric cipher, then the clients and server share a common secret key which can be used to encrypt/decrypt and/or sign messages.
- If you are using an asymmetric cipher, then the server must have the public keys of all the clients, in order to be able to determine if a client's private key has been used to encrypt and/or sign some data.
Hope this answers some of your questions!
Ulf Dittmer
Marshal

Joined: Mar 22, 2005
Posts: 42932
    
  68
As mentioned in the other topic where you asked about this, encryption is not the same as authentication. If you need to authenticate, then you should use a UsernameToken in addition to encrypting.
 
I agree. Here's the link: http://aspose.com/file-tools
 
subject: Web service Security