Hibri Marzook Musings on technology and occsionally photography

Adding simple authentication to a web service using SOAP headers

If you ever wanted to add a simple username/password authentication to your web service, but ended up with a whole lot of this ?

public string HelloWorld(string userName,string password)

Well then, here is a much cleaner way. You can use SOAP headers to pass extra information to a web service. This method uses SOAP headers to pass the user credentials to the web service.

The web service.

We need an object to hold the user credentials. For this example a simple class with username and password properties would suffice. The class should derive from the SoapHeader class.

public class Authentication:SoapHeader
    private string _userName;
    private string _password;
    public string Password
        get { return _password; }
        set { _password = value; }

    public string UserName
        get { return _userName; }
        set { _userName = value; }

In the web service class, declare a public field (or property) of the Authentication type.

WebService(Namespace = “[http://tempuri.org/”)]])
[WebServiceBinding(ConformsTo = WsiProfiles.BasicProfile1_1,Name=”MyWebService”)]
public class MyWebService : System.Web.Services.WebService {
    public Authentication ServiceCredentials;

In the next step, set up the web method to accept a SOAP header, of the type Authentication, and assign the value to the ServiceCredentials member.

    [SoapHeader("ServiceCredentials") ]
    public string HelloWorld() {
        if (ServiceCredentials.UserName == "test" && 
ServiceCredentials.Password == "world") { return "Hello World"; } else { return "Invalid authentication"; } }

 At the client.

  1. Add the web service reference as usual. Instantiate a new object of the type MyWebService.
    • In addition instantiate a new object of the type Authentication and assign the username and password properties.
      • Next, assign this to the Service credentials property of the MyWebService instance.
        • Call any web method, as you like. </ol> The credentials are being passed with the soap headers, so you don’t need to add the username/password to each and every method. Since, this is done once for the web service, it can be used for multiple calls to any web method in the same service.

        This is how the SOAP XML looks like,

<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"> <soap:Header> <Authentication xmlns="http://tempuri.org/"> <Password>string</Password> <UserName>string</UserName> </Authentication> </soap:Header> <soap:Body> <HelloWorld xmlns="http://tempuri.org/" /> </soap:Body> </soap:Envelope>


By Hibri Marzook

Discuss this post with me on @hibri