Microsoft Visual C++ .NET Professional Projects - Premier Press

692 Project 7 CREATING WEB SERVICES

Universal Description, Discovery, and Integration (UDDI)

Whenever you need to find a Web site that contains certain content, you must be using various Web search engines to look for it. Have you wondered how users are able to locate Web services that they require? The answer lies in a specification called Universal Description, Discovery, and Integration (UDDI), which is used for searching Web services. UDDI can be thought of as a public repository for Web service information, where an operator site acts as a repository for all Web service information. Collectively, operator sites provide a Web-based registry for searching published Web services. A registry contains information about a company and the publicly exposed interfaces of the company.

NOTE

UDDI is one of the first publicly available specifications to utilize SOAP. UDDI uses the SOAP Envelope/Body model, though it does not provide support for Headers.

Figure 22-4 illustrates the functioning of UDDI.

FIGURE 22-4 Functioning of UDDI

As Figure 22-4 indicates, service providers publish information about their Web services in the registry. To locate a Web service, a service requestor can send a query to the registry. If the registry is able to locate the Web service requested by the service requestor, the service requestor can bind to the service and use it.

If a user only wants to query the registry, the user can do so by using HTTP. However, since the published information is secured, users are required to sign up with the operator site, which involves users to acquire accounts. Authenticated access to the registry is maintained by authentication tokens, which are generated for each operator site.

.NET and Web Service Security

After creating a Web service, it is imperative for you to ensure its security to protect it from misuse as well as to protect the server on which the service is running. You might wonder whether securing a Web service would have been simple if security was incorporated into the SOAP protocol. The reason why this was not done is that incorporating security within the SOAP protocol would have made interoperable operations complex. Also, incorporating security in SOAP would require complex coding and testing. In addition, the wide variety of SOAP users might differ in their security requirements. Thus, it makes more sense to apply security systems and techniques separately for each service.

While securing Web services, security measures differ depending upon whether you are securing the service on the intranet or on the Internet. In the case of an intranet, the number of clients for the service is known, whereas in the case of the Internet, an unknown number of clients might use your service.

I will first discuss the options for ensuring Web service security over the Internet.

Ensuring Web Service Security over the Internet

Two main techniques are used to deal with Web service security over the Internet. The following sections discuss these two techniques.

Using Application-Specific Authentication

In certain situations where systems offered by local operating systems are not scalable or cannot be used interoperably, you need to use custom authentication processes. You can implement a custom authentication according to your requirements. Typically, you would use a separate login Web service along with your Web service. This Web service would return an authentication token and a session token, which will be passed either into the Web service as a method parameter or

Basic HTTP Security. Requires you to provide a password even though these passwords are transmitted over the network. Thus, this level is extremely insecure.

Basic over SSL HTTP Security. Uses bulk encryption, which means that packets are encrypted in totality.

Digest HTTP Security. Encrypts only the user ID and password rather than the entire packet.

Windows Authentication HTTP Security. Verifies the user ID and password by using Windows security subsystems.

Client Certificates HTTP Security. Requires a user to provide a digital certificate to access the Web service. This level provides the highest level of security.

Using ASP.NET Authentication

ASP.NET provides for authentication by using the following three authentication providers:

Windows authentication. This authentication provider provides authentication at two levels: at the server level, which is IIS, and at the application level, which is ASP.NET. Authentication is done first at the IIS level and then at the ASP.NET level.

Forms authentication. This authentication provider requires a user to enter user information in a form that you have specified.

Passport authentication. This authentication provider authenticates user credentials by using the Microsoft Passport authentication service.

I have discussed the various techniques used for ensuring Web service security over an intranet as well as the Internet. In .NET, you can secure a component by associating specified permissions with an assembly. Access to code in .NET is based on the combination of the following three components:

Permissions. Objects representing authorization for secured access to resources.

Policies. Carry permissions that you have assigned to each role (which is assigned to each group of users).

Evidence. Represents information that is specific to the assembly. This information is known to the runtime environment.

696 Project 7 CREATING WEB SERVICES

The preceding three aspects of securing code access together determine whether a user is authorized to use a specific assembly.

Summary

This chapter gave you an overview of Web services and the technologies related to them. You were first introduced to Web services and their functioning. In addition, you learned about the Web service architecture. Next, you learned about the various technologies related to Web services. You were introduced to XML and its various specifications. You also learned about XSD. You then learned about SOAP, WSDL, and UDDI. Finally, you learned about securing Web services.

Chapter 23

Creating a Web

Service Using

Managed

Extensions

You have read about Web services and a few related technologies. Based on that information, you might have concluded that creating Web services is a very complex task — a task that requires in-depth knowledge of XML, UDDI, WSDL, and so on. However, Visual Studio .NET does a very good job of simplifying the process of creating a Web service by encapsulating most of the tedious stuff and

allowing you to concentrate on the actual functionality of the Web service.

In Visual C++ .NET, you have the flexibility to create Web services by using either Managed C++ or the ATL Server. In this chapter, you will create a Web service using Managed C++ and also take a brief look at some of the underlying technologies. In the next chapter, you will learn to create a Web service using the ATL Server.

To begin with, consider the scenario of the Art-Shop gallery, which needs a Web service.

Art-Shop Associates Program

The promoters of Art-Shop realized that for an upcoming online store with a small Internet presence, a limited advertising budget, and a specific range of products, it is very difficult to build a significant online presence fast enough. To sell its products more aggressively, Art-Shop has reached agreements with other online stores and general portals whereby all of Art-Shop’s products displayed on the art-shop.com site will be displayed on these associate sites. Art-Shop hopes that this will increase the sales of its products to a great extent, because now the products are not restricted to Art-Shop’s site, but also are available on other sites.

The management of Art-Shop will pay these associate sites a commission for selling its products. The product range and data, from the Art-Shop database, has to be exposed to these sites for them to be able to display the art objects on their pages. Also, when a purchase is made at the associate site, the site should be able to place an order at art-shop.com.

With the requirements in place, the management once again approached the Code-Forge team to provide a solution. In the upcoming sections, you will see the