I have a multiple Framework 2.0 .asmx.cs that have a string input
property called "securityinput" on many WebMethods. Each .asmx.cs
inherits from a base class that inherits from WebService. 

I would like to create a custom Event in the constructor of this base
class that would capture/inspect the "securityinput" stuff. Then all
existing child WebService pages, as well as new ones, could have their
security automatically handled without doing their own
security-related method calls within their web methods.

I am forced to evaluate this "securityinput" manually because the web
service lives in a very heterogenous environment and some callers
cannot do anything beyond add securityinput as a parameter.

Is this possible?

Thanks.

"lucius" <lucius@newsgroup.nospam> wrote in message 
news:jlj493p9vb9t1ifaqvpm9lgj4elunu75u6@4ax.com...

>
> I have a multiple Framework 2.0 .asmx.cs that have a string input
> property called "securityinput" on many WebMethods. Each .asmx.cs
> inherits from a base class that inherits from WebService.
>
> I would like to create a custom Event in the constructor of this base
> class that would capture/inspect the "securityinput" stuff. Then all
> existing child WebService pages, as well as new ones, could have their
> security automatically handled without doing their own
> security-related method calls within their web methods.
>
> I am forced to evaluate this "securityinput" manually because the web
> service lives in a very heterogenous environment and some callers
> cannot do anything beyond add securityinput as a parameter.
>
> Is this possible?


Well, sort of.

To generalize your question a little, what you've got is a set of web 
methods that need common processing before they execute their "real work". 
You don't want these methods to have to do any work in order to make this 
happen, yet you need to ensure that the security check always happens.

One of the GOF Design Patterns can be helpful here - the Template Method 
pattern. It's possible to define a base class with an Execute method. This 
method can perform all the common steps, then can call an abstract 
"ExecuteImplementation" method. This can have the code that is specific to 
each of the particular web methods.

Now, this does mean having a separate small class per web method, but can be 
worth it. I've implemented a production service this way, and use such a 
"service layer" to provide common handling of authentication, exception 
handling, etc.

The nice thing about this technique is that you get to vary the 
implementation by working with the class hierarchy.

I'll try to post an example of this tonight.
-- 
John Saunders [MVP]

Hi lucius,

So the question here is also related to your another thread "internal 
webservice", right?

If you want to your custom authentication and want to put it in a central 
place without affecting your main webservice's webmethod codelogic, I think 
using SoapExtension is a good choice here. ASP.NET webservice will go 
through a series of Soap Extensions (like a pipeline) when the SOAP message 
come from network to the ASP.NET webservice engine. You can inject your 
custom soap extensions into the pipeline chain and so some 
customization(such as logging, message modification, authentication....).  

Also, you can attach authentication info in webservice's SOAP header, and 
check the Soap header for security authentcation info in SoapExtension:

#Digging into SOAP Headers with the .NET Framework
http://msdn2.microsoft.com/En-US/library/aa480503.aspx

The following articles have well demonstrate the use of SOAP Extensions:

#SOAP Message Modification Using SOAP Extensions  
http://msdn2.microsoft.com/en-us/library/esw638yk.aspx

#Using SOAP Extensions in ASP.NET
http://msdn.microsoft.com/msdnmag/issues/04/03/ASPColumn/

#Extend the ASP.NET WebMethod Framework with Business Rules Validation
http://msdn.microsoft.com/msdnmag/issues/03/08/businessrules/default.aspx

Sincerely,

Steven Cheng

Microsoft MSDN Online Support Lead

 

==================================================

Get notification to my posts through email? Please refer to 
http://msdn.microsoft.com/subscriptions/managednewsgroups/default.aspx#notif
ications.

 

Note: The MSDN Managed Newsgroup support offering is for non-urgent issues 
where an initial response from the community or a Microsoft Support 
Engineer within 1 business day is acceptable. Please note that each follow 
up response may take approximately 2 business days as the support 
professional working with you may need further investigation to reach the 
most efficient resolution. The offering is not appropriate for situations 
that require urgent, real-time or phone-based interactions or complex 
project analysis and dump analysis issues. Issues of this nature are best 
handled working with a dedicated Microsoft Support Engineer by contacting 
Microsoft Customer Support Services (CSS) at 
http://msdn.microsoft.com/subscriptions/support/default.aspx.

==================================================
 	

This posting is provided "AS IS" with no warranties, and confers no rights.

Hi Lucius,

Have you got any further idea on this issue or does the suggestion in 
previous message helps some? If you have any further specific questions on 
this, please feel free to let me know.

Sincerely,

Steven Cheng

Microsoft MSDN Online Support Lead


This posting is provided "AS IS" with no warranties, and confers no rights.