Hi, I am trying to write a small code to secure an exposed web services(service2.asmx) that returns server time by using cookie type authorization on the web service side using custom SOAP Headers that pass authentication credentials to the web service. I do not want to use SSL. If this works I will also encrypt/dcrypt the Soap message.
To achieve this, I wanted to build a client app. that does the followings:
a)Accepts and sends a username and password ( "admin" and "passord" resp.)
b)gets server time
C)checks to see if the user is logged in.
Well, in my application I tried to create 2 text boxes with labels for the userfor the username ansd password, created lable dispaly message and created 3 buttons : Login, Logout, GetTime.
However, when I tried to write valid credentials and hit the LOGIN and GETTIME Button the server does not display the time. Every Time I hit Login and GETTIME Button, I get SORRY BUDDY YOU DO NOT HAVE ACCESS. I think this is something to do with Cookies( I am not sure.)
The LOGOUT Button works well. The whole code is written below.
Can EXPERTS look at it and Give me comment.
Thank you in Advance.
Service2.asmx
------------
<%@ WebService Language="
VB" Class="Service2" %>
Imports System
Imports System.Data
Imports System.Data.OleDb
Imports System.Configuration
Imports System.Web.Services
Imports Microsoft.VisualBasic.ControlChars
Imports System.XML.Serialization
Imports System.Web.Services.Protocols
Imports System.Web.Security
Imports System.Globalization
'1) Create the public class SOAPHeaders
public class SOAPAuthHeader2:Inherits SoapHeader
public parameter1 As String
public Parameter2 As String
End Class
public class Service2:Inherits WebService
public sHeader As SOAPAuthHeader2
'Checks that the username and password are good. If they pass the test then set
'their Session to TRUE
<WebMethod(EnableSession:=True) ,SoapHeader("sHeader",Direction:=SoapHeaderDirecti on.InOut, Required:=True)> public function SignIn2() As boolean
'check the username and the password passed in the SOAPHeader
If ((sHeader.Parameter1.ToString() = "admin") AND (sHeader.Parameter2.ToString() = "password") ) Then
'HTTPContext.session("IsLoggedIn") =true
'HTTPContext.Current.session("IsLoggedIn") = true
Context.Session("IsLoggedIn") = true
return true
Else
Context.Session("IsLoggedIn") = false
return false
End If
End function
'3)The protected web method
'This simply gets the current local time of the web server but first check to see
'if the users session is set to true by calling CheckLogin2().
<WebMethod(EnableSession:=True)> public function GetServerTime2() As String
If (CheckLogin2() = false )
Return "Sorry Buddy you are not allowed to have access"
Else
Return System.DateTime.Now.ToString()
End if
'If (CheckLogin() )
' Return System.DateTime.Now.ToString()
'Else
'Return "Sorry Buddy you are not allowed to have access"
'End if
End Function
'4) CheckSession()
'This is first trying to see if context.Session("IsLoggedIn") exists
'If so then it checks to see if it set to TRUE. If it is true the function
',which called it, continues running and vise versa. BUT if the Context.Session("IsLoggedIn")
'DOES NOT exists it too stops the function that called it
'It is in the try/catch because if the Context.Session("IsLoggedIn") did not
'exist the system would fall over
<WebMethod(EnableSession:=true)> public function CheckLogin2() As Boolean
Try
if (Context.Session("IsLoggedIn") = false)
Return false
Else
Return true
End If
Catch
return false
End Try
End Function
End Class
-------------------------------
The client app. WSSClient3.aspx
-----------------------------
<%@ Page Language="
VB" Debug="true" %>
<%@ Import Namespace="System.Data" %>
<%@ Import Namespace="JAYSERVICE2" %>
<%@ Import Namespace="System.Net.CookieContainer" %>
<%@ Import Namespace="System.Web.UI.WebControls" %>
<script runat="server">
private cookies as System.Net.CookieContainer
private oWebService As Service2
private oSoapHdr As SOAPAuthHeader2
public Sub Main()
'Cursor = Windows.Forms.Cursors.WaitCursor
'Cursor.Current = Cursors.WaitCursor
'Cursor = Cursors.WaitCursor
'set the web service cookieContainer property to cookies object
If (cookies is Nothing ) Then
cookies = new System.Net.CookieContainer()
btnLogOut.Enabled = false
else
btnLogOut.Enabled = true
End If
oWebService.CookieContainer = cookies
'Cursor = Cursors.Arrow
End Sub
'create a function for the login
private function Login() AS String
dim oWebService As new JAYSERVICE2.Service2
dim oSoapHdr As new JAYSERVICE2.SOAPAuthHeader2
'send the parameters to the proxy header
oSoapHdr.Parameter1 = txtUsername.Text.ToString()
oSoapHdr.Parameter2 = txtPwd.Text.ToString()
'send the soap header values to the web service
oWebService.SOAPAuthHeader2Value = oSoapHdr
oWebService.SignIn2()
' call the protected web method
GetServerTime2()
Return true
End function
private function GetServerTime2() As String
dim oWebService As new JAYSERVICE2.Service2
dim oSoapHdr As new JAYSERVICE2.SOAPAuthHeader2
'now make a call to the protected web service and assign the result
'to the message label
lblMessage.Text = oWebService.GetServerTime2()
Return True
End function
private function LogOut() As String
dim oWebService As new JAYSERVICE2.Service2
dim oSoapHdr As new JAYSERVICE2.SOAPAuthHeader2
'kill the Cookie
Cookies = Nothing
oWebService.CookieContainer() = Nothing
btnLogOut.Enabled = false
lblMessage.Text = "Logged Out"
Return True
End function
' lastly assign the buttons to their functions
sub btnLogIn_Click(Sender as Object, e as EventArgs)
Login()
End Sub
sub btnLogOut_Click(Sender as Object, e as EventArgs)
LogOut()
End Sub
sub gettime_Click(Sender as Object, e as EventArgs)
GetServerTime2()
End Sub
</script>
<html><body>
<form runat="server">
Username:
<asp:TextBox id="txtUsername" runat="server"/><br>
Password:
<asp:TextBox id="txtPwd" runat="server" Textmode="password"/><p>
<asp:Button id="btnlogin" runat="server" Text="Login" onClick="btnLogIn_Click" />
<asp:Button id="btnLogOut" runat="server" Text="Logout" onClick="btnLogOut_Click" />
<asp:Button id="btgettime" runat="server" Text="GetTime" onClick="gettime_Click"/><p>
<asp:Label id="lblMessage" font-size="20pt" runat="server" />
</form>
</body>
</html>
Web service with SoapHeaders error..
