locked
Several question about design/develop Web Service in .NET RRS feed

  • 問題

  • Hi

    The company that I am working on want to develop a web-service for partner to access their data. I am very new on design and develop web-service. I would be grateful, if you can provide some help/guideline for me.

    1)
    Some web-service which is provided by the other company, they always has some method which required specific object that I need to create and set the value to it and than pass it on to the method.

    I would like to do the similar stuff, unfortunately after I created the object, on the web-service that I create.
    When I try to consume it, I cannot see the object is available. Unless, I create a web-service method which contain that object, but I cannot see the property/method inside the object.
    After doing some research, I knew that I can create a struct, and create a web-service method, then I can see the properties of that structure and I can also set the value to it as well. But cannot see any method that I created on that structure object
    E.G.1
      public struct ClientData
            {
                public String Name;
                public int ID;
                public int a()
                {
                    return 1;
                }
               
            }

    I can access ID, Name but not method "a'
    I am wondering if I would like to set and get value from an object via web-service, I have to create a structure rather than class?

    Please correct me if my concept is wrong.

    2) Could you let me know about the security approach about web-service. E.g. Is there anyway that we can force the user to login? Do we need to attach an user details object on each of the method that call? Is there any setting that I can set to only allow certain IP which can access the web-service, or I can create some Certificate for them, so only the server which contain the certificate can access the web-service...etc. (I am not quite sure how it works)
    Some of the web-service that we consume did require us to register our IP address with them. When the IP address is changed we cannot access the web-service.
    Could you give me some more idea about what kind of security measure that I need to be careful of.

    Sorry about my poor English. Hope you can still understood what I mean.

    I would be grateful if you give me some advice.

    Thanks in advance.
    2008年11月2日 下午 10:36

解答

  • 1. Please note that Web services is for you to exchange data between the consumer and the provider.  Hence, any method defined in your class and struct at the service provider side will not be available to the service consumer.  That means, the situation you described is normal.  If you really need to have method call on the object created based on your custom struct/class, you have to create a wrapper function on your web services to do so.  Moreover, other than "struct", you can also define your data structure in "class".

     

    2. I would suggest you use WCF to implement your service in order to minimize the security features you need to implement by yourself.  Plese refer to http://msdn.microsoft.com/en-us/library/ms730301.aspx for more information about security scenario and http://msdn.microsoft.com/en-us/library/ms731134.aspx for integrating WCF service to Web Services client.

    2008年11月3日 上午 01:17
  • If in your case, then security should be implemented by yourself, e.g.:

    1. The most simple one is to use IIS/application setting to use Integrated Windows Authentication but it may not be compatible to some client application

    2. You can utilitze the SoapHeader class (http://msdn.microsoft.com/en-us/library/system.web.services.protocols.soapheader.aspx) to submit custom information (e.g. username/password) to the Web Services in the SOAP header.  However, you should aware of the data security during transportation.  Hence, you may need to enable SSL or implement a custom encryption logic in your code.

    3. For IP range filtering, you may config it in IIS level or implement custom logic to check client's IP address before execuing any of your business logic.

     

    When using VS.NET or the wsdl command to generate the Web Services proxy class for you, it must be implemented in class since it needs to have inheritance from a standard base class no matter you use struct/class at service provider side.  In addition, please note that when using Web Services, service consumer and service provider are loosely couple to each other.  That means you only need to know the data structure provided but you don't need to care about what technology used at the service provider side.  You feel confuse is because the service provider and the service consumer are both implemented by you (or your team), that makes you know everything in the low level implementation.  Try to forget about the details at the services provider side when you implement the service consumer and I think you can make that clear.

     

    It's ok for adding me at your MSN and you can find my MSN account in the email section of my profile here. 

    2008年11月3日 下午 01:19

所有回覆

  • 1. Please note that Web services is for you to exchange data between the consumer and the provider.  Hence, any method defined in your class and struct at the service provider side will not be available to the service consumer.  That means, the situation you described is normal.  If you really need to have method call on the object created based on your custom struct/class, you have to create a wrapper function on your web services to do so.  Moreover, other than "struct", you can also define your data structure in "class".

     

    2. I would suggest you use WCF to implement your service in order to minimize the security features you need to implement by yourself.  Plese refer to http://msdn.microsoft.com/en-us/library/ms730301.aspx for more information about security scenario and http://msdn.microsoft.com/en-us/library/ms731134.aspx for integrating WCF service to Web Services client.

    2008年11月3日 上午 01:17
  • Hi Raymond

    Thanks for your information, I would love to use WCF to implement the web-service, unfortunately I do not think the company that I am working on want to move to VS2008 yet.

    When you design/develop a web-service do you use class much or normally people use "struct"?
    When I consume web-service no matter it is Class or "Struct" it always treat it as class. I am a bit confused here.

    Would you mind If I add you on MSN to ask you more questions?

    Thanks a lot.

    2008年11月3日 上午 08:46
  • If in your case, then security should be implemented by yourself, e.g.:

    1. The most simple one is to use IIS/application setting to use Integrated Windows Authentication but it may not be compatible to some client application

    2. You can utilitze the SoapHeader class (http://msdn.microsoft.com/en-us/library/system.web.services.protocols.soapheader.aspx) to submit custom information (e.g. username/password) to the Web Services in the SOAP header.  However, you should aware of the data security during transportation.  Hence, you may need to enable SSL or implement a custom encryption logic in your code.

    3. For IP range filtering, you may config it in IIS level or implement custom logic to check client's IP address before execuing any of your business logic.

     

    When using VS.NET or the wsdl command to generate the Web Services proxy class for you, it must be implemented in class since it needs to have inheritance from a standard base class no matter you use struct/class at service provider side.  In addition, please note that when using Web Services, service consumer and service provider are loosely couple to each other.  That means you only need to know the data structure provided but you don't need to care about what technology used at the service provider side.  You feel confuse is because the service provider and the service consumer are both implemented by you (or your team), that makes you know everything in the low level implementation.  Try to forget about the details at the services provider side when you implement the service consumer and I think you can make that clear.

     

    It's ok for adding me at your MSN and you can find my MSN account in the email section of my profile here. 

    2008年11月3日 下午 01:19