Expert Web Services Security in the .NET Platform

BRIAN NANTZ

LAURENCE MORONEY

Apress

© 2005 by Brian Nantz and Laurence Moroney

All rights reserved. No part of this work may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying, recording, or by any information storage or retrieval system, without the prior written permission of the copyright owner and the publisher.

ISBN (pbk) : 1590591151

9 8 7 6 5 4 3 2 1

Trademarked names may appear in this book. Rather than use a trademark symbol with every occurrence of a trademarked name, we use the names only in an editorial fashion and to the benefit of the trademark owner, with no intention of infringement of the trademark.

Lead Editor: Ewan Buckingham

Technical Reviewer: Massimo Nardone

Editorial Board: Steve Anglin, Dan Appleman, Ewan Buckingham, Gary Cornell, Tony Davis, John Franklin, Jason Gilmore, Chris Mills, Dominic Shakeshaft, Jim Sumser

Project Manager: Sofia Marchant

Copy Edit Manager: Nicole LeClerc

Copy Editor: Suzanne Goraj

Production Manager: Kari Brooks-Copony

Production Editor: Janet Vail

Compositor: Susan Glinert

Proofreader: April Eddy

Indexer: Rebecca Plunkett

Artist: Kinetic Publishing Services, LLC

Cover Designer: Kurt Krames

Manufacturing Manager: Tom Debolski

Distributed to the book trade in the United States by Springer-Verlag New York, Inc., 233 Spring Street, 6th Floor, New York, NY 10013, and outside the United States by Springer-Verlag GmbH & Co. KG, Tiergartenstr. 17, 69112 Heidelberg, Germany.

In the United States: phone 1-800-SPRINGER, fax 201-348-4505, e-mail http://www.springer-ny.com. Outside the United States: fax +49 6221 345229, e-mail http://www.springer.de.

For information on translations, please contact Apress directly at 2560 Ninth Street, Suite 219, Berkeley, CA 94710. Phone 510-549-5930, fax 510-549-5939, e-mail http://www.apress.com.

The information in this book is distributed on an “as is” basis, without warranty. Although every precaution has been taken in the preparation of this work, neither the author(s) nor Apress shall have any liability to any person or entity with respect to any loss or damage caused or alleged to be caused directly or indirectly by the information contained in this work.

The source code for this book is available to readers at http://www.apress.com in the Downloads section. You will need to answer questions pertaining to this book in order to successfully download the code.

Dedication

This book is dedicated to my wife Rebecca and children Claudia and Christopher for being the best people on the entire planet; to Anto Budiardjo, who gave me my first big break in this business; and to Steve Scimone and Tom McDonnell, who gave me my best big break in this business. Thanks, guys!

—Laurence Moroney

To my parents William and Debra Nantz for teaching me the true meaning of security.

—Brian Nantz

About the Authors

LAURENCE MORONEY is a physicist by training who fell into software development writing configuration and control applications for Closed Circuit TV applications. He currently works as a senior technology strategist for a major financial services firm in New York City. He has also worked for what he calls “alternative financial services” (what the rest of us call casinos), as well as environments as diverse as professional soccer and jail security. He lives in Westbury, New York with his wife Rebecca and his children Claudia and Christopher.

BRIAN NANTZ is a senior engineer in research and development at Security International in Milwaukee. He has designed solutions for GM, GE, Honeywell, and Analogic. An active member of the .NET open-source community, Brian contributes to many key projects. He has also authored other .NET books including Open Source .NET Development.

About the Technical Reviewer

Born under The Vesuvius in the south of Italy, MASSIMO NARDONE moved to Finland more than eight years ago and continues to live and work there. He holds a master’s degree in Computing Science from the University of Salerno, Italy, and has worked for a variety of international software houses and telecommunications companies, specializing in research, engineering, security, and project management. He has also been a visiting lecturer and supervisor at the Networking Laboratory of the Helsinki University of Technology.

Massimo has researched and developed Internet and mobile applications involving such technologies as J2EE, PKI/WPKI, SIP, SAML, BS7799, and TTS (Text to Speech). In his role as Chief Security Architect with Comptel Corporation, he researches, designs, and implements security methodologies for different software environments. He is an expert on Security Standard BS7799 as it applies to PKI and WPKI protocols, and holds two international patents on authentication and security protocols.