How to pass a password to a network service

[ssg31415926]

I administer a Server 2003/XP network. A developer has come to me with
a proposal to put in a web service-based application. The workstations
will be XP and the servers 2003 but he can't use Integrated Windows
authentication with the logged-on account because some of the
workstations are shared and have a "department" account (with minimum
access*), so the user will be signing in to the application. They all
have Windows accounts which he wants to pass to the web service so that
it can authenticate the user.

My concern is network security. He's looking at using
System.Net.NetworkCredential to pass the account. I dabble in .NET
myself so I had a look at MSDN. The example code starts with this:

NetworkCredential myCred = new NetworkCredential(
SecurelyStoredUserName, SecurelyStoredPassword,
SecurelyStoredDomain);

but I can't find how the strings are stored securely. Am I right in
thinking that if you put plain text strings in here, that they'd be
passed in plain text across the network? How do you avoid the security
risk? Is SSL the only route? Or am I barking up the wrong tree?

* Yes, I know this is a bad idea but these users don't have time to log
on and off each time they use the shared workstations so we came to
this locked-down workstation compromise.

[Ollie Riches]

I suggest you check out the following:

http://msdn.microsoft.com/library/de...ebServices.asp

HTH

Ollie Riches

"ssg31415926" <ne**********@gmail.com> wrote in message
news:11*********************@g14g2000cwa.googlegro ups.com...

I administer a Server 2003/XP network. A developer has come to me with
a proposal to put in a web service-based application. The workstations
will be XP and the servers 2003 but he can't use Integrated Windows
authentication with the logged-on account because some of the
workstations are shared and have a "department" account (with minimum
access*), so the user will be signing in to the application. They all
have Windows accounts which he wants to pass to the web service so that
it can authenticate the user.

My concern is network security. He's looking at using
System.Net.NetworkCredential to pass the account. I dabble in .NET
myself so I had a look at MSDN. The example code starts with this:

NetworkCredential myCred = new NetworkCredential(
SecurelyStoredUserName, SecurelyStoredPassword,
SecurelyStoredDomain);

but I can't find how the strings are stored securely. Am I right in
thinking that if you put plain text strings in here, that they'd be
passed in plain text across the network? How do you avoid the security
risk? Is SSL the only route? Or am I barking up the wrong tree?

* Yes, I know this is a bad idea but these users don't have time to log
on and off each time they use the shared workstations so we came to
this locked-down workstation compromise.

[ssg31415926]

I shall. Thanks very much.

Half of the problem, I find, is knowing where to look!

SG

[Prakash M]

Hi,

Ask the developer to modify the code. Ask him to use 'new default
credentials' instead of 'new network crdentilal' . Hope this will solve the
problem and still send you the windows logged-in user credential to the web
service method
--
Prakash M
"ssg31415926" wrote:

I administer a Server 2003/XP network. A developer has come to me with
a proposal to put in a web service-based application. The workstations
will be XP and the servers 2003 but he can't use Integrated Windows
authentication with the logged-on account because some of the
workstations are shared and have a "department" account (with minimum
access*), so the user will be signing in to the application. They all
have Windows accounts which he wants to pass to the web service so that
it can authenticate the user.

My concern is network security. He's looking at using
System.Net.NetworkCredential to pass the account. I dabble in .NET
myself so I had a look at MSDN. The example code starts with this:

NetworkCredential myCred = new NetworkCredential(
SecurelyStoredUserName, SecurelyStoredPassword,
SecurelyStoredDomain);

but I can't find how the strings are stored securely. Am I right in
thinking that if you put plain text strings in here, that they'd be
passed in plain text across the network? How do you avoid the security
risk? Is SSL the only route? Or am I barking up the wrong tree?

* Yes, I know this is a bad idea but these users don't have time to log
on and off each time they use the shared workstations so we came to
this locked-down workstation compromise.