XML Web Servivces AUTHENTICATION

I almost forgot. The DbUtils is small class wrapping the .net data access that I wrote to save code. Here's the method referenced: ///

/// Executes the SqlCommand passed and returns an untyped dataset /// with the values returned. ///

// // Exceptional return values: // // null - if the statement causes an exception to be thrown // empty dataset - if no data is returned public static DataSet GetDataSet( SqlCommand sqlCmd ) { DataSet dataSet = new DataSet(); sqlCmd.Connection = new SqlConnection( ConnectionString ); SqlDataAdapter dataAdapter = new SqlDataAdapter( sqlCmd ); try { dataAdapter.Fill( dataSet ); } catch( Exception x ) { return null; } return dataSet; }

I read that since .net 1.1 web services security is basically the same as asp.net security i.e. etc. Doesn't seem very reasonable to me as long as WebMethod calling often happens behind the hood and the client isn't supposed to know that so it's useful only in some scenarios. If you're asking for validation code against SQL Server database here's a little example. It's not commented but I hope it's clear. The thing that may cause confusion is that I have 4 user types - Admin, Specialist, Worker, Client. Take a look: public enum LoginResult { Admin = 1, Specialist = 2, Worker = 3, Client = 4, WrongPwd = 5, NoUser = 6, Failure = 7 } .... public static LoginResult GetUser( string loginID, string pwd, ref User u ) { LoginResult login = LoginResult.Failure; String CheckUser = @" SELECT UserID, Password, UserRoleID, UserName FROM Users WHERE UserLogonID=@UserLogonID"; SqlCommand cmdCheckUser = new SqlCommand(); cmdCheckUser.CommandText = CheckUser; SqlParameter paramUsr = new SqlParameter( "@UserLogonID", SqlDbType.VarChar ); paramUsr.Value = loginID.ToString(); cmdCheckUser.Parameters.Add( paramUsr ); DataSet users = new DataSet(); try { users = DbUtils.GetDataSet( cmdCheckUser ); } catch ( Exception e ) { login = LoginResult.Failure; return login; } if ( users.Tables[0].Rows.Count==0 ) { login = LoginResult.NoUser; } login = LoginResult.WrongPwd; foreach ( DataRow row in users.Tables[0].Rows ) { if ( row["Password"].ToString() == pwd ) { // use stored procedure to get organisation name // instead of user name if user is organization Int32 userID; String userName; UserRole role; try { userID = Convert.ToInt32( row["UserID"] ); userName = row["userName"].ToString(); role = (UserRole)( Convert.ToInt32( row["UserRoleID"] ) ); } catch ( Exception e ) { return LoginResult.Failure; } switch ( (UserRole)(Convert.ToInt32(row["UserRoleID"])) ) { case UserRole.Client: u = new Client(); return LoginResult.Client; case UserRole.Specialist: u = new Specialist( userID, userName, role ); return LoginResult.Specialist; case UserRole.Worker: u = new Worker( userID, userName, role ); return LoginResult.Worker; case UserRole.Admin: u = new Admin(); return LoginResult.Admin; default: return LoginResult.Failure; } } } return login; }