UsernameTokenManager Class

Article
09/15/2006

Represents a security token manager for UsernameToken security tokens.

Namespace: Microsoft.Web.Services2.Security.Tokens
Assembly: Microsoft.Web.Services2 (in microsoft.web.services2.dll)

Usage

'Usage
Dim usernameTokenManager1 As New UsernameTokenManager()

Syntax

'Declaration
Public Class UsernameTokenManager
    Inherits SecurityTokenManager

public class UsernameTokenManager : SecurityTokenManager

public ref class UsernameTokenManager : public SecurityTokenManager

public class UsernameTokenManager extends SecurityTokenManager

public class UsernameTokenManager extends SecurityTokenManager

Example

The following code example shows how to build a custom UsernameTokenManager.

<SecurityPermissionAttribute(SecurityAction.Demand, Flags:=SecurityPermissionFlag.UnmanagedCode)> _
Public Class PasswordProvider
    Inherits UsernameTokenManager

    Public Sub New()
    End Sub 'New

    ' Returns the password or password equivalent for a user name.
    Protected Overrides Function AuthenticateToken(ByVal token As UsernameToken) As String _
        ' Ensure the SOAP message contained a UsernameToken.
        If token Is Nothing Then
            Throw New ArgumentNullException
        End If

        ' This is a very simple provider.
        ' In most production systems the following code 
        ' typically consults an external database to obtain the password or
        ' password equivalent for a given user name.

        Dim password As Byte() = System.Text.Encoding.UTF8.GetBytes(token.Username)
        Array.Reverse(password)

        Return Convert.ToBase64String(password)
    End Function 
End Class

[SecurityPermissionAttribute(SecurityAction.Demand, Flags=SecurityPermissionFlag.UnmanagedCode)]
public class CustomUsernameTokenManager : UsernameTokenManager
{
   // Returns the password or password equivalent for a user name.
    protected override string AuthenticateToken(UsernameToken token)
    {
        // Ensure the SOAP message contained a UsernameToken.
        if (token == null)
            throw new ArgumentNullException();

        // This is a very simple provider.
        // In most production systems the following code 
        // typically consults an external database to obtain the password or
        // password equivalent for a given user name.


        byte[] password = System.Text.Encoding.UTF8.GetBytes(token.Username);
        Array.Reverse(password);

        return Convert.ToBase64String(password);        
    }
}

Remarks

This class is used to parse UsernameToken security tokens within incoming SOAP messages. WSE provides a default implementation that authenticates all UsernameToken security tokens in a received SOAP message against a Windows account. WSE calls the Win32 LogonUser function for this authentication. If it succeeds, a Windows principal is assigned to the Principal property of the UsernameToken.

To use the default UsernameTokenManager to parse UsernameToken security tokens on Windows XP and Windows 2000, the user account that the ASPNET account runs under must be given the Log on locally permission. This is because WSE calls LogonUser using the user name and password found in the UsernameToken.

When you do not want the WSE to authenticate the UsernameToken against a Windows account, derive a class from UsernameTokenManager and override the AuthenticateToken method. Then register your derived class in the configuration file using the Type attribute of the <securityTokenManager> element. For more information, see <securityTokenManager> Element .

Note

The UsernameTokenManager does not impersonate on the current thread with the credentials found in the UsernameToken.

Inheritance Hierarchy

System.Object
Microsoft.Web.Services2.Security.Tokens.SecurityTokenManager
Microsoft.Web.Services2.Security.Tokens.UsernameTokenManager

Thread Safety

Any public static (Shared in Visual Basic) members of this type are thread safe. Any instance members are not guaranteed to be thread safe.

Platforms

Development Platforms

Windows XP Home Edition, Windows XP Professional, Windows Server 2003, Windows Longhorn, and Windows 2000

Target Platforms

Windows 2000, Windows 2000 Server, Windows 2000 Advanced Server, Windows XP Home Edition, Windows XP Professional, Windows Server 2003, Windows Longhorn, Pocket PC, Windows CE, Smart Phone