web services - Microsoft sync framework Authentication -

web services - Microsoft sync framework Authentication -

i'm novice when comes web applications , asp.

recently, i've been experimenting microsoft sync toolkit synchronize databases on odata web service.

the obvious question here is: 1 time service set , published - open knowing url - how prevent unauthorized users accessing service.

please note: basic authentication of forms authentication - far little web development knowledge reaches - doesn't seem appropriate task, it's not web page client trying reach - page can display / or re-direct logon request - it's service accessing here.

to create things more difficult, client-side syncing i'm using 3rd party library/sync-provider accepts url service. so, there's no way (i think) can experiment incorporating login credentials within request header etc.

i assume best bet embedding login credentials within url , utilize 3rd party library.

can please direct me how to set such thing on server? prefer have somehow somewhere in server-side code place can check credentials , based upon proceed or abort (return 401) service request.

i not find place hook such code sync service. although in msdn suggested handle _onbeginsyncrequest event, there no way access web-request header within method.

is there by-any-chance global object accessible everywhere can access request header? please help this?

and last, prefer plain user / password string pair. should not (or rather not) have windows or directory accounts. prefer in code simple check against plain strings, such if(userstr == "authenticated user" && passwordstr == "correct password").

if using soap web service, can utilize ws-security usernametoken adds user name , password request header, otherwise can add together username , password parameters in webservice , validate on server side. i.e.

instead of

bool syncdata(datatable)

it becomes

bool syncdata(datatable, username, password)

note web service authenticate per call, if want per session, need first login username password, retrieves token on each subsequent phone call service token.

you utilize ssl secure channel username , password aren't transmitted plain text.

web-services authentication asp-classic synchronization