security level - Connecting to Navision via web service

heveen

Hello Guys
I have exposed Page and codeunit as web service.
I have able to connect to the web service through a .NET client as well as Php client.
Everything works fine...
But the problem comes at the security level.
My clients access the web service through http soap request.... a basic authentication process that navision web service provide.

My questions are:-
1. How much secure is this process?... is the username/password exposed as plain text on the internet?
2. How can i add a security layer before accessing the Navision? i mean what kind of security layer i can add to make my web services more secure.?
3. My company said that he do not want his client to has direct access to the Page web service..
My company think that the clients are accessing the database directly... :P

So, is it a good idea to create a proxy ( just like Freddy's blog)

I need more ideas on security...
Hope you will help me out..

Heveen

agentz

first of all get an ssl
force all traffic to go to ssl in iis (there's an install package for this in iis)

then all traffic including passwords is encrypted.
YES, write a proxy external layer of webservices for your clients to consume.
use a membership provider like the one that comes with .net, the asp net user membership db. very easy to use and manipulate.

to answer your questions:
My questions are:-
1. How much secure is this process?... is the username/password exposed as plain text on the internet? [very secure if you use ssl. credentials and all traffic is encrypted via the ssl. install the iis7 package that forces ssl on port 443 (google for it)]
2. How can i add a security layer before accessing the Navision? i mean what kind of security layer i can add to make my web services more secure.?[again, the ssl is key. it encrypts everything. you can also require that webservices have username as string and password as string params - pass these to a validation function which checks the user's role and validates credentials.]
3. My company said that he do not want his client to has direct access to the Page web service..
My company think that the clients are accessing the database directly...
[to ensure this does not happen, only publish the webservices in a public folder which you use to call the core webservices. never expose the core services to the external world. just a bad practice.]

i have code for all of this if you need it.