Using credentials with a web service -- what our my options?

Question

Hi All,
I'm trying to determine what options I have in regards to
setting credential requirements on my web services. The two options
seem to be:
-Basic authentication
-SOAP header authentication.
I see that the WebService class has a "setCredentials"
method, but I haven't had much success with it. Here's the
documentation reference:
http://livedocs.adobe.com/labs/flex/3/langref/mx/rpc/AbstractService.html#setCredentials()
It says: "Set the credentials for the destination accessed by
the service ... Note that services that use a proxy or a
third-party adapter to a remote endpoint will need to
setRemoteCredentials instead."
Great, I'm not using a proxy, so I figured it would work. I
thought I would try it with SOAP header auth. I setup a simple
ASP.NET web service that users SOAP header auth, and decided to
test it out. Attached is my complete MXML (I also tried using SSL).
The Flash player threw the following error:
[MessagingError message='Authentication not supported on
DirectHTTPChannel (no proxy).']
at mx.messaging.channels::DirectHTTPChannel/setCredentials()
at mx.messaging::ChannelSet/setCredentials()
at mx.messaging::MessageAgent/setCredentials()
at mx.rpc::AbstractService/setCredentials()
at SoapHeaderAuthenticatedServicesTest/handleLoad()
at
flash.events::EventDispatcher/flash.events:EventDispatcher::dispatchEventFunction()
at flash.events::EventDispatcher/dispatchEvent()
at mx.rpc::AbstractService/dispatchEvent()
at mx.rpc.soap::WebService/
http://www.adobe.com/2006/flex/mx/internal::wsdlHandler()
at
flash.events::EventDispatcher/flash.events:EventDispatcher::dispatchEventFunction()
at flash.events::EventDispatcher/dispatchEvent()
at mx.rpc.wsdl::WSDLLoader/private::checkLoadsOutstanding()
at
mx.rpc.wsdl::WSDLLoader/mx.rpc.wsdl:WSDLLoader::resultHandler()
at
flash.events::EventDispatcher/flash.events:EventDispatcher::dispatchEventFunction()
at flash.events::EventDispatcher/dispatchEvent()
at mx.rpc::AbstractInvoker/
http://www.adobe.com/2006/flex/mx/internal::dispatchRpcEvent()
at mx.rpc::AbstractInvoker/
http://www.adobe.com/2006/flex/mx/internal::resultHandler()
at mx.rpc::Responder/result()
at mx.rpc::AsyncRequest/acknowledge()
at private::DirectHTTPMessageResponder/completeHandler()
at
flash.events::EventDispatcher/flash.events:EventDispatcher::dispatchEventFunction()
at flash.events::EventDispatcher/dispatchEvent()
at flash.net::URLLoader/flash.net:URLLoader::onComplete()
at [io]
Interesting -- "Authentication not supported on
DirectHTTPChannel (no proxy)" -- but the docs made it sound like
that's precisely when you were to use setCredentials. If using a
proxy, you would use setRemoteCredentials.
So... what's up? How do I use setCredentials? And is it for
use with SOAP header authentication, Basic authentication, or
something else?

Answer 1

quote:
Originally posted by:
pete
...Other times you see operations requiring credentials in
SOAP headers...
Pete
This is what I'm currently pursuing. I did not have much
success with Basic authentication (didn't work at all in IE, and,
as you mentioned, even in browsers where it worked, if the
username/password is wrong, the Flex UI can't intercept the login
failure, and the user gets that ugly login popup).
But, I'm not having much success. Here's what the SOAP
request *should* look like, for my test web service that uses SOAP
headers for authentication. I used a Visual Studio generated proxy
class to make this call, and it returned the expected data from the
web service (i.e., the SOAP authentication worked).
<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:soap="
http://schemas.xmlsoap.org/soap/envelope/"
xmlns:xsi="
http://www.w3.org/2001/XMLSchema-instance"
xmlns:xsd="
http://www.w3.org/2001/XMLSchema">
<soap:Header>
<AuthHeader xmlns="
http://intranet/WebServices/">
<UserName>TestUser</UserName>
<Password>TestPassword</Password>
</AuthHeader>
</soap:Header>
<soap:Body>
<HelloWorld xmlns="
http://intranet/WebServices/"
/>
</soap:Body>
</soap:Envelope>
Now, I want to set this up in Flex as well. Here's what I
tried:
// Called when the WSDL is finished loading
public function handleLoad(event:Event):void{
var qName : QName = new QName( "
http://intranet/WebServices/",
"AuthHeader" );
var authXml : XML = <AuthHeader>
<UserName>TestUser</UserName>
<Password>TestPassword</Password>
</AuthHeader>;
var auth : SOAPHeader = new SOAPHeader( qName, authXml );
service.addHeader(auth);
service.HelloWorld();
No errors are thrown by Flex, however, the SOAP
authentication fails (I get the expected "access denied" response
from the web service). I used Wireshark to see what traffic was
being sent back and forth, and this is what I see for the request
from Flex:
<SOAP-ENV:Envelope xmlns:SOAP-ENV="
http://schemas.xmlsoap.org/soap/envelope/"
xmlns:s="
http://www.w3.org/2001/XMLSchema"
xmlns:xsi="
http://www.w3.org/2001/XMLSchema-instance">
<SOAP-ENV:Header></SOAP-ENV:Header>
<SOAP-ENV:Body>
<tns:HelloWorld xmlns:tns="
http://intranet/WebServices/"/>
</SOAP-ENV:Body>
</SOAP-ENV:Envelope>
Emphasis mine. Note that the SOAP header is empty -- what's
going on?