Update: Christian Weyer was kind enough to set me straight. HTTP.SYS support in VS2005 means you can dump IIS on the OSs that have it (WS2K3 and XP SP2). Of course he doesn't reference any resource that explain how. But, hey, VS2005 just made it Beta!
I recently gave someone bad information about Visual Studio 2005. I said that you could run Whidbey web services without IIS. I was wrong. Another case of memory bleeding. The truth seems to be:
- Indigo will not need IIS (here)
- VS2005 includes managed HTTP.SYS support (here, scroll down to 2004-03-24 HTTP.SYS, Indigo, and Windows XP SP2)
- VS2005 ASP.NET Web Applications do not need IIS for local access (here, half way down)
Don Box, if your listening: You really need to fix your posting links! The links you left on my post are dead and I have to link to the monthly link and tell people to scroll around. You are too valuable a resource for this.
Steve Mane has an excellent post comparing three strategies for user authentication and authorization. The three scenarios are:
- Client Managed
- Service Managed
- 3rd Party (Federated) Security
Each of these scenarios is compared against authentication and role-based authorization. His conclusion?
WSE2 is a big step forward in term of secure web services, but it’s not the endgame just yet. There’s a lot that can be done with WSE2 out of the box directly. Integrating with Windows domain authentication is a big step; it solves one part of the role-based security puzzle. If all your services can talk to the same NT credential store, you can auto-issue SCT’s to your heart’s content and at least have what I describe as “Option B” taken care of (with the added benefit of having a unified cross-service credential store). It’s not the general-case, interoperable solution that pan-enterprise web services need to succeed, but it’s a step in the right direction. The real solution lies in federating identities, and that’s something for which we’ll just have to wait.
He links to a post I just found recently that I want to blog more on later: the time-line for SAML, Liberty Alliance, and WS-Federation. I just wish it were yesterday!