Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have two WebServices that are hosted by two different applications. Both Applications access each other's webservices:

2 Webservices

Now both WebServices have to authenticate with each other. Different solutions came to mind.

  • Create a Authentification Server
  • Each application has a config file: Put a generated key in there.

What are solutions for this problem?

share|improve this question

closed as too broad by Xander, schroeder, Iszi, AviD Jun 10 '14 at 23:16

There are either too many possible answers, or good answers would be too long for this format. Please add details to narrow the answer set or to isolate an issue that can be answered in a few paragraphs.If this question can be reworded to fit the rules in the help center, please edit the question.

I disagree, it is not just an implementation problem, it is definitely a security issue. However, there are just too many possible solutions to go into, without having some more detail on your context, risk profile, technologies, network, environment, etc etc etc. – AviD Jun 10 '14 at 23:16

You can use WS-Security to sign requests. Depending on your application stack, you can even have a local CA sign the certificates, and use the CA signature to verify any of an arbitrary set of clients.

share|improve this answer

The "best" answer depends on your server arrangement, your threat model, your security model, your vulnerability profile, your maintenance program, and dozens of other factors.

Essentially you're asking "what is the best authentication mechanism?" -- to which the answer clearly is, "no."

But let me throw out some options:

  • Shared secret with digest-based authentication
  • Digest-based secret storage with plaintext authentication
  • Certificate-based authentication with a single trusted signing certificate
  • Certificate-based authentication with explicit trust of all allowed certificates
  • Certificate-based authentication with a global PKI
  • IP-based trust with no authentication
  • IP-based trust in addition to authentication
  • Requests tunneled over an authenticated channel (e.g. SSH)
  • Requests passed over a VPN in addition to or in lieu of any of the above

And I could keep going if I had the patience for it. Each system has its place, and I could come up with a compelling situation where any of the above is appropriate, and a compelling situation where any of the above is wildly inappropriate.

It all depends.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.