Hi there,
I am trying to get my head around how web services in Domino 7.0 facilitate security especially with regards to the security context for a specific user running a web service.
On the secuirty tab for the web service properties you have the following setting (taken straight from the Designer help":
“Run as web user – The Java or LotusScript code runs with the effective user name of the user invoking the Web service.”
Now I understand how this setting is supposed to work for a web agent, i.e. the user authenticates with the application (through the browser) before selecting the link that will execute an agent (or s/he would get prompted to authenticate when selecting the link).
What I am struggling with is how a foreign application (the web service consumer) is supposed to authenticate with the Domino environment in order to establish the security context for the execution of the web service.
Now I could handover the user credentials as input parameters for calling the web service and verify themmanually. That however would not determine whether the user would be allowed to use the wqeb service and essentially I would again have to check manually whetherthis particular user is allowed to use the web service or not.
Somehow I can’t see that this is how it’s supposed to work. I am thinking that I must be missing something obvious… =(
Any help/pointers appreciated.
Mike.