WSE 2.0 UsernameToken Authentication Tidbits

WSE 2.0 provides two main authentication models: 

• Windows authentication. WSE 2.0 automatically authenticates incoming UsernameTokens (via LogonUser) when the password is supplied in plain text (PasswordOptions.SendPlainText). You should only use this option if:
• You encrypt the UsernameToken element
• You're using a secure channel (e.g. SSL)
• Custom authentication. WSE 2.0 makes it possible to implement a custom authentication scheme through a UsernameTokenManager-derived class (UTM). This allows you to store credentials in SQL Server, for example. It also has the following benefits:
• You can send a hashed password (PasswordOptions.SendHashed). WSE will regenerate the hash from the password it gets from your UTM as proof-of-possession.
• You can sign the message with a UsernameToken and avoid sending the password altogether (PasswordOptions.SendNone). WSE will verify the signature using the password it gets from your UTM as proof-of-possession.

You should always sign your SOAP messages when security is an issue. Hence, the last option (UTM + signature + SendNone) is probably the best fit. Unless you need to use Windows authentication for some reason, then you should use one of the first options (SendPlainText + encryption).