Procedure 14-2. Update the ValidatorServiceClass

1. Right-click on the Validation.asmx file in Solution Explorer, and select View Code from the shortcut menu.

2. Declare a public member in ValidatorServiceClass of type SecurityHeader. This member will hold the data contained in the SecurityHeader SOAP Header when the ValidateCard Web method is invoked. The highlighted code that follows shows the changes you need to make to ValidatorServiceClass to declare the new member.

   Example 14-3. C#

   [WebService(Namespace="http://mycompany.com/webservices/",
       Name="ValidatorService",
       Description="A service to validate credit card numbers.")]
   public class ValidatorServiceClass: System.Web.Services.WebService
   {
       // declare a public member of type 
       // SecurityHeader to hold the SOAP 
       // header received in the request
       public SecurityHeader o_securityHeader;

   Example 14-4. Visual Basic .NET

   <WebService(Namespace:="http://mycompany.com/webservices/", _
       Name:=" ValidatorService", _
       Description:="A service to validate credit card numbers.")> _
   Public Class ValidatorServiceClass
       Inherits System.Web.Services.WebService
   
       ‘ declare a public member of type 
       ‘ SecurityHeader to hold the SOAP 
       ‘ header received in the request
       Public o_securityHeader As SecurityHeader

3. In the Validation.asmx code view window, locate the ValidateCard method and replace it with the following code; the changes from the existing ValidateCard method are highlighted in bold.

   We have applied the SoapHeader attribute to the ValidateCard method. The constructor argument identifies the name of the ­member in which to store the received SOAP header. The Direction parameter specifies that the SOAP header is included in both requests and responses. The Required parameter specifies that this header is mandatory.

   When the ValidateCard method is invoked, the first operation we perform is to call the AuthenticateUser method. (We will add this method in the following steps.) The AuthenticateUser method returns true if the credentials supplied in the SecurityHeader are correct; ­otherwise, it returns false. If we get a true result, we continue processing the credit card validation request as normal. If we get a false response, we throw a SoapHeaderException, which is returned to the client.

   Example 14-5. C#

   [WebMethod(EnableSession=true)]
   [SoapHeader("o_securityHeader",
       Direction = SoapHeaderDirection.InOut,
       Required = true)]
   public void ValidateCard(ref ValidationObject p_object) {
       // authenticate the user name and password contained 
       // in the Soap Header, it is automatically stored in 
       // the o_securityHeader member as specified by the 
       // SoapHeader attribute.
       if (AuthenticateUser() == false) {
           // authentication failed, throw a SoapHeaderException
           // indicating access denied
           throw new SoapHeaderException("Access Denied", 
               new XmlQualifiedName("Client.AcessDenied"));
       }
   
       // define a boolean to hold the result
       // of the validation request.
       bool x_result = false;
   
       // define a boolean to indicate if the
       // validation request resulted in an
       // exception being thrown by the 
       // CreditCardValidator.dll library
       bool x_error = false;
   
       try {
           // create the validator instance that we will
           // use to check the card number
           Validator x_validator = new Validator();
   
           // use the type of card supplied in the 
           // validation object to determine which
           // library method we should call in order
           // to perform the validation.
           switch (p_object.o_card_type) {
               case CARD_TYPE.AMEX:
                   // the client has requested that we validate
                   // an AMEX card number
                   x_result = x_validator.ValidateAMEX(
                       p_object.o_card_number);
                   break;
               case CARD_TYPE.MASTERCARD:
                   // the client has requested that we validate
                   // an MasterCard card number
                   x_result = x_validator.ValidateMasterCard(
                       p_object.o_card_number);
                   break;
               case CARD_TYPE.VISA:
                   // the client has requested that we validate
                   // an VISAcard number
                   x_result = x_validator.ValidateVisa(
                       p_object.o_card_number);
                   break;
               default:
                   // the method should not reach this point; if it
                   // does, it is because the client has specified
                   // a value which is not contained in the CARD_TYPE
                   // enumeration. Should this happen, the client has 
                   // requested that we validate a card type that we 
                   // do not support.
                   x_result = false;
                   break;
           }
       } catch (ApplicationException x_ex) {
           // update the variable to indicate 
           // that an exception has been thrown by
           // CreditCardValidator.dll library
           x_error = true;
   
           // return a soap exception with a custom fault 
           // code based on  the type of the application 
           // exception
           throw GetException(x_ex);
       } finally {
           // get the status object for this client
           ClientStats x_stats = GetClientStatistics();
           // increment the counter for the total
           // number of requests
           x_stats.o_total_requests++;
           // if the result was not true, or if an
           // exception was thrown, then update the
           // failed request counter
           if (x_error || !x_result) {
               x_stats.o_failed_validations++;
           }
   
           // set the result status in the validation object
           p_object.o_valid = x_result;
   
           // update the array list held in the application
           // state to reflect the new request
           ArrayList x_list = 
               (ArrayList)Application["ValidationObjects"];
           //      if (x_list == null) {
           //          x_list = new ArrayList();
           //          Application["ValidationObjects"] = x_list;
           //      }
           x_list.Add(p_object);
       }
   }

   Example 14-6. Visual Basic .NET

   <WebMethod(EnableSession:=True), _
       SoapHeader("o_securityHeader", _ 
       Direction := SoapHeaderDirection.InOut, _
       Required := true)> _
   Public Sub ValidateCard(ByRef p_object As ValidationObject)
       ‘ authenticate the user name and password contained 
       ‘ in the Soap Header, it is automatically stored in 
       ‘ the o_securityHeader member as specified by the
       ‘ SoapHeader attribute.
       If AuthenticateUser() = false Then
           ‘ authentication failed, throw a SoapHeaderException
           ‘ indicating access denied
           Throw new SoapHeaderException("Access Denied", _
               new XmlQualifiedName("Client.AcessDenied"))
       End If
   
       ‘ define a boolean to hold the result
       ‘ of the validation request.
       Dim x_result As Boolean
   
       ‘ define a boolean to indicate if the
       ‘ validation request resulted in an
       ‘ exception being thrown by the 
       ‘ CreditCardValidator.dll library
       Dim x_error As Boolean = False
   
       Try
           ‘ create the validator instance that we will
           ‘ use to check the card number
           Dim x_validator As Validator = New Validator()
   
           ‘ use the type of card supplied in the 
           ‘ validation object to determine which
           ‘ library method we should call in order
           ‘ to perform the validation.
           Select Case p_object.o_card_type
               Case CARD_TYPE.AMEX
                   ‘ the client has requested that we validate
                   ‘ an AMEX card number
                   x_result = x_validator.ValidateAMEX( _
                       p_object.o_card_number)
               Case CARD_TYPE.MASTERCARD
                   ‘ the client has requested that we validate
                   ‘ an MasterCard card number
                   x_result = x_validator.ValidateMasterCard( _
                       p_object.o_card_number)
               Case CARD_TYPE.VISA
                   ‘ the client has requested that we validate
                   ‘ an VISAcard number
                   x_result = x_validator.ValidateVisa( _
                       p_object.o_card_number)
               Case Else
                   ‘ the method should not reach this point; if it
                   ‘ does, it is because the client has specified
                   ‘ a value which is not contained in the CARD_TYPE
                   ‘ enumeration. Should this happen, the client has 
                   ‘ requested that we validate a card type that we 
                   ‘ do not support.
                   x_result = False
           End Select
       Catch x_ex As ApplicationException
           ‘ update the variable to indicate 
           ‘ that an exception has been thrown by
           ‘ CreditCardValidator.dll library
           x_error = True
   
           ‘ return a soap exception with a custom fault 
           ‘ code based on  the type of the application 
           ‘ exception
           Throw GetException(x_ex)
       Finally
           ‘ get the status object for this client
           Dim x_stats As ClientStats = GetClientStatistics()
           ‘ increment the counter for the total
           ‘ number of requests
           x_stats.o_total_requests = x_stats.o_total_requests + 1
   
           ‘ if the result was not true, or if an
           ‘ exception was thrown, then update the
           ‘ failed request counter
           If x_error Or Not x_result Then
               x_stats.o_failed_validations = _
                   x_stats.o_failed_validations + 1
           End If
   
           ‘ set the result status in the validation object
           p_object.o_valid = x_result
   
           Dim x_list As ArrayList = _
               CType(Application("ValidationObjects"), ArrayList)
           ‘ check to ensure that we have a list to work with - if the
           ‘ value returned from the Application object is null, this 
           ‘ is the first request made to the XML Web service method,
           ‘ and we should create the list for use by future calls
           ‘If x_list Is Nothing Then
           ‘    x_list = New ArrayList()
           ‘    Application("ValidationObjects") = x_list
           ‘End If
           ‘ update the array list held in the application
           ‘ state to reflect the new request
           x_list.Add(p_object)
   
       End Try
   End Sub

4. Add the new AuthenticateUser method listed below as a member of the ValidatorServiceClass class.

   When the AuthenticateUser method is called, we check the o_user and o_password fields of the o_securityHeader member to see whether they match our hard-coded values of admin and password. If the o_user and o_password fields are correct, we generate a String containing the current date and time and assign it to the o_security­Header.o_timestamp member. This timestamp is passed back to the client application in a SecurityHeader SOAP header as part of the ValidateCard Web method response. If the user name and password are incorrect, we return false.

   Example 14-7. C#

   private bool AuthenticateUser() {
       // perform a case insensitive comparison of the user 
       // name contained in the SOAP header with our hard-coded 
       // account name.
       if (o_securityHeader.o_user.ToLower() == "admin") {
           // perform a case insensitive comparison of the 
           // password contained in the SOAP header with our 
           // hard-coded password.
           if (o_securityHeader.o_password.ToLower() == "password") {
               // user and password are valid, set the timestamp 
               // in the SOAP header to the current time. this will
               // be passed back to the client.
               o_securityHeader.o_timestamp = DateTime.Now.ToString();
   
               // return true to indicate successful authentication
               return true;
           }
       }
       // return false to indicate failed authentication
       return false;
   }

   Example 14-8. Visual Basic .NET

   Private Function AuthenticateUser() As Boolean
       ‘ perform a case insensitive comparison of the user 
       ‘ name contained in the SOAP header with our hard-coded 
       ‘ account name.
       If o_securityHeader.o_user.ToLower() = "admin" Then
           ‘ perform a case insensitive comparison of the 
           ‘ password contained in the SOAP header with our 
           ‘ hard-coded password.
           If o_securityHeader.o_password.ToLower() = "password" Then
               ‘ user and password are valid, set the timestamp 
               ‘ in the SOAP header to the current time. this will
               ‘ be passed back to the client.
               o_securityHeader.o_timestamp = DateTime.Now.ToString()
    
               ‘ return true to indicate successful authentication
               Return True
           End If
       End If
       ‘ return false to indicate failed authentication
       Return False
   End Function

5. Build the ValidatorService project by selecting Build Solution from the Build menu or pressing Ctrl+Shift+B.