Microsoft hails security focus in Web services package

Microsoft on Monday is releasing an upgrade to its free WSE (Web Services Enhancements) package for Windows developers, focusing on security.

An add-on component to Visual Studio 2005 and the .Net Framework 2.0, WSE 3.0 "dramatically simplifies the development of secure Web services," said Ari Bixhorn, director Web services strategy at Microsoft. WSE 3.0 also serves as a prelude to the planned Windows Communication Foundation (WCF) for Web services, formerly known as Indigo, which is planned for inclusion in the Vista release of Windows in 2006, Bixhorn said.

"Developers are going to see a 30 percent improvement in the performance of their Web services, upgrading from WSE 2.0 to WSE 3.0," Bixhorn said.

The package includes turnkey security profiles. "What those do is allow developers to build five of the most common secure Web services scenarios with just a few clicks of a mouse," Bixhorn said. One profile features the building of a secure Web service that can be called via the Internet using a name and password.

"Developers are going to benefit greatly from these profiles because [they] dramatically reduce the amount of code that they have to write to build secure Web services," Bixhorn said.

"WSE 3.0 is really a bridge," to Indigo, said a user of the package, Andy Neilson, a senior software architect at Kinaxis, which develops software for manufacturers.

WSE technology has helped Kinaxis make its application flexible, according to Neilson. "The problem with security is that it's not a one-size-fits-all problem," he said. Different clients have different requirements, Neilson noted. "What's different about what's in WSE and Indigo and Web services in general is [they] allow you to say, 'That's something we can configure later,' " without having to rewrite the application itself, Neilson said.

Also featured in WSE 3.0 is expanded support for WS-* (pronounced "WS star") Web services specifications. MTOM (Message Transmission Optimization Mechanism) support is included for building secure Web services that include attachments such as documents or media files. MTOM supercedes the previous WS-Attachments specification.

Updated support for the WS-SecureConversation and WS-Trust specifications is also in WSE 3.0, offering better performance, according to Bixhorn.

WSE 3.0 also supports 64-bit Windows platforms and allows for building Web services that can communicate across a variety of protocols, including TCP, HTTP, and custom protocols. Web services built using WSE 3.0 will be interoperable with WCF when that ships.

"The fact that WSE 3.0 is an add-on to Visual Studio 2005 and .Net 2.0 and released alongside Visual Studio 2005 is actually one of its strengths," said Jason Bloomberg, senior analyst at ZapThink, in an e-mail. "Developers who leverage these technologies will benefit by the greater consistency across the tools. For developers looking to work with WCF, they will also see consistency in the programming model and API from WSE to WCF."