Internet Information Services will authorize access to the XML Web service if the credentials match a valid user account. Integrated Windows authentication Useful only for intranet scenarios. Uses NTLM or Kerberos. Cannot be used across proxy servers or other firewalls. Internet Information Services will authorize access to the XML Web service if the credentials match a valid user account.
Client certificates Requires each client to obtain a certificate.
Certificates are mapped to user accounts, which are used by Internet Information Services for authorizing access to the XML Web service. A viable option for Internet scenarios, although use of digital certificates is not widespread at this time. Another option is to implement a custom mechanism. For example, if you are sending SOAP messages, you can define your XML Web service contract so that client credentials are passed in the SOAP message itself. With this approach, you need to retrieve the credentials from the message and implement your own authorization logic, but you can use any kind of client account database you want.