The SOAP and WS-Security formats, although very verbose when compared to RESTful implementations, have a much more advanced security model. They give the ability to override the authentication used within IIS (which uses Active Directory). By moving the credentials (username and password) from the HTTP headers into the XML of the message, one can use the UserNamePasswordValidator class to implement custom authentication.

Here's an article I wrote for the Next Generation User Group giving all the technical details.

Well, Fest 08 was a great success with 'Data Today, Data Tomorrow'. Loved the sessions and the usual Dave and Rich game show.

Here's a write up of the day:

http://www.nxtgenug.net/Article.aspx?ArticleID=283

and here's a shot of Dave McMahon giving a live demonstration of various yoga positions. Don't ask......