A new version of the Web Services Enhancement (WSE) toolkit offers support for the latest versions of some key Web services security standards and improved integration with Visual Studio. However, it comes at the same time that Microsoft is encouraging developers to begin evaluating the Windows Communication Framework, another Web services framework that is not source-code compatible with WSE but will be included with Windows Vista and available as an add-on to current versions of Windows.

WSE is Microsoft's toolkit for advanced Web service developers who want to use Web services protocols not yet supported in Microsoft's other developer products, such as Windows and ASP.NET. Because its goal is to keep up with the various Web service protocols (often denoted as WS-*) as they are developed and standardized, WSE is updated frequently and Microsoft makes no guarantees of version-to-version compatibility. Indeed, WSE 3.0 is not source-code compatible with previous versions and developers will need to modify their code if they choose to upgrade.

What's New in WSE 3.0?

WSE 3.0 includes several new features that help developers build secure Web services, including the following:

Turnkey security profiles. WSE 3.0 includes a number of preselected security profiles that configure how a Web service performs authentication, allowing developers to concentrate on the business logic of their services. Examples of WSE 3.0's security profiles include UsernameOverTransport, which uses SSL encryption along with a username and password; MutualCertificate, in which the client and server exchange X.509 certificates; and Kerberos.

Updated WS-* support. Several WS-* specifications have changed since the previous version of WSE was released. WSE 3.0 includes support for the latest versions of WS-Addressing, WS-SecureConversations and WS-Security. However, this means that WSE 3.0 is not wire-level compatible with previous versions.

VS 2005 support. A new add-in to Visual Studio 2005 gives developers the ability to more easily configure a WSE-based Web service. For example, a Security Settings Wizard allows developers to choose from one of the built-in security profiles or select their own security settings. However, the add-ins are not supported on the Express Editions of Visual Studio.

WSE or WCF?

The biggest dilemma that potential users of WSE face is whether to go ahead and develop Web services now with WSE or wait for the release of the Windows Communication Framework (WCF), formerly code-named Indigo. Unlike WSE, which is focused primarily on the Web services protocols for security, WCF promises to be a comprehensive platform that supports the broad set of Web service protocols.

The two frameworks have different APIs, and source code written for one is not compatible with the other. In addition, WSE makes no attempt to hide the XML message nature of the underlying protocols. WCF, in contrast, builds a number of higher-level abstractions that theoretically allow developers to build Web services without understanding the asynchronous, message-oriented nature of the underlying protocols. It is worth noting, however, that some developers prefer the WSE model precisely because it doesn't try to hide the underlying protocols. These developers maintain that any attempt to hide the reality of the message-based protocols will only result in less stable, less maintainable and, ultimately, less reliable systems.

Despite the differences in APIs and style, WSE 3.0 is wire-level compatible with WCF, meaning that services developed with the two frameworks can exchange messages using any of the supported Web service protocols.

Requirements and Resources

WSE 3.0 requires Windows 2000 or later, IIS 5.0 or later, and the .NET Framework 2.0. The Visual Studio add-ins require Visual Studio 2005 Standard Edition or higher and therefore do not work on any of the Express Editions of Visual Studio.

For more on what's new in WSE 3.0, see msdn.microsoft.com/webservices/default.aspx?pull=/library/en-us/dnwse/html/newwse3.asp.

For information on WCF, see "Vista Communication Layer Targets Web Services".

John Cavnar-Johnson, an independent developer and trainer, has several discussions of WSE vs. WCF on his blog. Posts at pluralsight.com/blogs/johncj/archive/2005/08/12/14077.aspx and pluralsight.com/blogs/johncj/archive/2005/08/14/14100.aspx are particularly interesting for developers weighing their merits.