This post originated from an RSS feed registered with .NET Buzz by Scott Watermasysk. Original Post: WS-Security: What if you are already Hashed? Feed Title: ScottW's ASP.NET WebLog Feed URL: /error.aspx?aspxerrorpath=/blog/rss.aspx Feed Description: ASP.NET and Blogging Latest .NET Buzz Posts Latest .NET Buzz Posts by Scott Watermasysk Latest Posts From ScottW's ASP.NET WebLog

So I have my passwords hashed and salted like a good boy. I am trying to validate a web service user against this data store. Based on a couple good examples from Don Smith here, I quickly put together a simple UsernameTokenManager.

Now comes time to validate my password...

But as far as I can tell, there is now way to "hook" into the password validation. So unless I hash+salt my password (before WSE applies it's own hash), I am SOL.

I found a couple other's with the same issue, but no clear solution. Anyone have any ideas? I would love to take advantage of WS-Security while still obeying KISS!

It's hard to believe this is not possible. The default Whidbey providers are going to store passwords the same way, so will they be locked out as well?