What is the optimal architecture for such case:
- Web application(.Net Web Forms) connects to third party web service via wcf.
- Third party web service accepts only digitally signed soap requests
- Some typical business processes consist of several soap requests.
- User must start business process (send several soap requests) via web application and digitally sign it in the front-end by its certificate (smart-card holding its certificate). Web application doesn't store any user certificates, it only stores user data that must be sent to web service.
My current thoughts are to create some proxy web service that would intercept user soap requests without digital signatures and put them into database. Then user would open some web form where he would see all requests that he must digitally sign. User signs requests via some web browser plugin. As the result of that operation web application gets digitally signed requests that it can send to original web service.
There is some problem with this realization though - it doesn't consider any if's logic and it can't use results gained from previous requests. The process of information exchange between web application and web service must be straightforward since user sends requests to fake proxy web service that can't return real data and results. So we would send data as-is hoping that there would be no results that our process of informational exchange would depend on.
Another option is to digitally sign all requests to web service in real-time. But I can't get how to do it in WCF. I can use IClientMessageInspector and intercept message before it would be sent to web service. In theory I can make some callback at this moment to frontend and wait for user to digitally sign request and then replace original request to user's one. But current realization of web application doesn't allow any callbacks to front end in WCF.
Any thoughts would be highly appreciated.