Security in Groove Web Services

  • Article

This section describes security issues for Microsoft Office Groove 2007 and Microsoft Office Groove Data Bridge 2007.

Security Issues on Microsoft Office Groove

When you make Groove Web Services calls, you should always make sure that you use the correct request key, and that you receive the correct response key from Groove. Groove will use the request key to validate that your application is running under the same account.

Testing Response Keys

Your client application should test the response key each time it gets a response from Groove, in order to be certain that it is talking to Groove and not a rogue application. The following code shows you how to test a response key. For more information, see Reading Groove Registry Keys.

string responseKeyFromCall = spacesSvc.GrooveResponseHeaderValue.GrooveResponseKey;

string responseKeyFromRegistry = …;  // Get key from registry
if (responseKeyFromCall != responseKeyFromRegistry)
  throw new Exception ("Response Key does not match expected value.");
}

Security Issues on the Groove Data Bridge

The Groove Data Bridge Remote Groove Web Services provide a mechanism to integrate Groove data with external data in a secure network environment. They are not intended to provide access to Groove data over an unsecured Internet connection. Remote Groove Web Services should be configured and enabled only by a network administrator or a developer who is experienced in implementing secure networks. Remote Groove Web Services are not designed to be configured by end users.

Although access to Remote Groove Web Services requires knowledge of the Groove Web Services RemoteRequestKey for the device providing the service, the remote HTTP connection provided by Groove is not encrypted. If this connection is made unencrypted over an open network, it would be easy for network applications to discover the RemoteRequestKey by listening to the network traffic.

You can only use Groove Web Services Version 2.0 from a remote client; you cannot use the deprecated Version 1.0 Web Services from a remote client.

To ensure that Groove data is secure, you should only enable Groove Remote Web Services under the following conditions:

  • The HTTP connection between the external device and the Groove Data Bridge device providing the service must be made on a connection that is encrypted using a protocol such as Internet Protocol Security (IPSEC). This encryption can be performed by software or hardware. This encryption makes it impossible for a network application to discover the RemoteRequestKey by listening to network traffic.

  • The external ports on the Groove Data Bridge device must be protected by a firewall. Only systems inside the firewall should have access to these ports. Only secure systems should be inside the firewall. The firewall makes it impossible for an insecure device to obtain access to the Remote Groove Web Services even if the RemoteRequestKey has been compromised.

Typically, this secure network environment is provided within a secure data center. All Windows accounts on the system must be trusted.

See Also

Concepts

Programming Practices for Groove Web Services
Reading Groove Registry Keys