Using the Database To Do Too Much - Implementing Database Security and Auditing - page 222

GRANT CONNECT ON HTTP ENDPOINT::foo_endpoint TO <DOMAIN/USER>
You can also set IP-based restrictions for endpoints to further limit who
can call which Web services endpoint.
SQL Server 2005 supports four authentication options: basic, inte-
grated, digest, and SQL Authentication. Authentication is first done at the
transport level as with Web servers. If that is successful, the user's SID is
used to authenticate with SQL Server 2005. This is true for all options
except SQL Authentication, which is the equivalent to mixed authentica-
tion, in which case the login to SQL Server occurs separately. In this case
the credentials are sent as part of the SOAP packet using WS-Security token
headers. Integrated is based on Windows authentication.
Once the endpoint has been defined and connect permissions enabled,
you can call the stored procedure by sending a SOAP request over HTTP.
The request takes a form similar to the following:
<SOAP-ENV:Envelope
xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/">
<SOAP-ENV:Body>
< foo xmlns="http://tempuri.org"/>
</SOAP-ENV:Body>
</SOAP-ENV:Envelope>
You can ask the server to give you the WSDL using the following URL:
http://<host>/sql/foo?wsdl
Finally, a SOAP body can include a special tag called sqlbatch , which
defines an endpoint for performing ad hoc queries. For example, to query
the Northwind suppliers table, you can use a SOAP command such as:
<SOAP-ENV:Envelope
xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/">
<SOAP-ENV:Body>
<sqlbatch xmlns="http://schemas.microsoft.com/SQLServer/
2001/12/SOAP">
<BatchCommands>
SELECT ContactName, CompanyName FROM Suppliers for XML
AUTO;
</BatchCommands>
</sqlbatch>