SOAP API Service Security
Adeptia lets you secure SOAP-based API services with authentication and message-level security controls, so that only authorized callers can invoke your integrations and the messages they exchange are protected.
What this capability does
A security policy governs how incoming requests are authenticated and how the SOAP messages themselves are signed, encrypted, or validated. This gives you control over who can call the service and what level of message integrity is enforced.
Authentication options
Two authentication mechanisms are available for protecting access to a SOAP API service.
| Authentication type | How it works |
|---|---|
| Basic Authentication | The caller supplies a username and password. Adeptia validates those credentials against the security policy before allowing the request to proceed. If credentials are missing or invalid, the request is rejected with an appropriate error. |
| Kerberos Authentication | The caller presents a Kerberos (SPNEGO) token. Adeptia validates the token and, on success, makes the authenticated principal identity available to the integration for downstream use. If the token is absent or invalid, the request is rejected. |
Message-level security
Beyond transport-level authentication, Adeptia supports WS-Security controls on the SOAP messages themselves. These controls operate in two directions: outbound messages your service sends, and inbound messages your service receives.
Outbound message security
For messages your service sends, you can configure:
- Digital signatures, backed by a keystore you select. The keystore provides the credentials used to sign outgoing messages, giving recipients a way to verify the message has not been tampered with.
- Username token, where a username and password are embedded in the outgoing SOAP security header.
Inbound message security
For messages your service receives, you can configure:
- Decryption, using a keystore you select. Adeptia uses the private key or keystore password from that keystore to decrypt incoming encrypted messages.
- Username token validation, where Adeptia checks the username and password carried in the incoming SOAP security header. You also specify whether the password must arrive as plain text or as a digest; if the incoming message does not match the required format, the request is rejected.
Keystores and security policies
Keystores referenced by the security policy are selected when you configure the policy, keeping credential material organized for use with your services.
Where: Settings (accessible from the Automate portal)