Where should my username and password be placed in the POST of a SOAP api

Question

I put the api call together below. At this point i'm not even sure it is correct or not. I need to add my user name and password in but not sure where. Any advice on the placement of the user name and password would be greatly appreciated.

the background for the api call is that it was sent to me in postman where I was able to run it. I was able to pull the body from postman but I need to include authentication within the API call.

enter code here

library(RCurl)

headerFields =
  c(Accept = "text/xml",
    'Content-Type' = "text/xml; charset=utf-8")

body = '<?xml version="1.0" encoding="UTF-8"?>
<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ns1="http://www.sitename.com/bizconnect/SBU">
<SOAP-ENV:Body>
<ns1:GetSBUApplicationData>
<ns1:Subscriber>
<ns1:SubCode>123456</ns1:SubCode>
</ns1:Subscriber>
<ns1:UserID>xxxxxx</ns1:UserID>
<ns1:ReferenceID>A</ns1:ReferenceID>
<ns1:ResponseVersion>010</ns1:ResponseVersion>
<ns1:Application>
<ns1:Id>G020D</ns1:Id>
<ns1:Name/>
<ns1:Key>
<ns1:Field>
<ns1:Id>00920000</ns1:Id>
<ns1:Name/>
<ns1:Value>900000095</ns1:Value>
</ns1:Field>
</ns1:Key>
</ns1:Application>
</ns1:GetSBUApplicationData>
</SOAP-ENV:Body>
</SOAP-ENV:Envelope>'

curlPerform(url = "https://stg1-ss1.sitename.com/bizconnect/SBU/service",
            httpheader = headerFields,
            postfields = body
)

Did you check this https://stackoverflow.com/a/17506657/5086335 — amrrs, Jan 24 '19 at 05:33
Can we have a little more detail please? There are a bunch ofv different approaches to how the SOAP ebservice might be secured, e.g. Basic Auth, WS-Security etc... A bit more detail on what the authentication method is will makes it easy enough to provide the correct answer. — Chris J.T. Auld, Jan 27 '19 at 21:59

score 4 · Accepted Answer · answered Jan 27 '19 at 22:14

OK. For the moment, given that it works fine for you in postman, I'm going to assume that the service is running with Basic Authentication.

In this case, you don't need to include auth details in the SOAP envelope, instead the authn is happening at the HTTP level.

Suggest trying something like this;

curlPerform(url = "https://stg1-ss1.sitename.com/bizconnect/SBU/service",
        httpheader = headerFields,
        postfields = body, userpwd = "user:password")

For more details I would suggest reviewing section 4.2 of the JStatSoft paper for RCurl which is here: http://www.omegahat.net/RCurl/RCurlJSS.pdf

I am not a huge fan of inc including credentials in code files, so I would also suggest reviewing the guidance in the paper on how to externalise the credentials into a separate password file. This way you do not end up accidentally checking credentials into your version control.

Thanks, Basic authentication is what is being used. I am having a new issue with SSL but I am able to get a successful authentication. I've got the pdf from above ready to read tonight. Thanks! — I_AM_JARROD, Jan 28 '19 at 02:18

Where should my username and password be placed in the POST of a SOAP api

1 Answers1