How should a SOAP client pass credentials to a Notes Web Service created with Domino Designer 7?
When my (custom) SOAP client tries to access the Notes Service, it gets a SOAPFault (faultcode: soapenv:Server.generalException, faultstring: “NotesException: Notes error: You are not authorized to perform that operation”).
Should I be using one of the WS-Security profiles (which one?) or setting the HTTP Authorization header?
Is the web service security model documented anywhere?
Subject: Same as any HTTP request
You either have to set the authorization header or pass a session cookie. It depends on how your web server is configured.
Subject: Authentication Using SOAP?
But how does the SOAP client get authenticated in the first place?
The HTML client gets a login form and, if successfully authenticated, the server sends it a cookie to be used in subsequent requests. How would a SOAP client send the username/password so that the server would send it a cookie?
I tried attaching an HTTP Authorization header with the base64-encoded username/password on each SOAP request, but the Notes web service rejected it (with the same SOAPFault).
Can someone point me at some sample code that connects a SOAP client to a Notes web service using security? Thanks.
Subject: RE: Authentication Using SOAP?
This is all about HTTP:Client requests data
Server responds with not authorized or something like that
Client requests user name and password from user
Client supplies username and password to server
Server responds with requested data
I haven’t done this myself, but you should study the HTTP protocol to get the answers.
/Peter
Subject: RE: Authentication Using SOAP?
As described in the original post, this is clearly not what’s going on. Rather than get an HTTP 401, requesting credentials, I get an HTTP 200 (success) with a SOAPFault.
I guess we can assume that the web service is not using the HTTP Basic Authentication protocol.
Subject: RE: Authentication Using SOAP?
It could also be that you are expecting basic authentication, but the server is configured for session authentication. You might want to look into that as well.
/Peter