Configuring WS‑Security UsernameToken Authentication in SOAPUI

Import the WSDL file of your choice. I am using a sample WSDL file from https://www.tutorialspoint.com/.

By default, there is no authentication configured.

Send the default request fora particular API call by clicking the Play button

The raw request will looks like this with no particular authentication headers

Configuring WS-Security UsernameToken Authentication (PasswordText)

Double click on the project name > choose WS-Securith Configuration tab > Add a new outgoing profile with a name of your choice as shown in the screenshot below

Creating outgoing profile

Click the plus button and choose Username from the dropdown box

Fill out username and password and choose Password Text

There are other choices such as PasswordText, Password Digest and PasswordDigest Ext with varying level of password protection security. I chose the PasswordText option for the first demonstration.

Click the Auth menu at the bottom for a particular interface or API call

Choose Add New Authorization

Choose Basic from the dropdown menu

Choose the option that you have created above for WS-Security and make sure Use global preference radio button is active

Now, if you click the Play button to send the request to the server, a WS-Security header will be automatically appended by the SoapUI. The request will look like below.

Username and plaintext password are sent via a new header appended by SOAPUI for outgoing request

You can observe that the password is sent in plaintext which is not a good security practice. You can choose Password Digest or Password Digest Ext options when configuring WS-Security profile for higher security level.

This is when Password Digest option is chosen. The password is no longer in plaintext form

So this is how to easily configure WS-Security through SoapUI than manuall figuring out what headers to append to the raw HTTP request.

Thanks for reading.